Here the network trace pertaining to this screencast: dump_210214_2100_gdO.pcap From that screencast you can recover the video that I uploaded in that session to Open.Tube. View from 1:20. You can see a file is named: VID_20201105_zov_svjedoci_x265_ALL.mp4 in my computer, and you can see I chose that file to upload it to Open.Tube. Now, you can open the trace in Wireshark, give it the: dump_210214_2100_gdO_TLSKEYLOGFILE.txt so it can decrypt the TLS and extract http objects into a folder somewhere. A lot of files will be extracted. The largest one will be named: upload and from byte 1042 it contains that video from the start. You can also run this command, after you download the files listed below: tshark -otls.keylog_file:dump_210214_2100_gdO_TLSKEYLOGFILE.txt \ -r dump_210214_2100_gdO.pcap -q --export-object http,some-folder Same as with Wireshark, the largest file will be: upload Now execute this: tail -c+1042 upload > VID_20201105_zov_svjedoci_x265_ALL.mp4 That is bit-to-bit undeniably the video file that was at that time in my computer, which I chose to upload to Open.Tube.