It's a typical UNIX command - plain text output that can be munged in all sorts of ways to pipe somewhere else. If you really need up-to-the-moment graphs, MRTG would be better, though you can find a Howto to run tcpstat through gnuplot
here.
I just went with the following shell script, run by cron every 10 minutes. I haven't written in any fancy filter rules yet, but they'd go at the bottom. The nice thing about working with a raw dump is that you get minimal overhead on the wire and can do all sorts of fancy processing later. Probably I'll generate stats for http/s, smtp, other, and total and call a perl script in the daily reports to gather up the stats and report them in a pretty form.
#!/bin/sh
#
# trafmon - use tcpdump to create a raw dump of traffic on an interface,
# rotate that dump at each invocation, and analyze it with tcpstat
PATH=/bin:/sbin:/usr/bin:/usr/sbin
INT=tun0
OUTPUT=/var/log/traffic
STATS=/var/log/stats
# For rc.local at boot-time
if [ "$1" == "start" ]; then
touch ${OUTPUT}
chmod 600 ${OUTPUT}
tcpdump -i ${INT} -w ${OUTPUT} > /dev/null 2>&1 &
return 0
fi
PID=`fstat ${OUTPUT} | grep tcpdump | awk {'print $3'}`
# Stop the current dump, rename the file, and restart
kill ${PID}
mv ${OUTPUT} ${OUTPUT}.tmp
touch ${OUTPUT}
chmod 600 ${OUTPUT}
tcpdump -i ${INT} -w ${OUTPUT} > /dev/null 2>&1 &
# Analyze the dump with tcpstat
/usr/local/bin/tcpstat -r ${OUTPUT}.tmp -o "packets=%n\tbytes=%N\n" -1 >> ${STATS}
# Remove the old dump
rm ${OUTPUT}.tmp