Demo data. No capture tables were found in my_pcap. Configure MOTHERDUCK_CONN_TABLE (and friends) or load your Zeek output to investigate a real capture.

Filters

→

TLS

Handshakes, SNI, versions and certificates. Missing SNI is highlighted — it is rare in normal traffic.

TLS connections

Unique SNIs

Missing SNI

Issuers

TLS versions

Protocol versions.

Ciphers

Negotiated cipher suites.

Certificate issuers

By handshake count.

Handshakes

Filtered TLS log. Rows without SNI are flagged.