Hacker News Reader

I think this is only true if SNI is disabled. Otherwise you really only get the IP of SRC and DEST.

SNI relies on the client specifying the host name in the unencrypted ClientHello message that initiates a TLS handshake. Encrypted Client Hello involves extra configuration that most websites don't implement.

Reply on news.ycombinator.com