diff --git a/.clang-tidy b/.clang-tidy
index 77889d4f90..fe4604c03b 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -2,6 +2,8 @@ Checks: [-*,
          bugprone-*,
          performance-*,
 
+         modernize-loop-convert,
+
          # Enable a very limited number of the cppcoreguidelines checkers.
          # See the notes for some of the rest of them below.
          cppcoreguidelines-macro-usage,
diff --git a/src/analyzer/Analyzer.cc b/src/analyzer/Analyzer.cc
index 406d4440d3..f1ef9ed459 100644
--- a/src/analyzer/Analyzer.cc
+++ b/src/analyzer/Analyzer.cc
@@ -116,8 +116,8 @@ Analyzer::~Analyzer() {
     assert(finished);
     assert(new_children.empty());
 
-    LOOP_OVER_CHILDREN(i)
-    delete *i;
+    for ( Analyzer* a : children )
+        delete a;
 
     SupportAnalyzer* next = nullptr;
 
@@ -139,9 +139,9 @@ void Analyzer::Init() {}
 void Analyzer::InitChildren() {
     AppendNewChildren();
 
-    LOOP_OVER_CHILDREN(i) {
-        (*i)->Init();
-        (*i)->InitChildren();
+    for ( Analyzer* a : children ) {
+        a->Init();
+        a->InitChildren();
     }
 }
 
@@ -157,9 +157,9 @@ void Analyzer::Done() {
 
     AppendNewChildren();
 
-    LOOP_OVER_CHILDREN(i)
-    if ( ! (*i)->finished )
-        (*i)->Done();
+    for ( Analyzer* a : children )
+        if ( ! a->finished )
+            a->Done();
 
     for ( SupportAnalyzer* a = orig_supporters; a; a = a->sibling )
         if ( ! a->finished )
@@ -424,25 +424,25 @@ bool Analyzer::IsPreventedChildAnalyzer(const zeek::Tag& tag) const {
 bool Analyzer::HasChildAnalyzer(const zeek::Tag& tag) const { return GetChildAnalyzer(tag) != nullptr; }
 
 Analyzer* Analyzer::GetChildAnalyzer(const zeek::Tag& tag) const {
-    LOOP_OVER_CHILDREN(i)
-    if ( (*i)->tag == tag && ! ((*i)->removing || (*i)->finished) )
-        return *i;
+    for ( Analyzer* a : children )
+        if ( a->tag == tag && ! (a->removing || a->finished) )
+            return a;
 
-    LOOP_OVER_GIVEN_CHILDREN(i, new_children)
-    if ( (*i)->tag == tag && ! ((*i)->removing || (*i)->finished) )
-        return *i;
+    for ( Analyzer* a : new_children )
+        if ( a->tag == tag && ! (a->removing || a->finished) )
+            return a;
 
     return nullptr;
 }
 
 Analyzer* Analyzer::GetChildAnalyzer(const std::string& name) const {
-    LOOP_OVER_CHILDREN(i)
-    if ( (*i)->GetAnalyzerName() == name && ! ((*i)->removing || (*i)->finished) )
-        return *i;
+    for ( Analyzer* a : children )
+        if ( a->GetAnalyzerName() == name && ! (a->removing || a->finished) )
+            return a;
 
-    LOOP_OVER_GIVEN_CHILDREN(i, new_children)
-    if ( (*i)->GetAnalyzerName() == name && ! ((*i)->removing || (*i)->finished) )
-        return *i;
+    for ( Analyzer* a : new_children )
+        if ( a->GetAnalyzerName() == name && ! (a->removing || a->finished) )
+            return a;
 
     return nullptr;
 }
@@ -451,15 +451,13 @@ Analyzer* Analyzer::FindChild(ID arg_id) {
     if ( id == arg_id && ! (removing || finished) )
         return this;
 
-    LOOP_OVER_CHILDREN(i) {
-        Analyzer* child = (*i)->FindChild(arg_id);
-        if ( child )
+    for ( Analyzer* a : children ) {
+        if ( Analyzer* child = a->FindChild(arg_id) )
             return child;
     }
 
-    LOOP_OVER_GIVEN_CHILDREN(i, new_children) {
-        Analyzer* child = (*i)->FindChild(arg_id);
-        if ( child )
+    for ( Analyzer* a : new_children ) {
+        if ( Analyzer* child = a->FindChild(arg_id) )
             return child;
     }
 
