how to prove fallback host triggered is due to 1 bad request respond from backend server?

these 2 pics are for same packet ,I just use wireshark decode as ssl and http ,otherwise it will not show the correct info ,haha

81.9 is F5,81.124 is backend server which only accept plain http

1:deacode 443 port as ssl

2:decode 443 port as http

Nitass ,u there? need your expertise .