Tstat produces a "log_complete" and "log_nocomplete" files which log every
TCP connection that has been tracked by Tstat. Similarly, a
log_rtp_complete file tracks downs all RTP flows.

Being it impossible to detect RTP/RTCP flows, a heuristic metodology as
been implemented. A state machine is used, to track RTP flows. At the first
UDP packet, it is labeled as "unknown".  For each new UDP flows, Tstat
double checks if the UDP payload may be an RTP/RTCP packet. This is done by
double checking that
- the version field is set to 2
- the payload type field has an admissible values (for RTP ot for RTCP)
- the UDP port is larger than 1024 and is even/odd for RTP/RTCP
if so, the flow is marked as possible RTP/RTCP flow (first_RTP/first_RTCP
status).

When the second UDP segment of this UDP flow (same IP/ports) is observed,
then Tstat double checks that it may still be interpreted as RTP/RTCP.
In the case of RTP flows, it checks that
- the version is equal to 2
- the same ssrc is present
- the seqno is the expected one
- the payload type is the same as before.
Then the flows is marked as RTP and its analysis may start
For RTCP flows, a simples heuristic is used:
- the version must be equal to 2
- the payload type must be a correct one
if so, the flow is considered a RTCP flow and its analysis may start.

For each RTP flow which is successfully tracked, a line in the
log_rtp_complete file will be written when the flows ends.

Here it follows a brief description of the columns.

############################################################################
#Col n# Short desc      # Long descr                                      #
############################################################################
#  1  # Client IP addr # IP addresses of the transmitter
#  2  # Client TCP port# UDP port addresses of the transmitter
#  3  # pnum           # total number of packets observed 
#  4  # ssrc           # synchronization source identifier used
#  5  # avg pkt delay  # average interpacket gap [ms] over the all session
#  6  # jitter         # average jitter observed over all session (RFC3550)
#  7  # out of sequence# total number of out of sequence packets observed
#  8  # duplicate      # total number of duplicate packets observed 
#  9  # late           # total number of late packets observed 
# 10  # lost           # total number of lost packets observed 
# 11  # internal src   # 1 if the IP sender address was internal
# 12  # internal dst   # 1 if the IP sender address was internal