@@ -470,15 +468,13 @@ Analyzer* Analyzer::FindChild(zeek::Tag arg_tag) {
     if ( tag == arg_tag && ! (removing || finished) )
         return this;
 
-    LOOP_OVER_CHILDREN(i) {
-        Analyzer* child = (*i)->FindChild(arg_tag);
-        if ( child )
+    for ( Analyzer* a : children ) {
+        if ( Analyzer* child = a->FindChild(arg_tag) )
             return child;
     }
 
-    LOOP_OVER_GIVEN_CHILDREN(i, new_children) {
-        Analyzer* child = (*i)->FindChild(arg_tag);
-        if ( child )
+    for ( Analyzer* a : new_children ) {
+        if ( Analyzer* child = a->FindChild(arg_tag) )
             return child;
     }
 
@@ -607,11 +603,11 @@ void Analyzer::EndOfData(bool is_orig) {
 void Analyzer::FlipRoles() {
     DBG_LOG(DBG_ANALYZER, "%s FlipRoles()", fmt_analyzer(this).c_str());
 
-    LOOP_OVER_CHILDREN(i)
-    (*i)->FlipRoles();
+    for ( Analyzer* a : children )
+        a->FlipRoles();
 
-    LOOP_OVER_GIVEN_CHILDREN(i, new_children)
-    (*i)->FlipRoles();
+    for ( Analyzer* a : new_children )
+        a->FlipRoles();
 
     for ( SupportAnalyzer* a = orig_supporters; a; a = a->sibling )
         a->FlipRoles();
@@ -707,14 +703,14 @@ void Analyzer::CancelTimers() {
 }
 
 void Analyzer::AppendNewChildren() {
-    LOOP_OVER_GIVEN_CHILDREN(i, new_children)
-    children.push_back(*i);
+    for ( Analyzer* a : new_children )
+        children.push_back(a);
     new_children.clear();
 }
 
 void Analyzer::UpdateConnVal(RecordVal* conn_val) {
-    LOOP_OVER_CHILDREN(i)
-    (*i)->UpdateConnVal(conn_val);
+    for ( Analyzer* a : children )
+        a->UpdateConnVal(conn_val);
 }
 
 const RecordValPtr& Analyzer::ConnVal() { return conn->GetVal(); }
diff --git a/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc b/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc
index 714782eb8e..7722b5198d 100644
--- a/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc
+++ b/src/packet_analysis/protocol/tcp/TCPSessionAdapter.cc
@@ -43,8 +43,8 @@ TCPSessionAdapter::TCPSessionAdapter(Connection* conn) : packet_analysis::IP::Se
 }
 
 TCPSessionAdapter::~TCPSessionAdapter() {
-    LOOP_OVER_GIVEN_CHILDREN(i, packet_children)
-    delete *i;
+    for ( Analyzer* a : packet_children )
+        delete a;
 
     delete orig;
     delete resp;
@@ -52,8 +52,8 @@ TCPSessionAdapter::~TCPSessionAdapter() {
 
 void TCPSessionAdapter::Init() {
     Analyzer::Init();
-    LOOP_OVER_GIVEN_CHILDREN(i, packet_children)
-    (*i)->Init();
+    for ( Analyzer* a : packet_children )
+        a->Init();
 }
 
 void TCPSessionAdapter::Done() {
@@ -62,8 +62,8 @@ void TCPSessionAdapter::Done() {
     if ( run_state::terminating && connection_pending && is_active && ! BothClosed() )
         Event(connection_pending);
 
-    LOOP_OVER_GIVEN_CHILDREN(i, packet_children)
-    (*i)->Done();
+    for ( Analyzer* a : packet_children )
+        a->Done();
 
     orig->Done();
     resp->Done();
@@ -644,9 +644,8 @@ analyzer::Analyzer* TCPSessionAdapter::FindChild(analyzer::ID arg_id) {
     if ( child )
         return child;
 
-    LOOP_OVER_GIVEN_CHILDREN(i, packet_children) {
-        analyzer::Analyzer* child = (*i)->FindChild(arg_id);
-        if ( child )
+    for ( Analyzer* a : packet_children ) {
+        if ( analyzer::Analyzer* child = a->FindChild(arg_id) )
             return child;
     }
 
@@ -659,9 +658,8 @@ analyzer::Analyzer* TCPSessionAdapter::FindChild(zeek::Tag arg_tag) {
     if ( child )
         return child;
 
