Without decrypting, what portion of an HTTPS session is visible with a packet capture?

The source IP address resides in the IP header, which is outside the TLS encryption envelope. TLS only encrypts the application-layer payload (HTTP request/response headers, body, cookies), so network-layer addressing information like source and destination IP addresses are always visible in a packet capture.

HTTP request headers are part of the application-layer payload and are fully encrypted inside the TLS record, making them unreadable without the session keys.

Cookies are transmitted within HTTP headers or the request body, both of which are encrypted by TLS and not visible in a packet capture without decryption.

HTTP response headers are part of the TLS-encrypted payload and cannot be read from a packet capture without decrypting the TLS session.