 | 1 | initial version |
So the initial TCP handshake takes place normally (why didn't you include that?), the TCP connection is then handed over to some TLS entity. Obviously the TLS entity isn't available until after 15 seconds from when the TCP socket has been opened, hence the retransmissions. So you should be looking at that TLS handler. All assuming there's no intervening network equipment, eg. load balancers, firewalls, etc. So with this little information there's little to tell, really.
