What is SNI, and why does it matter for monitoring?

Server Name Indication (SNI) is a field in the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. ClientHello where the client names the site it wants, such as login.example.com, because many sites share one IP address and the server must know which certificate to present. It is sent before encryption starts, so anyone on the path can read it. For monitoring it is one of the most useful fields in encrypted traffic: it names the service behind an IP address, which helps tell an AI assistant, a file-sharing site or a known business application from an unknown server, without reading any content. Most web filters and many firewalls rely on it too. Two things reduce its value: connections made straight to an IP address carry no meaningful name, and Encrypted Client Hello (ECH) hides the real name behind a public front name. DNS answers and the history of each destination then matter more. NetSenX reads the server name from the handshake where its agent captures packets, on Linux or as a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it./TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. sensor.

← All 40 questions on Encryption and encrypted trafficAll topics