TLS SNI Leak Analysis
Monday, August 17, 2026 at 10:02 AM | 1 min read
Last modified on Monday, August 17, 2026 at 11:15 AM
A close-up shot of a water droplet hanging from a stainless steel faucet, highlighting surface tension
This project is a network traffic analysis built around a single question: what does a TLS connection actually reveal before encryption exists? Using tcpdump to capture live traffic on a Kali Linux interface and Wireshark to analyze it, the project traces a full TLS 1.3 handshake from the first plaintext bytes through to a decrypted HTTPS response.
The core finding is the Server Name Indication (SNI) field inside the TLS ClientHello message. Even though the rest of an HTTPS connection is encrypted, the SNI field travels in plaintext, because it's sent before any session keys are negotiated. That means the destination hostname is visible to anyone capturing traffic on the network, regardless of encryption. The project also includes a separate decryption walkthrough, using the SSLKEYLOGFILE environment variable to have Wireshark decrypt a live HTTPS session directly, confirming what's actually inside the encrypted traffic once the keys are available.
This isn't a summary of the whole investigation. The full walkthrough, including the tcpdump commands, the Wireshark analysis steps, the SSLKEYLOGFILE decryption process, and the TLS 1.2-versus-1.3 handshake comparison, is written up in full in the project README on GitHub.