Why am I seeing TLS running over HTTP?
How is it that whireshark places TLS over HTTP whereas in the OSI model, TSL belongs to layers 5 and 6 while HTTP to layer 7 ?
with OSI model
layer 7 : HTTP layer 5 and 6: TLS
with wireshark:
Frame Internet II IPv4 TCP Hypertext transfert Protocol Transport Layer Security
Thank you for any help.
Can you share the capture that shows this behaviour? Use a public share such as CloudShark, Google Drive or DropBox etc. and post a link back here.
For normal https traffic, Wireshark doesn't place TLS over HTTP.
If you're seeing HTTP over TCP and TLS over HTTP, that's something unusual, so we'd need to see a capture of that traffic to see what's being done there.