THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question

Revision history  [back]

Revision 2
hugo.vanderkooij's avatar
76
hugo.vanderkooij
updated 2024-03-20 13:03:09 +0000

You can track hostname in TLS traffic with fields like:

tls.handshake.extensions_server_name
ssl.handshake.extensions_server_name
x509sat.printableString

If you know what name to match in the query then you find what is used. However it seems you are in for a game of "whack a mole".

Revision 1
hugo.vanderkooij's avatar
76
hugo.vanderkooij
answered 2024-03-20 13:02:29 +0000

You can track hostname in TLS traffic with fields like:

like:
tls.handshake.extensions_server_name
ssl.handshake.extensions_server_name
x509sat.printableString
x509sat.printableString

If you know what name to match in the query then you find what is used. However used. Howeve it seems you are in for a game of "whack a mole".