A 'feature_extract_plugin' repo built for MESA Lab's sapp platform (using the same '*_entry.cpp' plugin-registration pattern seen elsewhere in sapp's plugin family) implements dedicated SSL/TLS parsing and statistics entry points (sslparse_entry.cpp, sslstat_entry.cpp) alongside a generic stream-statistics entry (stmstat_entry.cpp), indicating sapp has an extensible plugin architecture specifically for extracting TLS-connection features -- consistent with TLS fingerprinting / classifier feature extraction -- beyond the base DPI engine.

The same 224-column TSG per-session log schema carries a full TLS- interception field set — proxy_pinning_status, proxy_intercept_status, proxy_passthrough_reason, proxy_cert_verify, proxy_intercept_error, sc_rsp_raw and sc_rsp_decrypted (raw vs. decrypted server response content) — plus ssl_esni_flag and ssl_ech_flag (explicit ECH/ESNI-usage flags), ssl_ja3_hash/ssl_ja3s_hash, and ssh_hassh (SSH client fingerprinting), confirming certstore-style MITM interception, ECH/ESNI detection, and TLS/SSH fingerprinting are all first-class fields logged on every session, not experimental add-ons.

A 2020 MESA Lab monthly report describes building a sapp plugin that extracts packet-sequence features specifically "for DoH (DNS-over-HTTPS) service discovery," alongside a broader CSTNET DoH measurement-report effort and configuring a DNS-to-DoH gateway -- confirming sapp is used to fingerprint DoH traffic via statistical sequence features rather than plaintext DNS content.

MESA Lab researcher notes on an encrypted-video-identification project describe adding SSL-layer information output to more precisely trace a flow's true source/identity, and considering reinforcement learning so the identification model adapts as network conditions change, working within/around sapp's plugin limitations.

A raw TSG session-log export shows the full production log schema: per-flow fields include subscriber_id, imei, imsi, phone_number and apn alongside ssl_ja3_hash/ja3s_hash, ssl_esni_flag, ssl_ech_flag, quic_sni, dtls_ja3_fingerprint, and proxy_pinning_status/proxy_intercept_status/ proxy_cert_verify fields for the MITM proxy path. This confirms TSG's session logging natively joins network-flow identity to subscriber identity and captures TLS fingerprint/ESNI-ECH state and MITM-interception outcome in the same record.

The MESA_Platform/gquic sapp plugin extracts SNI and User-Agent across a wide range of QUIC implementations/versions (Google QUIC 23/25/33/34/35/37/39/41/43/44/46/48/50, IETF QUIC draft-29 and RFC9000, plus QUANT/PicoQUIC/quic-go/quicly/MsQuic/mvfst/TQUIC), including a dedicated Aug 2021 feature to 'support parsing encrypted SNI for QUIC RFC9000' — i.e. the DPI engine derives/decrypts QUIC Initial-packet protection to recover the TLS ClientHello SNI even from RFC9000's protected header.

A raw production SSL/TLS session log from sapp's monitoring pipeline (timestamps dated 2021-08-23, client IPs in domestic Chinese carrier ranges) shows the per-connection logging schema includes dedicated fields for a captured certificate chain (INDIVIDUAL_CERT_FILE, MIDDLE_CERT_FILE, ROOT_CERT_FILE, CHAIN_CERT_FILE) and for any injected packet (INJECTED_PKT_FILE), alongside SNI and TLS version -- confirming sapp's live SNI-logging and MITM-cert-capture instrumentation was operating against real user traffic to services including huobi.com, steamcommunity.com, and dropbox.com.