I'd like to capture the TLS resumption traffic using Wireshark. The traffic is recorded while I open a connection in a tab, close it and then re-enter the url and load again. I've noticed two traffic patterns. One is full handshake. However, the other doesn't seem like a TLS resumption. Any any expert help to confirm it or suggest a correct way to obtain resumption traffic? Thanks.
The screenshot below shows a full handshake
This is another pattern. Can this be TLS resumption pattern? However, it's not like the normal resumption handshake as described in some document