Wireshark and SNI

Sometimes it is needed to capture the SNI = server name indication. This information is encapsulated in client’s SSL Hello message.

To filter SNI in pcap file:

ip.addr == 20.108.184.198 && ssl.handshake.extension.type == 0

Example:

Author: pawel