-    LOOP_OVER_GIVEN_CHILDREN(i, packet_children) {
-        analyzer::Analyzer* child = (*i)->FindChild(arg_tag);
-        if ( child )
+    for ( Analyzer* a : packet_children ) {
+        if ( analyzer::Analyzer* child = a->FindChild(arg_tag) )
             return child;
     }
 
@@ -1046,8 +1044,8 @@ void TCPSessionAdapter::UpdateConnVal(RecordVal* conn_val) {
     Analyzer::UpdateConnVal(conn_val);
 
     // Have to do packet_children ourselves.
-    LOOP_OVER_GIVEN_CHILDREN(i, packet_children)
-    (*i)->UpdateConnVal(conn_val);
+    for ( Analyzer* a : packet_children )
+        a->UpdateConnVal(conn_val);
 }
 
 void TCPSessionAdapter::AttemptTimer(double /* t */) {
@@ -1182,11 +1180,12 @@ FilePtr TCPSessionAdapter::GetContentsFile(unsigned int direction) const {
 void TCPSessionAdapter::ConnectionClosed(analyzer::tcp::TCP_Endpoint* endpoint, analyzer::tcp::TCP_Endpoint* peer,
                                          bool gen_event) {
     const analyzer::analyzer_list& children(GetChildren());
-    LOOP_OVER_CONST_CHILDREN(i)
-    // Using this type of cast here is nasty (will crash if
-    // we inadvertently have a child analyzer that's not a
-    // TCP_ApplicationAnalyzer), but we have to ...
-    static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(*i)->ConnectionClosed(endpoint, peer, gen_event);
+
+    for ( Analyzer* a : children )
+        // Using this type of cast here is nasty (will crash if
+        // we inadvertently have a child analyzer that's not a
+        // TCP_ApplicationAnalyzer), but we have to ...
+        static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(a)->ConnectionClosed(endpoint, peer, gen_event);
 
     if ( DataPending(endpoint) ) {
         // Don't close out the connection yet, there's still data to
@@ -1266,9 +1265,10 @@ void TCPSessionAdapter::ConnectionClosed(analyzer::tcp::TCP_Endpoint* endpoint,
 
 void TCPSessionAdapter::ConnectionFinished(bool half_finished) {
     const analyzer::analyzer_list& children(GetChildren());
-    LOOP_OVER_CONST_CHILDREN(i)
-    // Again, nasty - see TCPSessionAdapter::ConnectionClosed.
-    static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(*i)->ConnectionFinished(half_finished);
+
+    for ( Analyzer* a : children )
+        // Again, nasty - see TCPSessionAdapter::ConnectionClosed.
+        static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(a)->ConnectionFinished(half_finished);
 
     if ( half_finished )
         Event(connection_half_finished);
@@ -1282,8 +1282,8 @@ void TCPSessionAdapter::ConnectionReset() {
     Event(connection_reset);
 
     const analyzer::analyzer_list& children(GetChildren());
-    LOOP_OVER_CONST_CHILDREN(i)
-    static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(*i)->ConnectionReset();
+    for ( Analyzer* a : children )
+        static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(a)->ConnectionReset();
 
     is_active = 0;
 }
@@ -1312,8 +1312,8 @@ void TCPSessionAdapter::EndpointEOF(analyzer::tcp::TCP_Reassembler* endp) {
         EnqueueConnEvent(connection_EOF, ConnVal(), val_mgr->Bool(endp->IsOrig()));
 
     const analyzer::analyzer_list& children(GetChildren());
-    LOOP_OVER_CONST_CHILDREN(i)
-    static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(*i)->EndpointEOF(endp->IsOrig());
+    for ( Analyzer* a : children )
+        static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(a)->EndpointEOF(endp->IsOrig());
 
     if ( close_deferred ) {
         if ( DataPending(endp->Endpoint()) ) {
@@ -1331,8 +1331,8 @@ void TCPSessionAdapter::EndpointEOF(analyzer::tcp::TCP_Reassembler* endp) {
 
 void TCPSessionAdapter::PacketWithRST() {
     const analyzer::analyzer_list& children(GetChildren());
-    LOOP_OVER_CONST_CHILDREN(i)
-    static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(*i)->PacketWithRST();
+    for ( Analyzer* a : children )
+        static_cast<analyzer::tcp::TCP_ApplicationAnalyzer*>(a)->PacketWithRST();
 }
 
 void TCPSessionAdapter::CheckPIA_FirstPacket(bool is_orig, const IP_Hdr* ip) {