171    1.223269    192.168.3.104   47.108.167.197  TCP 66  38415 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM
172    1.238616    47.108.167.197  192.168.3.104   TCP 66  443 → 38415 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1412 SACK_PERM WS=128
173    1.238701    192.168.3.104   47.108.167.197  TCP 54  38415 → 443 [ACK] Seq=1 Ack=1 Win=262400 Len=0
174    1.238879    192.168.3.104   47.108.167.197  TCP 1466    38415 → 443 [ACK] Seq=1 Ack=1 Win=262400 Len=1412 [TCP PDU reassembled in 175]
175    1.238879    192.168.3.104   47.108.167.197  TLSv1.3 486 Client Hello (SNI=vio.vin)
179    1.253799    47.108.167.197  192.168.3.104   TCP 60  443 → 38415 [ACK] Seq=1 Ack=1845 Win=62464 Len=0
180    1.254261    47.108.167.197  192.168.3.104   TLSv1.3 308 Server Hello, Change Cipher Spec, Application Data, Application Data
181    1.254855    192.168.3.104   47.108.167.197  TLSv1.3 134 Change Cipher Spec, Application Data
182    1.255030    192.168.3.104   47.108.167.197  TLSv1.3 146 Application Data
183    1.255217    192.168.3.104   47.108.167.197  TLSv1.3 1161    Application Data
186    1.269661    47.108.167.197  192.168.3.104   TCP 60  443 → 38415 [ACK] Seq=255 Ack=3124 Win=61312 Len=0
187    1.269661    47.108.167.197  192.168.3.104   TLSv1.3 133 Application Data
188    1.269661    47.108.167.197  192.168.3.104   TLSv1.3 125 Application Data
189    1.269738    192.168.3.104   47.108.167.197  TCP 54  38415 → 443 [ACK] Seq=3124 Ack=405 Win=262144 Len=0
190    1.269992    192.168.3.104   47.108.167.197  TLSv1.3 85  Application Data
206    1.306572    47.108.167.197  192.168.3.104   TCP 1466    443 → 38415 [ACK] Seq=405 Ack=3155 Win=61312 Len=1412 [TCP PDU reassembled in 208]
207    1.306572    47.108.167.197  192.168.3.104   TCP 1466    443 → 38415 [PSH, ACK] Seq=1817 Ack=3155 Win=61312 Len=1412 [TCP PDU reassembled in 208]
208    1.306572    47.108.167.197  192.168.3.104   TLSv1.3 1236    Application Data
209    1.306626    192.168.3.104   47.108.167.197  TCP 54  38415 → 443 [ACK] Seq=3155 Ack=4411 Win=262400 Len=0
216    1.308416    47.108.167.197  192.168.3.104   TCP 1466    443 → 38415 [ACK] Seq=4411 Ack=3155 Win=61312 Len=1412 [TCP PDU reassembled in 221]
217    1.308416    47.108.167.197  192.168.3.104   TCP 1466    443 → 38415 [PSH, ACK] Seq=5823 Ack=3155 Win=61312 Len=1412 [TCP PDU reassembled in 221]
218    1.308416    47.108.167.197  192.168.3.104   TCP 1466    443 → 38415 [ACK] Seq=7235 Ack=3155 Win=61312 Len=1412 [TCP PDU reassembled in 221]
219    1.308416    47.108.167.197  192.168.3.104   TCP 1466    443 → 38415 [PSH, ACK] Seq=8647 Ack=3155 Win=61312 Len=1412 [TCP PDU reassembled in 221]
220    1.308416    47.108.167.197  192.168.3.104   TCP 1466    443 → 38415 [ACK] Seq=10059 Ack=3155 Win=61312 Len=1412 [TCP PDU reassembled in 221]
221    1.308416    47.108.167.197  192.168.3.104   TLSv1.3 1303    Application Data
222    1.308416    47.108.167.197  192.168.3.104   TLSv1.3 85  Application Data
223    1.308477    192.168.3.104   47.108.167.197  TCP 54  38415 → 443 [ACK] Seq=3155 Ack=12751 Win=262400 Len=0

