RTFM && WTFN - backup

tcpdump -nnee -i eth1 -c 10

tcpdump -nn -vvv -i en0 -s 1500 -c 1 'ether[20:2] == 0x2000

[root@blackpc ~]# tcpdump -i eth1 -n -c 300 "broadcast or multicast"

Применяем фильтры (в зависимости от версии Wireshark):

• ssl.handshake.extensions_server_name
• ssl.handshake.extension.type == 0
• ssl.handshake.extension.type == “server_name”

Далее в отфильтрованном смотрим на поле “Server Name:”.
Путь: Secure Sockets Layer –>
TLS Record Layer –>
Handshake Protocol: Client Hello –>
Extension: server_name –>
Server Name Indication extension –>
Server Name: xakep.ru

Используем ssl.handshake.extension.data contains “xakep.ru” когда надо отфильтровать пакеты с определенным SNI.

tcpdump -i eth1 -s 1500 -X  '(tcp[((tcp[12:1] & 0xf0) >> 2)+5:1] = 0x01) and (tcp[((tcp[12:1] & 0xf0) >> 2):1] = 0x16)' 

Пример:

[root@blackpc ~]# tcpdump -i eth1 -s 1500 -X  '(tcp[((tcp[12:1] & 0xf0) >> 2)+5:1] = 0x01)' and 
'(tcp[((tcp[12:1] & 0xf0) >> 2):1] = 0x16)' and host 178.248.232.27
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 1500 bytes
14:44:29.950497 IP x.x.x.x.60044 > 178.248.232.27.https: Flags [P.], seq 2690445558:2690446075, ack 2960121525, win 115, options [nop,nop,TS val 100379054 ecr 1195184343], length 517
 0x0000:  4500 0239 5960 4000 4006 769e c0a8 0d04  E..9Y`@.@.v.....
 0x0010:  b2f8 e81b ea8c 01bb a05c f0f6 b06f deb5  .........\...o..
 0x0020:  8018 0073 6aec 0000 0101 080a 05fb a9ae  ...sj...........
 0x0030:  473d 10d7 1603 0102 0001 0001 fc03 0347  G=.............G
 0x0040:  edab 33fe a68e 1625 904e 404c d99c dc12  ..3....%.N@L....
 0x0050:  645e de6e f35f d2a3 5fe4 920a 51a6 8820  d^.n._.._...Q...
 0x0060:  cf3b 1e81 07e6 a15c 5343 fb04 3e7e a684  .;.....\SC..>~..
 0x0070:  ba9e 5fd3 5ad5 fcf6 5969 21a2 0035 bdbe  .._.Z...Yi!..5..
 0x0080:  0024 c02b c02f 009e c00a c009 c013 c014  .$.+./..........
 0x0090:  c007 c011 0033 0032 0039 009c 002f 0035  .....3.2.9.../.5
 0x00a0:  000a 0005 0004 0100 018f 0000 000d 000b  ................
 0x00b0:  0000 0878 616b 6570 2e72 75ff 0100 0100  ...xakep.ru.....
 0x00c0:  000a 0008 0006 0017 0018 0019 000b 0002  ................
 0x00d0:  0100 0023 00b0 8aec 9689 2d9d 7387 24ef  ...#......-.s.$.
 0x00e0:  1c8d e0b6 08ce 283b c5a7 174b 09cd 43db  ......(;...K..C.
 0x00f0:  87e3 3d9d f4ff 6cc8 c327 a9d3 9537 8e29  ..=...l..'...7.)
 0x0100:  637f 7f7d e146 401c 84c5 b62d 38f6 284c  c..}.F@....-8.(L
 0x0110:  656a d3ab c460 77c2 d024 2b09 cf7c 94ca  ej...`w..$+..|..
 0x0120:  a603 e410 38c9 4154 8ed5 4e67 b871 60ee  ....8.AT..Ng.q`.
 0x0130:  7ad0 e003 ccf4 dd49 67cf 32e8 881d 740d  z......Ig.2...t.
 0x0140:  5ebc 99f3 d08a cf2c f24a 0a28 b5ea 3157  ^......,.J.(..1W
 0x0150:  78fb c9f0 f2ef 87aa bdb2 822c 1c61 d47c  x..........,.a.|
 0x0160:  68b7 b55c 0440 bf26 47f5 d5df acbf 6b3e  h..\.@.&G.....k>
 0x0170:  d45d 7dc1 dd72 0abb abb2 183d 88a1 9237  .]}..r.....=...7
 0x0180:  4cc4 9bfa 70ed 3374 0000 0010 001a 0018  L...p.3t........
 0x0190:  0873 7064 792f 332e 3105 6832 2d31 3408  .spdy/3.1.h2-14.
 0x01a0:  6874 7470 2f31 2e31 0005 0005 0100 0000  http/1.1........
 0x01b0:  0000 1200 0000 0d00 1200 1004 0105 0102  ................
 0x01c0:  0104 0305 0302 0304 0202 0200 1500 6a00  ..............j.
 0x01d0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
 0x01e0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
 0x01f0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
 0x0200:  0000 0000 0000 0000 0000 0000 0000 0000  ................
 0x0210:  0000 0000 0000 0000 0000 0000 0000 0000  ................
 0x0220:  0000 0000 0000 0000 0000 0000 0000 0000  ................
 0x0230:  0000 0000 0000 0000 00                   .........