Tstat produces a "log_complete" and "log_nocomplete" files which log every TCP
connection that has been tracked by tstat.

A tcp connection is identified when the first SYN segment is observed, and
is ended when either
a) the FIN/ACK or RST segments are observer
b) no packet has been observed (from both sides) for IDLE_TIME microsec
(defined in param.h). By default is set to  10 min.

if the three way handshake succeeded and if the connection tear-down a
case) is observed, then a line in the log_complete file is added.
Otherwise, the connection is logged in the log_nocomplete file.

Both files have the same format. Values are separated by tabs.

each line is composed of three main parts: values referring to the client
host, values referring to the server hosts, time references.

Here it follows a brief description of the columns.

############################################################################
#Col n# Short desc      # Long descr                                      #
############################################################################
#  1  # Client IP addr # IP addresses of the client 
#  2  # Client TCP port # TCP port addresses for the client
#  3  # packets        # total number of packets observed form the client
#  4  # RST sent       # 0 if no RST segment has been sent by the client, 1 otherwise
#  5  # ACK sent       # number of segments with the ACK field set to 1
#  6  # PURE ACK sent  # number of segments with ACK field set to 1 and no data
#  7  # unique bytes   # number of bytes sent in the payload
#  8  # data pkts      # number of segments with payload
#  9  # data bytes     # number of bytes transmitted in the payload, including retransmissions
# 10  # rexmit pkts    # number of retransmitted segments
# 11  # rexmit bytes   # number of retransmitted bytes
# 12  # out seq pkts   # number of segments observed out of sequence
# 13  # SYN count      # number of SYN segments observed (including rtx)
# 14  # FIN count      # number of FIN segments observed (including rtx)
# 15  # RFC1323 ws     # Window scale option sent [boolean]
# 16  # RFC1323 ts     # Timestamp option sent [boolean]
# 17  # window scale   # Scaling values negotiated [scale factor]
# 18  # SACK req       # SACK option set [boolean]
# 19  # SACK sent      # number of SACK messages sent
# 20  # MSS            # MSS declared [bytes]
# 21  # max seg size   # Maximum segment size observed [bytes]
# 22  # min seg size   # Minimum segment size observed [bytes]
# 23  # win max        # Maximum receiver window announced (already scale by the window scale factor) [bytes]
# 24  # win min        # Maximum receiver windows announced (already scale by the window scale factor) [bytes]
# 25  # win zero       # Total number of segments declaring zero as receiver window
# 26  # cwin max       # Maximum in-flight-size computed as the difference between the largest sequence number so far, and the corresponding last ACK message on the reverse path. It is an estimate of the congestion window. [bytes]
# 27  # cwin min       # Minimum in-flight-size [bytes]
# 28  # initial cwin   # First in-flight size, or total number of unack-ed bytes sent before receiving the first ACK segment [bytes]
# 29  # Average rtt    # Average RTT computed measuring the time elapsed between the data segment and the corresponding ACK [ms]
# 30  # rtt min        # Minimum RTT observed during connection lifetime [ms]
# 31  # rtt max        # Maximum RTT observed during connection lifetime [ms]
# 32  # Stdev rtt      # Standard deviation of the RTT [ms]
# 33  # rtt count      # Number of valid RTT observation
# 34  # ttl_min        # Minimum Time To Live
# 35  # ttl_max        # Maximum Time To Live
# 36  # rtx RTO        # Number of retransmitted segments due to timeout expiration
# 37  # rtx FR         # Number of retransmitted segments due to Fast Retransmit (three dup-ack)
# 38  # reordering     # Number of packet reordering observed
# 39  # net dup        # Number of network duplicates observed
# 40  # unknown        # Number of segments not in sequence or duplicate which are not classified as specific events
# 41  # flow control   # Number of retransmitted segments to probe the receiver window
# 42  # unnece rtx RTO # Number of unnecessary transmissions following a timeout