Thanks, this'll be interesting. One of my first go-tos in Wireshark is finding the interesting hosts I'm looking for, then using the built-in Follow TCP Stream to go deeper.

I wonder if tcpflow would make this easier, or maybe just different, by effectively pre-slicing the capture into sessions.