How does tcpflow compare with ngrep?
tcpflow is rather simpler, but probably a lot better for examining multiple connections. You specify a tcpdump/pcap filter and it saves the traffic to files (two per connection, one for each direction). You review the data at your leisure, it's not all jumbled up in your terminal.
Can tcpflow set up fake TLS certificates like Charles?