# G0 2026-10-26: TLS handshakes seen on the tunnel node (capture 121641-0d72, ports 443, VM [redacted])
# pcap sha256: 064577d341753e892d4a9758d9f57f045c98141f531465c2a41c71391e98ac6d  (kept at ~/.config/all-e2e/captures/, ciphertext + metadata only)
# parsed with the ClientHello/ServerHello parser in scripts/e2e_handshake_report.py; SNI [redacted]... = the device; other SNIs are the VM's own Azure traffic or a scanner
[redacted] SNI= [redacted].blob.core.windows.net | client offers groups ['X25519', 'secp256r1', 'X448', 'secp521r1', 'secp384r1', 'ffdhe2048', '0x101', '0x102', '0x103', '0x104'] key_share ['X25519'] versions ['TLS1.3', 'TLS1.2'] alpn ['h2', 'http/1.1']
      -> server chose: {'type': 'ServerHello', 'cipher': 'TLS_AES_256_GCM_SHA384', 'group': 'secp384r1', 'version': 'TLS1.3'}
9.129.55.42 SNI= [redacted].centralus.cloudapp.azure.com | client offers groups ['X25519MLKEM768', 'X25519', 'secp256r1', 'X448', 'secp384r1', 'secp521r1', 'ffdhe2048', '0x101'] key_share ['X25519MLKEM768', 'X25519'] versions ['TLS1.3', 'TLS1.2'] alpn ['http/1.1']
      -> server chose: {'type': 'ServerHello', 'cipher': 'TLS_AES_256_GCM_SHA384', 'group': 'X25519MLKEM768', 'version': 'TLS1.3'}
9.129.55.42 SNI= [redacted].centralus.cloudapp.azure.com | client offers groups ['X25519MLKEM768', 'X25519', 'secp256r1', 'X448', 'secp384r1', 'secp521r1', 'ffdhe2048', '0x101'] key_share ['X25519MLKEM768', 'X25519'] versions ['TLS1.3', 'TLS1.2'] alpn ['http/1.1']
      -> server chose: {'type': 'ServerHello', 'cipher': 'TLS_AES_256_GCM_SHA384', 'group': 'X25519MLKEM768', 'version': 'TLS1.3'}
9.129.55.39 SNI= [redacted].centralus.cloudapp.azure.com | client offers groups ['X25519MLKEM768', 'X25519', 'secp256r1', 'X448', 'secp384r1', 'secp521r1', 'ffdhe2048', '0x101'] key_share ['X25519MLKEM768', 'X25519'] versions ['TLS1.3', 'TLS1.2'] alpn ['http/1.1']
      -> server chose: {'type': 'ServerHello', 'cipher': 'TLS_AES_256_GCM_SHA384', 'group': 'X25519MLKEM768', 'version': 'TLS1.3'}
[redacted] SNI= [redacted] | client offers groups ['0xe', '0xd', 'secp521r1', '0x1c', '0xb', '0xc', '0x1b', 'secp384r1', '0x9', '0xa', '0x1a', '0x16', 'secp256r1', '0x8', '0x6', '0x7', '0x14', '0x15', '0x4', '0x5', '0x12', '0x13', '0x1', '0x2', '0x3', '0xf', '0x10', '0x11'] key_share [] versions [] alpn ['\x01']
      -> server chose: None
9.129.55.37 SNI= [redacted].centralus.cloudapp.azure.com | client offers groups ['X25519MLKEM768', 'X25519', 'secp256r1', 'X448', 'secp384r1', 'secp521r1', 'ffdhe2048', '0x101'] key_share ['X25519MLKEM768', 'X25519'] versions ['TLS1.3', 'TLS1.2'] alpn ['http/1.1']
      -> server chose: {'type': 'ServerHello', 'cipher': 'TLS_AES_256_GCM_SHA384', 'group': 'X25519MLKEM768', 'version': 'TLS1.3'}
[redacted] SNI= [redacted].blob.core.windows.net | client offers groups ['X25519', 'secp256r1', 'X448', 'secp521r1', 'secp384r1', 'ffdhe2048', '0x101', '0x102', '0x103', '0x104'] key_share ['X25519'] versions ['TLS1.3', 'TLS1.2'] alpn ['http/1.1']
      -> server chose: {'type': 'ServerHello', 'cipher': 'TLS_AES_256_GCM_SHA384', 'group': 'secp384r1', 'version': 'TLS1.3'}