@SeanWrightSec tshark -i eth0 -Y "ssl.handshake" -T fields -e ssl.handshake.extensions_server_name Suggests it's being set correctly, might be worth checking against your attempt tho