171-173：TCP三次握手阶段

175-181：TLS握手

TLS1.2

TLS1.3

数据包信息

数据包基本信息 Frame

Frame 175: 486 bytes on wire (3888 bits), 486 bytes captured (3888 bits) on interface \Device\NPF_{B521975A-A6F6-4E2D-AF1F-49734647DB88}, id 0
    Section number: 1
    Interface id: 0 (\Device\NPF_{B521975A-A6F6-4E2D-AF1F-49734647DB88})
        Interface name: \Device\NPF_{B521975A-A6F6-4E2D-AF1F-49734647DB88}
        Interface description: vEthernet (Hyper-V)
    Encapsulation type: Ethernet (1)
    Arrival Time: Apr 14, 2025 10:17:29.637600000 中国标准时间
    UTC Arrival Time: Apr 14, 2025 02:17:29.637600000 UTC
    Epoch Arrival Time: 1744597049.637600000
    [Time shift for this packet: 0.000000000 seconds]
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 1.238879000 seconds]
    Frame Number: 175
    Frame Length: 486 bytes (3888 bits)
    Capture Length: 486 bytes (3888 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp:tls]
    [Coloring Rule Name: TCP]
    [Coloring Rule String: tcp]

wireshark获取到的数据包基本信息

数据链路层 Ethernet II

Ethernet II, Src: ASUSTekCOMPU_7b:35:8d (04:d4:c4:7b:35:8d), Dst: HuaweiDevice_26:97:02 (30:66:d0:26:97:02)
    Destination: HuaweiDevice_26:97:02 (30:66:d0:26:97:02)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: ASUSTekCOMPU_7b:35:8d (04:d4:c4:7b:35:8d)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IPv4 (0x0800)
    [Stream index: 0]

定义以以太网帧的源MAC地址[^1]和目标MAC地址

网络层 Internet

Internet Protocol Version 4, Src: 192.168.3.104, Dst: 47.108.167.197
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
        0000 00.. = Differentiated Services Codepoint: Default (0)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 472
    Identification: 0x6d0f (27919)
    10. .... = Flags: 0x2, Don't fragment
        0... .... = Reserved bit: Not set
        .1.. .... = Don't fragment: Set
        ..0. .... = More fragments: Not set
    ...0 0000 0000 0000 = Fragment Offset: 0
    Time to Live: 128
    Protocol: TCP (6)
    Header Checksum: 0x0000 [validation disabled]
    [Header checksum status: Unverified]
    Source Address: 192.168.3.104
    Destination Address: 47.108.167.197
    [Stream index: 2]

目标IP和源IP

• Internet Protocol Version 4：使用IPV4
• Time to Live: 128：数据包在路由器中最大条数，每经过1跳-1
• Protocol: TCP (6)：协议类型为TCP

传输层 Transmission

Transmission Control Protocol, Src Port: 38415, Dst Port: 443, Seq: 1413, Ack: 1, Len: 432
    Source Port: 38415
    Destination Port: 443
    [Stream index: 11]
    [Stream Packet Number: 5]
    [Conversation completeness: Incomplete, DATA (15)]
        ..0. .... = RST: Absent
        ...0 .... = FIN: Absent
        .... 1... = Data: Present
        .... .1.. = ACK: Present
        .... ..1. = SYN-ACK: Present
        .... ...1 = SYN: Present
        [Completeness Flags: ··DASS]
    [TCP Segment Len: 432]
    Sequence Number: 1413    (relative sequence number)
    Sequence Number (raw): 318538494
    [Next Sequence Number: 1845    (relative sequence number)]
    Acknowledgment Number: 1    (relative ack number)
    Acknowledgment number (raw): 1465246415
    0101 .... = Header Length: 20 bytes (5)
    Flags: 0x018 (PSH, ACK)
        0. .... .... = Reserved: Not set
        ...0 .... .... = Accurate ECN: Not set
        .... 0... .... = Congestion Window Reduced: Not set
        .... .0.. .... = ECN-Echo: Not set
        .... ..0. .... = Urgent: Not set
        .... ...1 .... = Acknowledgment: Set
        .... .... 1... = Push: Set
        .... .... .0.. = Reset: Not set
        .... .... ..0. = Syn: Not set
        .... .... ...0 = Fin: Not set
        [TCP Flags: ·······AP···]
    Window: 1025
    [Calculated window size: 262400]
    [Window size scaling factor: 256]
    Checksum: 0x9d0c [unverified]
    [Checksum Status: Unverified]
    Urgent Pointer: 0
    [Timestamps]
        [Time since first frame in this TCP stream: 0.015610000 seconds]
        [Time since previous frame in this TCP stream: 0.000000000 seconds]
    [SEQ/ACK analysis]
        [iRTT: 0.015432000 seconds]
        [Bytes in flight: 1844]
        [Bytes sent since last PSH flag: 1844]
    TCP payload (432 bytes)
    TCP segment data (432 bytes)

