[randomname93857]

Sorry for deviating from OP subject -any pointers to a good (https/ssl) traffic analysis guide?

[spacecadet]

Wireshark/TShark/PShark

I use T/P Shark to store everything in a local graph database and then perform cluster, outlier, etc on it.

IPInfo API for additional details not in the packet. I have scripts that batch process IP addresses.