Glossary
SNI (Server Name Indication)
SNI is the TLS extension in which a client names the server host it wants. It is visible in the ClientHello and shows the destination of encrypted sessions.
Server Name Indication (SNI) is a TLS extension, defined in RFC 6066, in which the client states the hostname it wants to reach. It lets one IP address host many TLS sites, each with its own certificate. SNI is carried in the ClientHello, before encryption starts.
For network analysis this makes SNI one of the most useful fields in encrypted traffic: it names the destination of a session even though the content is unreadable. Encrypted Client Hello (RFC 9849) hides the real name inside an encrypted inner ClientHello, leaving only a public name visible. PCAP Parser shows the SNI of every TLS session it finds; see JA3 and JA4 TLS fingerprinting.