CoralReef Software Components
|

CoralReef drivers
The CoralReef device drivers are extensions to the operating system
that permit the passive collection of data from
specialized collection hardware.
CoralReef includes FreeBSD drivers for Apptel POINT
and FORE ATM cards, and supports the Linux and FreeBSD drivers
for Endace DAG cards.
Other CoralReef input
In addition to collecting data from the network monitor device drivers
noted above, the CoralReef software suite can read data from
live pcap interfaces,
and from trace files recorded by CoralReef, older NLANR Coral software,
tcpdump,
and dagtools.
The CoralReef libcoral C library
Libcoral provides a C API for reading passive traffic data
and for writing trace files.
The data sources supported include live monitoring devices,
live network interfaces, and trace files recorded
by CoralReef and other software.
Applications that use libcoral see a uniform interface to all these
source types, so they do not need to be rewritten for each input source.
As support for new network card, monitor systems, and
link level encapsulations is added to libcoral,
application programs that use libcoral will be able to use the
new sources with little or no change.
The CoralReef perl API
Since Perl is often preferred for research tools and rapid prototyping,
CoralReef includes the Coral.pm module, which provides an object-oriented
interface to the libcoral functionality in Perl.
By using SWIG (the Simplified Wrapper and Interface Generator),
libcoral objects are wrapped and made accessible from Perl.
The perl API also includes the Unpack library, for convenient and
efficient access to network protocol data and libcoral data structures.
It exists because the native Perl method of extracting headers is too
inefficient for a tight loop (one is required to extract every possible
field from a header, even when unwanted).
With the magic of SWIG, efficient C code to select specific fields from
these headers is easily accessible from Perl.
Analysis Programs in C/C++
C and C++ applications built on top of libcoral provide some turnkey
traffic analysis capabilities. Some provide standalone analysis,
and some are intended as back ends for the
report generation tools.
Those capabilities will continue to be refined and expanded in
future revisions of CoralReef.
In addition, the CoralReef analysis tools provide a solid starting
place for developers seeking to develop custom monitoring solutions.
Analysis Programs in Perl
Perl applications built on top of libcoral provide some turnkey
traffic analysis capabilities.
Those capabilities will continue to be refined and expanded in
future revisions of CoralReef.
In addition, the CoralReef analysis tools provide a solid starting
place for developers seeking to develop custom monitoring solutions.
HTML Report Generation tools
The top level of the CoralReef analysis suite provides report
generation capabilities for the World Wide Web.
These report generation capabilities allow traffic
analysis results to be shared with groups as small as local
network administrators or as large as end users.
These tools are rapidly undergoing revision and updating,
and will eventually include CGI scripts and other custom controls
to allow for remote report generation and system monitoring.