4. Network/Transport Layers

4.1 How do I filter traffic?

CoralReef applications can apply pcap filters to any interface (not just pcap interfaces) with the filter command. On ATM interfaces, CoralReef applications can improve performance by applying a pcap filter before AAL5 reassembly with the prefilter command.

Some DAG cards support filtering on the card. It is not yet known how this interacts with CoralReef.

4.2 How do I anonymize captured traffic to protect privacy?

CoralReef applications anonymize traffic with the anonymize command, which has options for deep IPv4 and IPv6 address anonymization and packet payload truncation.

4.3 Can I play back traffic using the CoralReef software?

There is a very limited playback application (not installed by default), which transmits a single hardcoded ATM cell repeatedly over a given VP/VC on a given ForeRunner device.

4.4 Is there a tcpdump to coral converter?

Not as such, but it is not necessary since CoralReef applications that work at the network layer can read tcpdump files directly.

4.5 Is there a coral to tcpdump converter?

crl_to_pcap reads any coral source and outputs a pcap-format file.