Wireshark’s Proxy Label Can Come from a Port Association
Inspect protocol dissection and Decode As mappings when an HTTP-colored proxy packet appears in a TLS investigation.
An HTTP label on a proxy connection can reflect the dissector selected for that TCP port. A green row can also come from a coloring rule: Wireshark colors packets using display filters, and the first matching rule wins.
Inspect the protocol tree and the active Decode As association for the connection. If the configured listener uses TLS on a nonstandard port, an HTTP port association may be inappropriate. Selecting the expected dissector helps interpret the saved bytes; it does not turn arbitrary bytes into a valid TLS handshake.
Also distinguish the outer proxy connection from destination TLS inside CONNECT. A plain HTTP proxy can receive a readable CONNECT request before carrying encrypted destination traffic.
If TLS decryption is configured with the appropriate secrets, Wireshark may display decoded application HTTP from an encrypted session. Record the actual TLS and application layers involved rather than treating a protocol-column label or packet color as independent proof of cleartext transmission.