1. CoralReef:Analysis Tools platform for passive network monitoring collection of coral tools dmoore@caida.org

2. outline what is CoralReef? software modules: –drivers –libcoral –CRL.pm –analysis programs –report generation status and future

3. what is CoralReef? software distribution –collection of coral tools –suggestions and automation for analysis operational side of caida's coral project collection point for enhancements platform for development/research

4. why is it desired? largely motivated by complaints about existing state of coral tools and configuration management non-hardware costs of deployment provides common methodologies support for trend analysis how often/what to collect

5. software modules: overview

6. libcoral - inputs capture devices –oc3mon –oc12mon –oc48mon –DAG cards trace files tcpdump headers-only, partial & full packets network configuration files –encapsulation (LLC/SNAP, null, NLPID) –filtering –labeling

7. libcoral - APIs reading/processing –block- buffer of ATM cells –cell- single cell at a time –packet- (partial) reassembly –callback- allows multiple modules –interface merging/timestamp reordering writing/capturing/encoding configuration controls

8. CRL.pm perlized access to libcoral header field extraction (ip_len, etc) flows analysis support statistics modules

9. analysis programs real-time, continuous collection in C can avoid trace collection generate summaries –text –html –arts++

10. analysis reporting basic traffic characterization AS matrices configurable net-net matrices checksum verification traffic import and export

11. analysis reports: AS Matrices

12. report generation summaries transferred from monitor to web server reports designed so they can be easily parsed back to raw data periodic html generation on-demand CGI summaries

13. status and future initial 3.0 release on copyright approval priorities –regression testing suites –libcoral module API –better automation and management –Table.pm –Arts/cflowd file support/NeTraMet

14. acknowledgements CoralReef Team: –Nancy Bachman –Jambi Ganbar –Ken Keys –Ryan Koga –Esmond Lee –Sean McCreary –David Moore –Mike Tesch –Mike Young Steve Feldman (MAE west) Kevin Thompson (MCI) Bill Jensen (University Wisconsin Madison) Hans-Werner Braun (NLANR) k claffy (CAIDA)

15. dmoore@caida.org cooperative association for Internet data analysis (CAIDA) University of California’s San Diego Supercomputer Center http://www.caida.org/Tools/CoralReef/ http://www.caida.org/Tools/CoralReef/