• Source Port: 38415：本机端口
• Destination Port: 443：目标服务器端口
• Header Length: 20 bytes (5)：TCP Header长度

Client Hello 175

Transport Layer Security
    TLSv1.3 Record Layer: Handshake Protocol: Client Hello
        Content Type: Handshake (22)
        Version: TLS 1.0 (0x0301)
        Length: 1839
        Handshake Protocol: Client Hello
            Handshake Type: Client Hello (1)
            Length: 1835
            Version: TLS 1.2 (0x0303)
                [Expert Info (Chat/Deprecated): This legacy_version field MUST be ignored. The supported_versions extension is present and MUST be used instead.]
                    [This legacy_version field MUST be ignored. The supported_versions extension is present and MUST be used instead.]
                    [Severity level: Chat]
                    [Group: Deprecated]
            Random: 375d1d1404d2f6cd5b666b9cdeb353745514e1e2305ee9bc2cb11ea117d292df
            Session ID Length: 32
            Session ID: 8bac9f0438ad26c4e016f3c08ef942ba65d9381730874644835171a73d39c193
            Cipher Suites Length: 32
            Cipher Suites (16 suites)
                Cipher Suite: Reserved (GREASE) (0x7a7a)
                Cipher Suite: TLS_AES_128_GCM_SHA256 (0x1301)
                Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)
                Cipher Suite: TLS_CHACHA20_POLY1305_SHA256 (0x1303)
                Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b)
                Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)
                Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (0xc02c)
                Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)
                Cipher Suite: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca9)
                Cipher Suite: TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)
                Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)
                Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)
                Cipher Suite: TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)
                Cipher Suite: TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)
                Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
                Cipher Suite: TLS_RSA_WITH_AES_256_CBC_SHA (0x0035)
            Compression Methods Length: 1
            Compression Methods (1 method)
                Compression Method: null (0)
            Extensions Length: 1730
            Extension: Reserved (GREASE) (len=0)
                Type: Reserved (GREASE) (56026)
                Length: 0
                Data: <MISSING>
            Extension: encrypted_client_hello (len=218)
                Type: encrypted_client_hello (65037)
                Length: 218
                Client Hello type: Outer Client Hello (0)
                Cipher Suite: HKDF-SHA256/AES-128-GCM
                    KDF Id: HKDF-SHA256 (1)
                    AEAD Id: AES-128-GCM (1)
                Config Id: 120
                Enc length: 32
                Enc: b7c2b561b6efe0885bd0f5f0bb93d0ca37c029b9bea829690d1e7245346ffe18
                Payload length: 176
                Payload […]: cc96616ca1010141bbb9b6b6625f2a647fe7355f3a75131be4ca9b6da0fec88bbf2fc45851424ca4feb3f285989911a1d4fb42ddeeaa86c04a7ef34f667b14dff32218a7fe2417b283f07d6c7fb251cba51e1eaf9513109f27ff759ee1a8c776f06ebc8e0d0d1f489a64d876141243ff
            Extension: key_share (len=1263) Unknown (4588), x25519
                Type: key_share (51)
                Length: 1263
                Key Share extension
                    Client Key Share Length: 1261
                    Key Share Entry: Group: Reserved (GREASE), Key Exchange length: 1
                        Group: Reserved (GREASE) (27242)
                        Key Exchange Length: 1
                        Key Exchange: 00
                    Key Share Entry: Group: Unknown (4588), Key Exchange length: 1216
                        Group: Unknown (4588)
                        Key Exchange Length: 1216
                        Key Exchange […]: 3f4b9425874aa82365d54bb38a01a8c77b503c2267c5ec6af695cd42946a17a10c8133ab80a8c1b849c4b9180dd1fa2d48022d911873f9629319c41f8613bb3ad4155de6a156a97d9d78236420aecdfbb7f4c54121a913d136bd7af86d9287bb2a8b98a6b8cff2196ac6c20e9b5
                    Key Share Entry: Group: x25519, Key Exchange length: 32
                        Group: x25519 (29)
                        Key Exchange Length: 32
                        Key Exchange: 101faf67a97be3c219d9eeeae6cc042b5059a23b6703b7ff99c2b0ce00b4481a
            Extension: Unknown type 17613 (len=5)
                Type: Unknown (17613)
                Length: 5
                Data: 0003026832
            Extension: signed_certificate_timestamp (len=0)
                Type: signed_certificate_timestamp (18)
                Length: 0
            Extension: renegotiation_info (len=1)
                Type: renegotiation_info (65281)
                Length: 1
                Renegotiation Info extension
                    Renegotiation info extension length: 0
            Extension: compress_certificate (len=3)
                Type: compress_certificate (27)
                Length: 3
                Algorithms Length: 2
                Algorithm: brotli (2)
            Extension: server_name (len=12) name=vio.vin
                Type: server_name (0)
                Length: 12
                Server Name Indication extension
                    Server Name list length: 10
