# What is SNI, and why does it matter for monitoring?

Server Name Indication (SNI) is a field in the TLS ClientHello where the client names the site it wants, such as login.example.com, because many sites share one IP address and the server must know which certificate to present. It is sent before encryption starts, so anyone on the path can read it. For monitoring it is one of the most useful fields in encrypted traffic: it names the service behind an IP address, which helps tell an AI assistant, a file-sharing site or a known business application from an unknown server, without reading any content. Most web filters and many firewalls rely on it too. Two things reduce its value: connections made straight to an IP address carry no meaningful name, and Encrypted Client Hello (ECH) hides the real name behind a public front name. DNS answers and the history of each destination then matter more. NetSenX reads the server name from the handshake where its agent captures packets, on Linux or as a SPAN/TAP sensor.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/what-is-sni-and-why-does-it-matter-for-monitoring

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is Encrypted Client Hello (ECH)?](https://netsenx.com/en/faq/what-is-encrypted-client-hello)
- [Does Encrypted Client Hello blind network monitoring?](https://netsenx.com/en/faq/does-encrypted-client-hello-blind-network-monitoring)
- [Do QUIC and HTTP/3 blind firewalls?](https://netsenx.com/en/faq/do-quic-and-http3-blind-firewalls)
- [Can DNS over HTTPS hide traffic from security monitoring?](https://netsenx.com/en/faq/can-dns-over-https-hide-traffic-from-security-monitoring)
- [How do I decrypt TLS traffic for troubleshooting?](https://netsenx.com/en/faq/how-to-decrypt-tls-for-troubleshooting)