1. One or more computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to: monitor one or more media streams established between media stream endpoints; capture packets from the one or more media streams; copy the captured packets; analyze the captured packets; generate a media stream report based on the analysis, wherein the media stream report includes real-time packet transportation statistics for identified portions of the one or more media streams; set-up a tunnel to a central media monitor; and send the media stream report over the tunnel to the central media monitor for further media stream analysis, wherein the media stream report indicates a false source address.