What is SNI?
Learn how TLS Server Name Indication identifies the requested hostname and how to search indexed SNI values in PacketSafari.
Server Name Indication (SNI) allows a server to host multiple TLS certificates for multiple sites under a single IP address. The client includes the hostname in the TLS ClientHello extension so the server can present the right certificate.
In PacketSafari you can search for SNI values in the capture library (tls.handshake.extensions_server_name:example.com) and pivot into matching packets. SNI is indexed by default for quick autocompletion.