I captured my network traffic to a web server and the SSL Handshake consists only of two packets. Why does that happen and why aren't there all the other packets?
You're probably seeing session resumption. If the Client Hello and Server Hello packets both have the same
Session ID value, then the handshake is shortened as the Client and Server 'recognize' each other.
To quote RFC 5246:
The client sends a ClientHello using the Session ID of the session to be resumed. The server then checks its session cache for a match. If a match is found, and the server is willing to re-establish the connection under the specified session state, it will send a ServerHello with the same Session ID value. At this point, both client and server MUST send ChangeCipherSpec messages and proceed directly to Finished messages.