tsh2ta.pl -f inputfile {-t timeout} {-d displayflags} {-x exittime} {-b} -f = input file name (required) -t = transaction timeout in seconds -d = display flow records include one or more of: C create records U update records D delete records X forced exit delete records S by-second flow count sumamry -x = forced exit time in seconds relative to the beginning of the trace -b = bidirectional transactions Defaults: -t 4 ---------------------------------------------------------------------------------------- Parameter record: P DX -f APN-911316021.tsa -t 4 command line with which tsa2flows was called ---------------------------------------------------------------------------------------- Creation records: C 0.000029 2 1.2.9.1 1.9.5.2 6 3665 20 1 40 0 0 0.000029 0.000029 0.000000 2 1 C Create record flag 2 0.000029 time stamp in seconds (can be relative or absolute) 3 2 number of flows known 4 1.2.9.1 source IP address 5 1.9.5.2 destination IP address 6 6 IP protocol 7 3665 TCP or UDP source port (or zero) 8 20 TCP or UDP destination port (or zero) 9 1 packet count 10 40 byte count 11 0 packet count, reverse direction 12 0 byte count, reverse direction 13 0.000029 start time stamp 14 0.000029 current time stamp 15 0.000000 current duration 16 2 TCP flags ---------------------------------------------------------------------------------------- Update records: U 0.000213 71 1.5.2.2 2.1.6.9 6 3654 3013 8 3840 0 0 0.000039 0.001352 0.001313 18 1 U Update record flag 2 0.000213 time stamp in seconds (can be relative or absolute) 3 71 number of flows known 4 1.5.2.2 source IP address 5 2.1.6.9 destination IP address 6 6 IP protocol 7 3654 TCP or UDP source port (or zero) 8 3013 TCP or UDP destination port (or zero) 9 8 packets 10 3840 bytes 11 0 packet count, reverse direction 12 0 byte count, reverse direction 13 0.000039 start time stamp 14 0.001352 current time stamp 15 0.001313 current duration 16 18 TCP flags ---------------------------------------------------------------------------------------- Delete records: D 5.000578 1.9.2.7 2.4.0.2 6 80 1606 3 255 0 0 0.081156 0.888373 0.807217 0.112205 1 D Delete record flag 2 5.000578 current time stamp in seconds (can be relative or absolute) 3 1.9.2.7 source IP address 4 2.4.0.2 destination IP address 5 6 IP protocol 6 80 TCP or UDP source port (or zero) 7 1606 TCP or UDP destination port (or zero) 8 3 packets 9 255 bytes 10 0 packet count, reverse direction 11 0 byte count, reverse direction 12 0.081156 $at: start time stamp (creation time) 13 0.888373 $al: last access time stamp 14 0.807217 $al-$at: last-start duration (active time) 15 0.112205 $tstamp-$al: current time - last duration (hold time) ---------------------------------------------------------------------------------------- eXit records: X 10.000086 1.9.7.1 1.2.8.7 6 20 3921 718 28720 0 0 0.000061 9.971558 9.971497 0.028528 1 X eXit (forced) record flag 2 10.000086 current time stamp in seconds (can be relative or absolute) 3 1.9.7.1 source IP address 4 1.2.8.7 destination IP address 5 6 IP protocol 6 20 TCP or UDP source port (or zero) 7 3921 TCP or UDP destination port (or zero) 8 718 packets 9 28720 bytes 10 0 packet count, reverse direction 11 0 byte count, reverse direction 12 0.000061 $at: start time stamp (creation time) 13 9.971558 $al: last access time stamp 14 9.971497 $al-$at: last-start duration (active time) 15 0.028528 $tstamp-$al: current time - last duration (hold time) ---------------------------------------------------------------------------------------- Status records: S 5.000578 1522 1313 209 1 S Status record flag 2 5.000578 time stamp in seconds (can be relative or absolute) 3 1522 old active flows count before cleanup 4 1313 remaining active flows count after cleanup 5 209 number of deleted flows