13

Does wireshark have a filter for TLS's Server Name Indication field?

12

ssl.handshake.extensions_server_name

| improve this answer | |
  • 7
    Hello Shawn E. Although this might answer the question, can you provide some additional explanations? Maybe that would be helpful for others. – nixda Jan 21 '13 at 20:20
10

Shawn E's answer is probably the correct answer but my wireshark version doesnt have that filter. Following filters do exists, however:

To check if the SNI field exists:

ssl.handshake.extension.type == 0

or

ssl.handshake.extension.type == "server_name"

To check if an extension contains certain domain:

ssl.handshake.extension.data contains "twitter.com"
| improve this answer | |
  • 3
    here's what worked for me: tls.handshake.extensions_server_name contains "twitter.com" – Alexey Andronov Sep 13 '19 at 4:46
2

Newer Wireshark has R-Click context menu with filters.

Find Client Hello with SNI for which you'd like to see more of the related packets.

Drill down to handshake / extension : server_name details and from R-click choose Apply as Filter.

See attached example caught in version 2.4.4

SNI-WireShark-contextFilter

| improve this answer | |
1

For a more complete example, here's the command to show SNIs used in new connections:

tshark -p -Tfields -e ssl.handshake.extensions_server_name \ 
    -Y 'ssl.handshake.extension.type == "server_name"'

(This is what your ISP can easily see in your traffic.)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.