The arguments for perf are now mostly optional, except for the input file. Here is the list: - output file will contain stats for each transaction. First line in the file tells the meaning of each field - victim file is used for one-way measurement so we need the clocks synchronized. This is only needed for IRC and VoIP. - offset is input in milliseconds and it serves if ntp synchronization is imperfect. If a clock drifts between source trace and victim trace and you know the drift then use this value for the offset and it will help adjust the measurements. - you can specify either destination and mask (in changeable bits) or source and mask (again in changeable bits so /24 would have a mask 8) - attack start and end are measured in seconds from the start of the trace. They are needed because DoS usually has effect only during an attack so it makes sense to measure pft only while attack lasts. If you don't specify them they default to 0 and 5000 - monitoring interval should be 1 if you want timed stats every second - batch processing is something particular to my tests on a specific trace so please ignore this option - c flag says if we should match req/rep for DNS and ping based on identification. It defaults to true and this should be OK for most traces but some traces may have this ID anonymized. In this case req/rep will be matched solely (and imperfectly) on timing. - human vs machine output is just for the final pft statistics that are printed on the screen. It defaults to human. All tresholds are in tresholds.h, in case you need to change some. File tg.txt will have throughput and goodput per second for all traffic going to the same dest (if you use -d flag) or coming from the same source (if you use -s flag). File timed.txt will have timed stats of live transactions and failed transactions at a given time slot, and the last column is the pft per second, i.e. the failure ratio.