1. A non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to: receive, at an intermediate device, a first request for a media stream report at a predetermined time interval, the request identifying at least one media stream and a periodicity for the media stream report; monitor, in response to the first request, the at least one media stream established between media stream endpoints; generate the media stream report for the at least one media stream at the predetermined interval, wherein the media stream report includes real-time packet transportation statistics for the at least one media stream; set-up a tunnel to a central media monitor; send the media stream report over the tunnel to the central media monitor for further media stream analysis; receive, from the central media monitor, a second request for initiation of a media stream packet monitoring, wherein receiving the second request comprises receiving the second request in response to the central media monitor determining a potential problem in a network connecting the at least one media stream based on the media stream report; and send, in response to the second request, packets from a suspect media stream by the intermediary device, wherein sending the packets by the intermediary device comprises: trapping the packets from the suspect media stream, wherein trapping comprises assigning and binding a time stamp with each of the trapped packets, wherein the time stamp is provided by a local clock associated with the intermediate device at an instance when each of the packets are trapped, cloning the trapped packets, and encapsulating the cloned packets into the tunnel to the central location for in-depth analysis of the suspect media stream.