Skip to content

Instantly share code, notes, and snippets.

@tlwr

tlwr/sni.bash

Created January 29, 2021 12:41
Show Gist options
  • Save tlwr/9636ff788ce79f5151963aa1b3101635 to your computer and use it in GitHub Desktop.
Save tlwr/9636ff788ce79f5151963aa1b3101635 to your computer and use it in GitHub Desktop.
Download ZIP
netsniff
Raw
sni.bash
#!/usr/bin/env bash
# Check if SNI is visible or if the TLS client uses ECH or ESNI
# Looks at the Client Hello and Handshake
# https://serverfault.com/questions/574405/tcpdump-server-hello-certificate-filter
tcpdump -X -i any -s 2048 -nn '(tcp[((tcp[12:1] & 0xf0) >> 2)+5:1] = 0x01) and (tcp[((tcp[12:1] & 0xf0) >> 2):1] = 0x16)'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment