In one example, a processing system including at least one processor obtains a transport control protocol flow associated with a video session that streams a video from a server to a client. The transport control protocol flow comprises a plurality encrypted packets exchanged between the server and the client. The processing system then reconstructs a hypertext transfer protocol transaction that is part of the streaming video session. The reconstructing is performed without decrypting the plurality of encrypted packets.