TLS handshake
SNI Filtering
Blocking HTTPS connections by inspecting the Server Name Indication field.
Read the definitionThe definition and detection notes below retain the published reference wording. They are not a current network test.
01 / Definition
What it means.
SNI (Server Name Indication) filtering exploits the fact that during TLS handshakes, the destination hostname is transmitted in plaintext before encryption begins. Network equipment can inspect this field and terminate connections to blocked domains.
This technique is more sophisticated than DNS blocking because it works even when users use alternative DNS resolvers. It requires deep packet inspection (DPI) infrastructure and is commonly deployed in countries with advanced censorship capabilities.
02 / How We Detect This
What we look for.
We attempt TLS handshakes to known endpoints and monitor for connection resets, timeouts, or injected responses during the handshake phase. When DNS resolves correctly but TLS connections fail specifically for certain domains while other domains on the same IP succeed, we identify SNI-based filtering.
03 / Examples
What it can look like.
TLS handshake reset after SNI is sent
Connection timeout during TLS negotiation
Successful connection when using encrypted SNI (ESNI)
Illustrative examples from the glossary, not incident reports or live observations.
Sources
Read the original.
Reference context & original shorthand
Published bypass label: Moderate to bypass.
This is the original index’s editorial shorthand. Actual access depends on the network and technique; this label is not a guarantee. The glossary has no per-entry publication or review date.
Related links lead to definitions in the published glossary.
Complete definition →