In my organization we have a cloud proxy that work on a loopback address. The vendor of this proxy has deployed an app on our machine which listens on the loopback address.
I have captured the apps traffic with Wireshark. You can see it below:
Also, I have captured traffic on the wifi interface or adapter as well, which is the actual interface of my laptop. You can see the capture below:
On the wifi interface, I can see that there is an "HTTP connect" packet which is being sent which is totally fine as its proxy devices and I expect that but the problem is that I am not able to see the client hello and server hello or any other SSL handshake packet. So I want to know where these packets are gone, although it is an encrypted traffic.
Also, just additional information: This app create an unencrypted HTTP micro tunnel to their server or cloud(proxy) and in these micro tunnels the traffic is being sent but how my Facebook (which is an encrypted traffic being sent without SSL packets although my application is creating an SSL handshake packets and these micro tunnels are being created for every session)
Analyze | Decode As
and add an entry for the port (443) and the protocol you want to use for decoding (SSL). If this does not work please provide the pcap in question as download. – Steffen Ullrich Sep 4 '19 at 16:19