You're right that getting scanned opens a lot of tabs, which can be annoying. Auto-closing would help, but we still need a way to know that a connection happened (from the pyrdp-player) so we can look at the replay files. Definitely something could be done here!

I think I implemented something so that port scans dont make a replay file. If they leave a tab open, it can indeed be confusing and frustrating. I'm unsure right now what is the best way to implement that, but it would indeed be a welcome change.

I would auto-close all "trash" connections that do not complete the connection sequence within a set amount of time. For the purpose of the live tabs, this could be considered as the first frame buffer update to avoid requiring too much refactoring. That should reduce the noise by a significant amount.

Auto-closing of tabs with actual user input would have to be an opt-in setting as it can be confusing, especially if you're watching the tab and it closes on you abruptly. Another QoL thing we could do is maybe "move" the disconnected tabs to the replay pane after some time passes.