
_A close-up shot of a water droplet hanging from a stainless steel faucet, highlighting surface tension_

This project is a network traffic analysis built around a single question:
what does a TLS connection actually reveal before encryption exists? Using
tcpdump to capture live traffic on a Kali Linux interface and Wireshark to
analyze it, the project traces a full TLS 1.3 handshake from the first
plaintext bytes through to a decrypted HTTPS response.

The core finding is the Server Name Indication (SNI) field inside the TLS
ClientHello message. Even though the rest of an HTTPS connection is
encrypted, the SNI field travels in plaintext, because it's sent before any
session keys are negotiated. That means the destination hostname is visible
to anyone capturing traffic on the network, regardless of encryption. The
project also includes a separate decryption walkthrough, using the
SSLKEYLOGFILE environment variable to have Wireshark decrypt a live HTTPS
session directly, confirming what's actually inside the encrypted traffic
once the keys are available.

## More on this project

This isn't a summary of the whole investigation. The full walkthrough,
including the tcpdump commands, the Wireshark analysis steps, the
SSLKEYLOGFILE decryption process, and the TLS 1.2-versus-1.3 handshake
comparison, is written up in full in the
project README on GitHub.


A network traffic analysis using Wireshark and tcpdump that captures a TLS handshake and shows how the destination hostname still leaks in plaintext through the SNI field.

projects tag: pcap

TLS SNI Leak Analysis