How to get the datapacket from wireshark? I have a pcap of my twitter traffic using wireshark. The cipher suite TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 method is used for for encryption data.. I have a tweet of 42 characters are traced in the pcap. How can i get the application data packet with the length of my tweet data.
It is expected that is not possible to


  get the application data packet with the length of my tweet data


in clear even if it was additionally obtained all long-term secrets involved. Exceptions involve exploiting deficiencies (e.g. a poor Random Number Generator, some side channel..), or going from passive eavesdropping to performing an active attack (this requires obtaining a rogue certificate, which at least is difficult for most except state actors).

That's because TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 specifies negotiation of an ephemeral session key using Elliptic Curve Diffie–Hellman key Exchange (ECDHE). That session key is used for AES encryption of the session (including the tweet), then forgotten. This prevents deciphering the application data packet.

But is possible to get at the length of the data packet containing the tweet (wireshark displays packet length), and from that to estimate the tweet length.  Per Dave Thompson's analysys, the packet size minus 24 bytes gives the tweet size (assuming no compression or fragmentation).

In captures of two experiments made with a short then with a long tweet, the packet with the tweet can be identified as the one which size grew by the difference in tweet size.