I think this is a really good idea, but I'd add one alternate possibility is well. Doing this on a typical user's computer today will present a mind blowing amo

I think this is a really good idea, but I'd add one alternate possibility is well. Doing this on a typical user's computer today will present a mind blowing amount of data--so much that it is easy to give up trying to figure out what's going on if you've never done it before. Instead, perhaps spin up a Linux VM, maybe even no GUI to start. Then run Wireshark on its interface. Much less noise. Should be much easier to begin dissecting.