I suspect that the collection of tap data while "update packet list in
real time" is set is either easy to do or already works. Having some
kind of periodic redraw shouldn't be too hard to add either... I
started to try and think about how someone could elect a tap to display,
"on the fly". (io stats tries to create taps on the fly)
If the conversation stuff, with a tap id comes in, then I think that
adding taps on the fly shouldn't be too hard either. I think that the
keeping track of which packets were already processed for which taps
shouldn't be too difficult, if one assumes that a packet has been
processed for ALL taps up to a certain tap id. This seems very
compatible with sequential tap id's.
This added field will allow rescanning of the packet list to do the
minimal amount of work to catch up to where it left off before starting
to rescan the packet list.
Does this sound like a reasonable approach?