[MrOwen]

I think this is only true if SNI is disabled. Otherwise you really only get the IP of SRC and DEST.

[appointment]

SNI relies on the client specifying the host name in the unencrypted ClientHello message that initiates a TLS handshake. Encrypted Client Hello involves extra configuration that most websites don't implement.