                    Server Name Type: host_name (0)
                    Server Name length: 7
                    Server Name: vio.vin
            Extension: application_layer_protocol_negotiation (len=14)
                Type: application_layer_protocol_negotiation (16)
                Length: 14
                ALPN Extension Length: 12
                ALPN Protocol
                    ALPN string length: 2
                    ALPN Next Protocol: h2
                    ALPN string length: 8
                    ALPN Next Protocol: http/1.1
            Extension: psk_key_exchange_modes (len=2)
                Type: psk_key_exchange_modes (45)
                Length: 2
                PSK Key Exchange Modes Length: 1
                PSK Key Exchange Mode: PSK with (EC)DHE key establishment (psk_dhe_ke) (1)
            Extension: supported_versions (len=7) TLS 1.3, TLS 1.2
                Type: supported_versions (43)
                Length: 7
                Supported Versions length: 6
                Supported Version: Reserved (GREASE) (0x5a5a)
                Supported Version: TLS 1.3 (0x0304)
                Supported Version: TLS 1.2 (0x0303)
            Extension: extended_master_secret (len=0)
                Type: extended_master_secret (23)
                Length: 0
            Extension: session_ticket (len=0)
                Type: session_ticket (35)
                Length: 0
                Session Ticket: <MISSING>
            Extension: status_request (len=5)
                Type: status_request (5)
                Length: 5
                Certificate Status Type: OCSP (1)
                Responder ID list Length: 0
                Request Extensions Length: 0
            Extension: signature_algorithms (len=18)
                Type: signature_algorithms (13)
                Length: 18
                Signature Hash Algorithms Length: 16
                Signature Hash Algorithms (8 algorithms)
                    Signature Algorithm: ecdsa_secp256r1_sha256 (0x0403)
                        Signature Hash Algorithm Hash: SHA256 (4)
                        Signature Hash Algorithm Signature: ECDSA (3)
                    Signature Algorithm: rsa_pss_rsae_sha256 (0x0804)
                        Signature Hash Algorithm Hash: Unknown (8)
                        Signature Hash Algorithm Signature: Unknown (4)
                    Signature Algorithm: rsa_pkcs1_sha256 (0x0401)
                        Signature Hash Algorithm Hash: SHA256 (4)
                        Signature Hash Algorithm Signature: RSA (1)
                    Signature Algorithm: ecdsa_secp384r1_sha384 (0x0503)
                        Signature Hash Algorithm Hash: SHA384 (5)
                        Signature Hash Algorithm Signature: ECDSA (3)
                    Signature Algorithm: rsa_pss_rsae_sha384 (0x0805)
                        Signature Hash Algorithm Hash: Unknown (8)
                        Signature Hash Algorithm Signature: Unknown (5)
                    Signature Algorithm: rsa_pkcs1_sha384 (0x0501)
                        Signature Hash Algorithm Hash: SHA384 (5)
                        Signature Hash Algorithm Signature: RSA (1)
                    Signature Algorithm: rsa_pss_rsae_sha512 (0x0806)
                        Signature Hash Algorithm Hash: Unknown (8)
                        Signature Hash Algorithm Signature: Unknown (6)
                    Signature Algorithm: rsa_pkcs1_sha512 (0x0601)
                        Signature Hash Algorithm Hash: SHA512 (6)
                        Signature Hash Algorithm Signature: RSA (1)
            Extension: ec_point_formats (len=2)
                Type: ec_point_formats (11)
                Length: 2
                EC point formats Length: 1
                Elliptic curves point formats (1)
                    EC point format: uncompressed (0)
            Extension: supported_groups (len=12)
                Type: supported_groups (10)
                Length: 12
                Supported Groups List Length: 10
                Supported Groups (5 groups)
                    Supported Group: Reserved (GREASE) (0x6a6a)
                    Supported Group: Unknown (0x11ec)
                    Supported Group: x25519 (0x001d)
                    Supported Group: secp256r1 (0x0017)
                    Supported Group: secp384r1 (0x0018)
            Extension: Reserved (GREASE) (len=1)
                Type: Reserved (GREASE) (6682)
                Length: 1
                Data: 00
            Extension: pre_shared_key (len=91)
                Type: pre_shared_key (41)
                Length: 91
                Pre-Shared Key extension
                    Identities Length: 38
                    PSK Identity (length: 32)
                        Identity Length: 32
                        Identity: c0adb61665bea1c4754c25096d25e1a88f7b68f5b04398fe0d3d587b00a0917b
                        Obfuscated Ticket Age: 1596269139
                    PSK Binders length: 49
                    PSK Binders
            [JA4: t13d1517h2_8daaf6152771_b6f405a00624]
            [JA4_r: t13d1517h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,0017,001b,0023,0029,002b,002d,0033,44cd,fe0d,ff01_0403,0804,0401,0503,0805,0501,0806,0601]
            [JA3 Fullstring: 771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51-17613-18-65281-27-0-16-45-43-23-35-5-13-11-10-41,4588-29-23-24,0]
            [JA3: 62fc926ac0287a7bf4ffdba12e312d3c]

