One of the last rules I have setup for shaping is dealing with somewhat of a "catch" all which immediate follows any HTTP and HTTPS traffic that i have missed in preceding rules.
I try to keep ntopng nearby, but often i 'miss' activity this way and would really like to be able to drill into some better metrics by pipe, queue, rule....
thoughts?
(https://i.imgur.com/Yw60n4p.png)