2 ms·
The two "application data" records at the bottom are what would wrap around a request/response for an established connection - you can see how much is added to
by syncsynchalt 8y ago
The two "application data" records at the bottom are what would wrap around a request/response for an established connection - you can see how much is added to make the strings "ping" and "pong" (though some of that is padding to expand it to a multiple of 16 bytes).
And much of the rest of the records might go away completely if the session were resumed from the client's memory (this wasn't demonstrated here).