• Content Type: Handshake (22)：表示这是一个握手消息
• Handshake Protocol: Client Hello：表示这是一个客户端发送的 Client Hello 消息
• Version: TLS 1.2 (0x0303)：表示客户端支持的最高 TLS 版本
• Random：客户端生成的随机数，用户后续密钥生成
• Session ID：会话ID
• Cipher Suites (16 suites)：客户端支持的加密套件，按优先级排序
• Compression Methods：客户端支持的压缩算法
• key_share：客户端生成的公钥
• server_name：SNI
• application_layer_protocol_negotiation：客户端支持的应用层协议，h2，http/1.1
• supported_versions (len=7) TLS 1.3, TLS 1.2：客户端支持的 TLS 版本
• signature_algorithms：客户端支持的签名算法
• pre_shared_key：预共享密钥（PSK）信息，用于会话恢复
• JA4：识别客户端的 TLS 实现

Client Hello ACK 179

179    1.253799    47.108.167.197  192.168.3.104   TCP 60  443 → 38415 [ACK] Seq=1 Ack=1845 Win=62464 Len=0

服务器收到客户端发送的Client Hello后发送的ACK

Server Hello 180

180    1.254261    47.108.167.197  192.168.3.104   TLSv1.3 308 Server Hello, Change Cipher Spec, Application Data, Application Data

