What is the difference between 'Follow HTTP Stream' and 'Follow TLS Stream'?

• A. Follow HTTP Stream reconstructs the HTTP dialogue; Follow TLS Stream shows TLS handshake and, if decrypted, the HTTP payload
• B. Follow HTTP Stream decrypts TLS
• C. Follow TLS Stream reconstructs all TLS messages including certificate chain
• D. Follow HTTP Stream displays only DNS queries

Answer: (A)

The main idea is that these Follow features operate at different layers of a TLS/HTTP conversation. HTTP Stream is about the actual HTTP dialogue when the traffic is unencrypted. It reassembles and presents the HTTP requests and responses in order, giving you a readable transcript of the conversation. If the traffic is TLS-encrypted, there is no readable HTTP content to show in this view.

TLS Stream, however, focuses on the TLS protocol itself. It shows the TLS handshake and the TLS records that carry the encrypted data. If you have the means to decrypt the session (for example, with the proper keys), you can then see the HTTP payload after decryption. So TLS Stream gives you the handshake details and, potentially, the decrypted HTTP messages.

That’s why the best answer describes Follow HTTP Stream as reconstructing the HTTP dialogue and Follow TLS Stream as showing the TLS handshake and, if decrypted, the HTTP payload. The other descriptions mix up what each view does (for example, HTTP Stream does not decrypt TLS on its own, and DNS queries aren’t the focus of the HTTP stream view).