Wireshark change column displayed

Owned by Jean-luc KRIKER
Last updated: Sept 11, 2022
2 min read

https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/


Use a different Profile
Add a new Column

move the colunm

Edit the colunm

SNI in TLS packetSNI and ESNI or Server Name Indication in TLS hanshake

Select the TLS "Client Hello" >> look for the extension: server-name


create a filtertls.handshake.extensions_server_name == "weberblog.net"
use the filter

in the colunm just use the filter:  tls.handshake.extensions_server_name