Transport Layer Security
    TLSv1.3 Record Layer: Handshake Protocol: Server Hello
        Content Type: Handshake (22)
        Version: TLS 1.2 (0x0303)
        Length: 128
        Handshake Protocol: Server Hello
            Handshake Type: Server Hello (2)
            Length: 124
            Version: TLS 1.2 (0x0303)
                [Expert Info (Chat/Deprecated): This legacy_version field MUST be ignored. The supported_versions extension is present and MUST be used instead.]
                    [This legacy_version field MUST be ignored. The supported_versions extension is present and MUST be used instead.]
                    [Severity level: Chat]
                    [Group: Deprecated]
            Random: 76c64f13513065db08331d4dc30343c390d39da9c014a07ab909725f0183d230
            Session ID Length: 32
            Session ID: 8bac9f0438ad26c4e016f3c08ef942ba65d9381730874644835171a73d39c193
            Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)
            Compression Method: null (0)
            Extensions Length: 52
            Extension: supported_versions (len=2) TLS 1.3
                Type: supported_versions (43)
                Length: 2
                Supported Version: TLS 1.3 (0x0304)
            Extension: key_share (len=36) x25519
                Type: key_share (51)
                Length: 36
                Key Share extension
                    Key Share Entry: Group: x25519, Key Exchange length: 32
                        Group: x25519 (29)
                        Key Exchange Length: 32
                        Key Exchange: ba81c663bf5ee63ca7e41871521f1824a3c6b1e8954ee78dac3e9935f686eb2b
            Extension: pre_shared_key (len=2)
                Type: pre_shared_key (41)
                Length: 2
                Pre-Shared Key extension
                    Selected Identity: 0
            [JA3S Fullstring: 771,4866,43-51-41]
            [JA3S: 2253c82f03b621c5144709b393fde2c9]
    TLSv1.3 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec
        Content Type: Change Cipher Spec (20)
        Version: TLS 1.2 (0x0303)
        Length: 1
        Change Cipher Spec Message
    TLSv1.3 Record Layer: Application Data Protocol: Hypertext Transfer Protocol
        Opaque Type: Application Data (23)
        Version: TLS 1.2 (0x0303)
        Length: 36
        Encrypted Application Data: f3656c44f284ac0921dd2456aae5afcc1d66cfba0fbee710a3cae53184d07bbd0c361cc6
        [Application Data Protocol: Hypertext Transfer Protocol]
    TLSv1.3 Record Layer: Application Data Protocol: Hypertext Transfer Protocol
        Opaque Type: Application Data (23)
        Version: TLS 1.2 (0x0303)
        Length: 69
        Encrypted Application Data: 101e5d5c276c7f466f820a8f789ad4ceb2638db452a23854b2f02852681414dff44098e0f7af586ae4dd4d35bc4a8ad97c2e1b64ce6be27fed2ec01c4585bedea884a37892
        [Application Data Protocol: Hypertext Transfer Protocol]

• TLSv1.3 Record Layer: Handshake Protocol: Server Hello：TLS层基本信息，Server Hello表示握手消息
• Handshake Protocol: Server Hello：握手消息的具体类型和长度
• Version: TLS 1.2 (0x0303)：服务器支持的最高 TLS 版本（该字段应被忽略，实际使用的是 supported_versions 扩展中的版本信息）
• Random：服务端生成的随机数
• Session ID：会话ID
• Cipher Suite: TLS_AES_256_GCM_SHA384 (0x1302)：服务器选择的加密套件
• Compression Method：服务器支持的压缩算法
• supported_versions：服务器支持的协议版本
• key_share：服务器生成的公钥
• pre_shared_key：支持会话恢复，则选择预共享密钥
• TLSv1.3 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec：表示服务器已切换到加密通信模式
• TLSv1.3 Record Layer: Application Data Protocol: Hypertext Transfer Protocol：加密的应用层数据，HTTP数据

Client Finished 181

181    1.254855    192.168.3.104   47.108.167.197  TLSv1.3 134 Change Cipher Spec, Application Data

Transport Layer Security
    TLSv1.3 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec
        Content Type: Change Cipher Spec (20)
        Version: TLS 1.2 (0x0303)
        Length: 1
        Change Cipher Spec Message
    TLSv1.3 Record Layer: Application Data Protocol: Hypertext Transfer Protocol
        Opaque Type: Application Data (23)
        Version: TLS 1.2 (0x0303)
        Length: 69
        Encrypted Application Data: 61ee5f08513e506269de00aae940042238e8ce98b7810addc0e4e3a63490d823ba67d7b3a337aa2111dbe38f989b8cc2bcae0770894839be59ea2420e8f4a7c55abf7a57f0
        [Application Data Protocol: Hypertext Transfer Protocol]

• TLSv1.3 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec：客户端使用协商好的加密参数对数据加密通讯
• TLSv1.3 Record Layer: Application Data Protocol: Hypertext Transfer Protocol：加密的应用层数据