tips to figure out traffic on specific queues and pipes?

[tswalker]

One of the last rules I have setup for shaping is dealing with somewhat of a "catch" all which immediate follows any HTTP and HTTPS traffic that i have missed in preceding rules.

I try to keep ntopng nearby, but often i 'miss' activity this way and would really like to be able to drill into some better metrics by pipe, queue, rule....

thoughts?