CoralReef:Analysis Tools platform for passive network monitoring collection of coral tools dmoore@caida.org
outline what is CoralReef? software modules: status and future drivers libcoral CRL.pm analysis programs report generation status and future
what is CoralReef? software distribution collection of coral tools suggestions and automation for analysis operational side of caida's coral project collection point for enhancements platform for development/research
why is it desired? largely motivated by complaints about existing state of coral tools and configuration management non-hardware costs of deployment provides common methodologies support for trend analysis how often/what to collect
software modules: overview
libcoral - inputs capture devices trace files tcpdump oc3mon oc12mon oc48mon DAG cards trace files tcpdump headers-only, partial & full packets network configuration files encapsulation (LLC/SNAP, null, NLPID) filtering labeling
libcoral - APIs reading/processing writing/capturing/encoding block - buffer of ATM cells cell - single cell at a time packet - (partial) reassembly callback - allows multiple modules interface merging/timestamp reordering writing/capturing/encoding configuration controls
CRL.pm perlized access to libcoral header field extraction (ip_len, etc) flows analysis support statistics modules
analysis programs real-time, continuous collection in C can avoid trace collection generate summaries text html arts++
analysis reporting basic traffic characterization AS matrices configurable net-net matrices checksum verification traffic import and export
analysis reports: AS Matrices
report generation summaries transferred from monitor to web server reports designed so they can be easily parsed back to raw data periodic html generation on-demand CGI summaries
status and future initial 3.0 release on copyright approval priorities regression testing suites libcoral module API better automation and management Table.pm Arts/cflowd file support/NeTraMet
acknowledgements CoralReef Team: Steve Feldman (MAE west) Nancy Bachman Jambi Ganbar Ken Keys Ryan Koga Esmond Lee Sean McCreary David Moore Mike Tesch Mike Young Steve Feldman (MAE west) Kevin Thompson (MCI) Bill Jensen (University Wisconsin Madison) Hans-Werner Braun (NLANR) k claffy (CAIDA)
dmoore@caida.org cooperative association for Internet data analysis (CAIDA) University of California’s San Diego Supercomputer Center http://www.caida.org/Tools/CoralReef/