How can you identify the TLS server name used for SNI in Wireshark?

• A. tls.server_name_ext
• B. tls.sni
• C. tls.server_name
• D. tls.hostname

Answer: (C)

The thing to look for is the value inside the Server Name Indication (SNI) extension of the TLS ClientHello. That extension carries the hostname the client is trying to reach, and in Wireshark this field is exposed as tls.server_name. So you can filter or inspect by this field to see the exact server name the client offered during the handshake. Other names like tls.server_name_ext, tls.sni, or tls.hostname aren’t the standard Wireshark display field for this data, so tls.server_name is the correct way to identify the SNI value.