Please elaborate on "Bytes In"

The quick start guide defines Bytes In as

I found a comment by Patrick Meenan which seems to be a little more definitive:

But some elaboration would be helpful.
I believe “bytes in” would include all the overhead of SSL encryption, at least from my experiments, but does it include TCP overhead, etc?

Thanks
Oh and thanks for the very powerful WebPageTest tool!

It will include SSL (only overhead is the certificate negotiation and a couple of bytes of framing) but not TCP overhead. It intercepts the socket reads in user mode so doesn’t see packet-level details.

Thanks Patrick

I’ll pester you just one more time.
I’ve included links to two tests below:
The first, a Google png file using https, the second is just the same file with straight http.
Comparing the “Bytes In” for both there is an 8K difference. Can I conclude the bytes transferred for the encrypted version of png file is 8K larger than the un-encrypted version?

WebPageTest Test - WebPageTest Details HTTPS
Notice “Bytes In” at 30K, but in the Request Details 21.6K.
WebPageTest Test - WebPageTest Details
Notice “Bytes In” at 22K, but in the Request Details the size remains 21.6K, which seems completely reasonable to me.

21.6K is the actual size reported by other browser “network” tools for the png file from Google.

Sorry, yes - there is the potential for wasted bytes with TLS padding depending on how well optimized the server is and if it supports dynamic record sizes: Optimizing TLS Record Size & Buffering Latency - igvita.com