expiration
# 43  # unnece rtx FR  # Number of unnecessary transmissions following a fast retransmit
# 44  # != SYN seqno   # Set to 1 if the eventual retransmitted SYN segments have different initial seqno
# 45  # Server IP addr # IP addresses of the server 
# 46  # Server TCP port# TCP port addresses for the server 
# 47  # packets        # total number of packets observed form the server
# 48  # RST sent       # 0 if no RST segment has been sent by the server, 1 otherwise
# 49  # ACK sent       # number of segments with the ACK field set to 1
# 50  # PURE ACK sent  # number of segments with ACK field set to 1 and no data
# 51  # unique bytes   # number of bytes sent in the payload
# 52  # data pkts      # number of segments with payload
# 53  # data bytes     # number of bytes transmitted in the payload, including retransmissions
# 54  # rexmit pkts    # number of retransmitted segments
# 55  # rexmit bytes   # number of retransmitted bytes
# 56  # out seq pkts   # number of segments observed out of sequence
# 57  # SYN count      # number of SYN segments observed (including rtx)
# 58  # FIN count      # number of FIN segments observed (including rtx)
# 59  # RFC1323 ws     # Window scale option sent [boolean]
# 60  # RFC1323 ts     # Timestamp option sent [boolean]
# 61  # window scale   # Scaling values negotiated [scale factor]
# 62  # SACK req       # SACK option set [boolean]
# 63  # SACK sent      # number of SACK messages sent
# 64  # MSS	       # MSS declared [bytes]
# 65  # max seg size   # Maximum segment size observed [bytes]
# 66  # min seg size   # Minimum segment size observed [bytes]
# 67  # win max        # Maximum receiver window announced (already scale by the window scale factor) [bytes]
# 68  # win min        # Maximum receiver window announced (already scale by the window scale factor) [bytes]
# 69  # win zero       # Total number of segments declaring zero as receiver window
# 70  # cwin max       # Maximum in-flight-size computed as the difference between the largest sequence number so far, and the corresponding last ACK message on the reverse path. It is an estimate of the congestion window. [bytes]
# 71  # cwin min       # Minimum in-flight-size [bytes]
# 72  # initial cwin   # First in-flight size, or total number of unack-ed bytes sent before receiving the first ACK segment [bytes]
# 73  # Average rtt    # Average RTT computed measuring the time elapsed between the data segment and the corresponding ACK [ms]
# 74  # rtt min        # Minimum RTT observed during connection lifetime [ms]
# 75  # rtt max        # Maximum RTT observed during connection lifetime [ms]
# 76  # Stdev rtt      # Standard deviation of the RTT [ms]
# 77  # rtt count      # Number of valid RTT observation
# 78  # ttl_min        # Minimum Time To Live
# 79  # ttl_max        # Maximum Time To Live
# 80  # rtx RTO        # Number of retransmitted segments due to timeout expiration
# 81  # rtx FR         # Number of retransmitted segments due to Fast Retransmit (three dup-ack)
# 82  # reordering     # Number of packet reordering observed
# 83  # net dup        # Number of network duplicates observed
# 84  # unknown        # Number of segments not in sequence or duplicate which are not classified as specific events
# 85  # flow control   # Number of retransmitted segments to probe the receiver window
# 86  # unnece rtx RTO # Number of unnecessary transmissions following a timeout expiration
# 87  # unnece rtx FR  # Number of unnecessary transmissions following a fast retransmit
# 88  # != SYN seqno   # Set to 1 if the eventual retransmitted SYN segments have different initial seqno
# 89  # Completion time# Flow duration since first packet to last packet [ms]
# 90  # First time     # Flow first packet since first segment ever [ms]
# 91  # Last time      # Flow last segment since first segment ever [ms]
# 92  # C first payload# Client first segment with payload since the first flow segment [ms]
# 93  # S first payload# Server first segment with payload since the first flow segment [ms]
# 94  # C last payload # Client last segment with payload since the first flow segment [ms]
# 95  # S last payload # Server last segment with payload since the first flow segment [ms]
# 96  # Internal       #Bool set to 1 if the client has internal IP

