i’ve a task to find a specific text that was send through TLS1.3 and cannot find that info by following the HTTP2 Stream nor by exporting the raw data of the packages.

I have the pcap file and the keylog file with the secrets. After loading the loading the keys into Wireshark i can see the decrypted data and certificates.

Now i’m trying to find the file/info that was send, however I can’t find the information. I’ve 8 http2 entries in total so it shouldn’t be that difficult but i’m lost

Its not a lot of data so I already went through the entries 1by1 and tried to follow TCP, HTTP and TLS Stream. I’ve tried to view in ASCII and also tried to export as raw data and identify the filetype via “file filename” in Linux but I can’t find it.

Anyone any idea what i’m doing wrong?