If you have to resort to a proxy (fiddler) then you are making changes. You do not get to sample unblemished data. Perhaps that is OK for the snag/issue in qu

If you have to resort to a proxy (fiddler) then you are making changes. You do not get to sample unblemished data. Perhaps that is OK for the snag/issue in question but may not be. Port mirroring/SPAN/RSPAN is the only way to be an observer without affecting the traffic you are inspecting. Fiddler literally does a man in the middle attack. If you don't have access to a private key for a TLS exchange and stream, then you cannot do quite a lot of diags. In the end, Fiddler and the like might do the job but to really get close to the wire requires full knowledge and a much lighter touch. That will be a port SPAN/mirror and Wireshark and a private key.