On Tue, Jul 14, 2026 at 12:11:30PM -0700, Philip Guenther wrote:
I suggest that because the version number in a TLSv1.3 client hello is actually “1.2” for middlebox compatibility; cf rfc8446 section 4.1.2. I’m not familiar with whether or how tshark displays the *real* version number.
Yep, I saw that with -V (too much to paste here) Right now, I'm not seeing anything SNI-wise for dns-tls, imaps or ssmtp. I only see it when using e.g. lynx: % doas tshark -r tls-versions-test5.pcap -Y "tcp.port == 443 && tls.handshake.type==1 \ && tls.handshake.extensions_server_name" 1290 56.042036 192.168.1.199 ? 104.16.124.96 TLSv1.2 210 Client Hello (SNI=www.cloudflare.com) 1950 66.882389 192.168.1.199 ? 104.16.124.96 TLSv1.2 210 Client Hello (SNI=www.cloudflare.com) 3381 79.831790 192.168.1.199 ? 104.16.124.96 TLSv1.2 210 Client Hello (SNI=www.cloudflare.com) Maybe I need to manually build lynx from the ports. --
