Sure. I'm just pointing out that it's becoming increasingly rare to be able to replace a given use case of tcpdump with a physical tap, so you can't always side

Sure. I'm just pointing out that it's becoming increasingly rare to be able to replace a given use case of tcpdump with a physical tap, so you can't always sidestep the nastiness of calculating overhead—especially on a live system.