This read-only TimeStamp records the last time this Security Association actually carried traffic. An admin uses it to identify idle or stale SAs that are still consuming state on the device despite no recent activity, which can help decide whether to prune unused tunnel configurations. For example, an SA whose last-used timestamp is many hours old while its peer is still connected may indicate one direction of traffic has stopped flowing.