I have made research long time ago to construct a capture filter for TLS packets only. I am not sure if I got it right. I tested it but need an expert to check and confirm to me if possible please:
Does this filter capture TLS (port 443, https) packets?
tcp port 443 and tcp[tcp[12]/16*4]=22
