Packet Continuum’s DPI Engine logs Server Name Indicator(SNI) for each TLS session. As majority of web traffic is TLS based (estimated to be over 90%), an aggregation of TLS sessions based on SNI will allow analysts to know which applications are being used by the users in violation of one or more policies.