[nneonneo]

You can recover SNI if you sniff from the very beginning, but not thereafter. It’s only sent once as part of the initial TLS handshake.