How does wireshark read TCP headers

edit

I think you are trying to capture 802.11 traffic and expect it to be encrypted. To access this type of traffic, you need to collect the traffic using some type of monitor mode interface that can do an OTA (over the air) capture. A good starting reference: https://wiki.wireshark.org/CaptureSetup/WLAN

The AP bridges wireless to wired traffic at layer 2 as you say; so it is true that layer 3 and above would be encrypted, if encryption is in use. So, be sure you have encryption turned on as this could be one of your causes.

Another possible issue is the interface you are capturing on. For best results, capture in monitor mode / promiscuous mode on an adapter not in use by the communications. Avoid using the actual AP interface until you know how it behaves, and avoid the bridge interface it may be on, or the wired interface that is bridged to it. If you just capture on the wireless interface not in monitor mode, the driver will decrypt the traffic and convert it to EthernetII, hiding what you are looking for.

My textbook knowledge tells me that the AP is a layer 2 device. So how does the trace collected from the AP provide access to layer 4 (TCP) headers?

The trace contains the entire contents of the packet; the AP might not look at headers above layer 2, but it does have to forward them to the end station, so they have to be present in the packets, and, as such, they get written to the pcap file by tcpdump.

I assumed that there would some kind of layer 4 encryption that would only allow decryption at the end-points (i.e. either the server or the client). The AP is an intermediate point (neither the server nor the client). I can also see TLS label on the packets. So how was the TCP header decrypted?

No, TLS doesn't encrypt TCP headers, it encrypts headers above the TCP layer, if it's running atop TCP.

The wireless network may also be doing layer 2 encryption (WEP/WPA), which encrypts at layer 3 (IP) and above, but either that's not the case or the AP is decrypting the packets itself and saving them to the capture file.