Filter in Wireshark for TLS's Server Name Indication field

ssl.handshake.extensions_server_name


Shawn E's answer is probably the correct answer but my wireshark version doesnt have that filter. Following filters do exists, however:

To check if the SNI field exists:

ssl.handshake.extension.type == 0

or

ssl.handshake.extension.type == "server_name"

To check if an extension contains certain domain:

ssl.handshake.extension.data contains "twitter.com"

Newer Wireshark has R-Click context menu with filters.

Find Client Hello with SNI for which you'd like to see more of the related packets.

Drill down to handshake / extension : server_name details and from R-click choose Apply as Filter.

See attached example caught in version 2.4.4

SNI-WireShark-contextFilter

Tags:

Wireshark