voidly
Research

TLS handshake

SNI Filtering

Blocking HTTPS connections by inspecting the Server Name Indication field.

Read the definition
A hostname in the handshake.Concept illustration · not a live measurement
From the glossary

The definition and detection notes below retain the published reference wording. They are not a current network test.

01 / Definition

What it means.

SNI (Server Name Indication) filtering exploits the fact that during TLS handshakes, the destination hostname is transmitted in plaintext before encryption begins. Network equipment can inspect this field and terminate connections to blocked domains.

This technique is more sophisticated than DNS blocking because it works even when users use alternative DNS resolvers. It requires deep packet inspection (DPI) infrastructure and is commonly deployed in countries with advanced censorship capabilities.

02 / How We Detect This

What we look for.

We attempt TLS handshakes to known endpoints and monitor for connection resets, timeouts, or injected responses during the handshake phase. When DNS resolves correctly but TLS connections fail specifically for certain domains while other domains on the same IP succeed, we identify SNI-based filtering.

Published method descriptionFull methodology ↗

03 / Examples

What it can look like.

  • TLS handshake reset after SNI is sent

  • Connection timeout during TLS negotiation

  • Successful connection when using encrypted SNI (ESNI)

Illustrative examples from the glossary, not incident reports or live observations.

Sources

Read the original.

Reference context & original shorthand

Published bypass label: Moderate to bypass.

This is the original index’s editorial shorthand. Actual access depends on the network and technique; this label is not a guarantee. The glossary has no per-entry publication or review date.

Related links lead to definitions in the published glossary.

Complete definition →

Keep exploring.

All terms →