Bro behind a TLS reverse proxy

I don’t know if this messes up your test, but I didn’t have tshark on the physical box I’m running. Below is the output showing the date via tcpdump options. It looks correct.

$ tcpdump -ttttnnr lo-port-80.pcap
reading from file lo-port-80.pcap, link-type EN10MB (Ethernet)
2018-04-10 08:13:20.209770 IP6 ::1.49258 > ::1.80: Flags [S], seq 485780875, win 43690, options [mss 65476,sackOK,TS val 1090368614 ecr 0,nop,wscale 7], length 0
2018-04-10 08:13:20.209809 IP6 ::1.80 > ::1.49258: Flags [R.], seq 0, ack 485780876, win 0, length 0
2018-04-10 08:13:20.210015 IP 127.0.0.1.43960 > 127.0.0.1.80: Flags [S], seq 859064153, win 43690, options [mss 65495,sackOK,TS val 1090368615 ecr 0,nop,wscale 7], length 0
2018-04-10 08:13:20.210046 IP 127.0.0.1.80 > 127.0.0.1.43960: Flags [R.], seq 0, ack 859064154, win 0, length 0
$

Philip