Which view shows the TLS handshake and, if decrypted, the HTTP payload?

• A. Follow TLS Stream shows TLS handshake and, if decrypted, the HTTP payload
• B. Follow HTTP Stream reconstructs HTTP dialogue
• C. Follow TLS Stream shows DNS queries
• D. Follow TLS Stream deletes data

Answer: (A)

Wireshark’s Follow TLS Stream view collects all packets from one TLS session, so you can see the entire handshake sequence (ClientHello, ServerHello, certificate exchange, and so on) in one place. If you provide TLS keys to enable decryption, that same view will also reveal the HTTP payload inside the TLS records, showing the actual HTTP requests and responses. Without decryption, the HTTP content remains encrypted, so you only see the TLS handshake and the encrypted application data. The HTTP dialogue itself is typically reconstructed by the Follow HTTP Stream view, which only becomes meaningful after decryption or when the traffic is not TLS-encrypted. The other options don’t fit because they describe different flows or nonsensical actions.