This is provided for information purposes only. We strongly recommend that you never write a program that reads a CoralReef file directly, but instead always use libcoral (in C) or CRL.pm (in perl) to read CoralReef files. Using the libraries has many advantages, including transparent support for several different formats (even future formats), robustness, simplicity, efficiency, and portability.
CoralReef trace file format (version 9):
| offset | size | description |
| 0 | 1 long | CoralReef format identifier (0x000C04A1) |
| 4 | 1 long | header_size |
| 8 | 1 long | CoralReef format version (0x80000009) |
| 12 | 24 bytes | reserved |
| 36 | 32 byte string | encoding |
| 68 | 1 long | encoding version |
| 72 | 1 short | iface_info_count |
| 74 | 1 short | filter_rule_count |
| 76 | 256 chars | comment |
| 332 | iface_info_count * sizeof(iface_info_t) | array of iface_infos |
| ? | filter_rule_count * sizeof(filter_rule_t) | array of filter_rules (not implemented) |
| ? | ? | padding to multiple of 512 bytes |
| header_size | ? | array of any number of data blocks |
Interface info (iface_info) layout (version 9):
| offset | size | description |
| 0 | 1 long | hw_type |
| 4 | 5 long | reserved |
| 24 | 1 long | I/O mode flags |
| 28 | 1 long | I/O mode first |
| 32 | 1 long | not used |
| 36 | 1 long | bandwidth |
| 40 | 1 long | time_is_le |
| 44 | 1 long | data link layer type |
| 48 | 1 long | timezone offset, in seconds from UTC |
| 52 | 2 longs | capture time (seconds and nanoseconds since 1970-01-01 00:00:00 Z) |
CoralReef block layout:
| offset | size | description |
| 0 | 1 long | interface number |
| 4 | 1 long | cells_per_blk (total number of cells allocated, typically 17475) |
| 8 | 1 long | cell_count (number of cells actually present) |
| 12 | 1 long | cells_lost (number of cells lost) |
| 16 | 1 long | unknown_vpi_vci (cells dropped because vpi/vci unknown) |
| 20 | 2 long | tbegin (time of block start in seconds and nanoseconds) |
| 28 | 2 long | tbegin (time of block end in seconds and nanoseconds) |
| 36 | 40 bytes | pad |
| 76 | cells_per_blk * sizeof(coral_atm_cell_t) | array of CoralReef ATM cells |
CoralReef ATM cell layout, for FATM and POINT cards:
| offset | size | description |
| 0 | 8 bytes | timestamp and FIFO depth |
| 8 | 1 word | ATM header without HEC (note: in format version 3, this was in little endian order for fatm cards) |
| 12 | 48 bytes | payload |
Blocks typically (but not always) contain 17475 cells, which when prefixed by a 76 byte block info structure, makes a block exactly 1 Mebibyte (1048576 bytes).