CoralReef Frequently Asked Questions

Contact coral-info@caida.org if your question is not answered here.

1. General Questions

• 1.1 What is CoralReef?
• 1.2 What is the status of the project?

2. Hardware Questions

• 2.1 What are the CoralReef machine specs?
• 2.2 What are the specifications for the monitor card?
• 2.3 How do I tap a network link?
• 2.4 Is there a vendor or system integrator you can recommend?

3. Link Layer

• 3.1 What protocols does CoralReef support?
• 3.2 Will the ATM cards support culling traffic by VCs?
• 3.3 Will CoralReef enable me to get the cards to echo (pass-through) ATM cells (which would make it possible to splice the card into the existing fiber link instead of splitting off part of the signal for the card)?
• 3.4 What about SDH on European links?
• 3.5 What POS support does CoralReef provide?
• 3.6 Does Coralreef support any Gigabit Ethernet cards?
• 3.7 When I use CoralReef's ATM cell reassembly function, how can I make sure that no cells are lost?

4. Network/Transport Layers

• 4.1 How do I filter traffic?
• 4.2 How do I anonymize captured traffic to protect privacy?
• 4.3 Can I play back traffic using the CoralReef software?
• 4.4 Is there a tcpdump to coral converter?
• 4.5 Is there a coral to tcpdump converter?

5. Software

• 5.1 How do I start using the software?
• 5.2 Where can I get a routing table to use t2_report[++]?
• 5.3 How can I control when a flow is finished using crl_flow? Does crl_flow use the FIN packet for flow termination?

6. Analysis modules

• 6.1 How can I convert an IP address into an AS (Autonomous System) number?
• 6.2 How do I get routing tables for ASFinder?

7. Human Interface

• 7.1 Is it possible to generate reports using CoralReef?
• 7.2 I have many scripts that work on the old NLANR Coral format. How can I make them work with the new package?
• 7.3 What is the CoralReef file format?
• 7.4 Do you have a description of all the applications that come with CoralReef?

8. Troubleshooting

• 8.1 When compiling on a LINUX system, I get errors involving bool. How do I fix these?
• 8.2 I get compile errors in libsrc/crl involving _crypt_struct, _off64_t, etc. How do I fix these?
• 8.3 CoralReef won't compile with gcc 2.96. How do I fix this?
• 8.4 How do I fix compile errors involving PAnonymizer?
• 8.5 The Perl applications complain about undefined symbols. How do I fix this?
• 8.6 Why do the cell timestamps jump backward in my POINT trace? Why do some applications report intervals with negative duration?
• 8.7 Why do the cell timestamps jump backward in my FATM trace?
• 8.8 Why does the point card sometimes report -185273100 or -454761244 cells lost?
• 8.9 Why does running some Coral applications appear to cause cell/packet loss when the applications are run for a short durations?
• 8.10 Why do CoralReef applications crash the first time one is run on a DAG card?
• 8.11 Why does the report generator t2_report[++] report a large number of Autonomous Systems (AS's) as unknown?
• 8.12 Why doesn't my pcap filter expression match any packets on my VLAN?
• 8.13 Why do I get "no support for coral_type=-2" when reading a native interface (or "-1" when reading a tcpdump file)?
• 8.14 "Warning: BPF filter on interface 0 will run in user space, not in kernel."
• 8.15 Why do I get "Warning: Must use positive value to set FlowCounter's bytes" when reading t2-format data with CAIDA::Tables reading functions?