How to inspect TLS SNI and certificates in a PCAP

Encrypted application data does not make every handshake field invisible. Depending on the TLS version, capture position and use of ECH, a passive capture may still reveal server names, negotiated versions, cipher suites and certificate details.

1. Find the handshake, not just port 443

Filtering on tcp.port == 443 misses TLS on non-standard ports and includes protocols such as QUIC that do not use TCP. Start with Wireshark's decoded protocol:

tls.handshake

For a compact tshark inventory:

tshark -r capture.pcapng -Y "tls.handshake" -T fields \
  -e frame.number -e ip.src -e ip.dst \
  -e tls.handshake.type -e tls.handshake.version

If no handshake is visible, the capture may have started after the connection was established, the traffic may use QUIC, the relevant packets may be missing, or the dissector may not recognise the flow as TLS.

2. Extract visible server names

The Server Name Indication extension normally appears in the ClientHello. Filter it with:

tls.handshake.extensions_server_name

Export unique observed names with tshark:

tshark -r capture.pcapng \
  -Y "tls.handshake.extensions_server_name" \
  -T fields -e tls.handshake.extensions_server_name \
  | sort -u

SNI is useful for discovering which named services a client attempted to reach, but it is not proof of the content transferred. One IP can host many names, a connection can fail after ClientHello, and Encrypted ClientHello can hide the real server name.

3. Review versions and cipher suites

Inspect both the client's offered capabilities and the server's negotiated choice. In modern TLS, version negotiation can be represented by the Supported Versions extension rather than the legacy record-layer version field. Rely on Wireshark's interpreted handshake fields rather than reading one raw version value in isolation.

Useful filters include:

tls.handshake.type == 1   # ClientHello
tls.handshake.type == 2   # ServerHello
tls.handshake.ciphersuite

A client offering an old option does not prove it was selected. Conversely, a negotiated legacy version or weak suite deserves context: confirm the handshake completed and identify the server endpoint before escalating.

4. Inspect certificates when they are visible

For TLS versions where the Certificate handshake is visible to the passive observer, Wireshark can decode subjects, issuers, validity dates and subject alternative names. Start with:

tls.handshake.certificate

Check whether the certificate was valid at the time of the capture, not merely today. A self-signed certificate may be intentional on a managed internal service; an expired public-facing certificate may be operationally important. Name mismatches also require the requested hostname, which may be absent or encrypted.

5. Know what passive TLS analysis cannot show

• TLS 1.3 encrypts most handshake messages after ServerHello, including the certificate. Without session secrets, a passive capture normally cannot expose those details.
• ECH can conceal the real SNI from passive observers.
• QUIC carries TLS handshake data differently and needs QUIC-aware analysis.
• A capture taken mid-session may contain application records but no handshake metadata.
• Visible SNI identifies a requested name, not user intent or maliciousness.

Manual method vs PCAPNG Analyzer