How tshark's filter, extract, and stats commands turned a confirmed TLS tunnel into an exact exfil timeline β€” plus a tooling trap worth avoiding.