The various embodiments provide selective real-time monitoring of one or more flows of packets over a network, real-time buffering of packets for the one or more monitored flows, real-time recording of packets for one or more monitored flows and its corresponding buffered packets based on initiation of at least one trigger, and real-time analysis of the one or more recorded flows of packets regarding at least the occurrence of the at least one trigger. One or more flows of packets may be selected for monitoring by an administrator or an automated process based on different factors. In at least one of the various embodiments, the one or more monitored flows of packets are tagged and threaded so that they are separately accessible in a ring buffer.