@damon I have a license to HTTPScoop. Comes in handy and usually faster than dealing with tcpflow on the command line.