This is provided for information purposes only. We strongly recommend that you never write a program that reads a CoralReef file directly, but instead always use libcoral (in C) or CRL.pm (in perl) to read CoralReef files. Using the libraries has many advantages, including transparent support for several different formats (even future formats), robustness, simplicity, efficiency, and portability.

CoralReef trace file format (version 9):

offset size description
0 1 long CoralReef format identifier (0x000C04A1)
4 1 long header_size
8 1 long CoralReef format version (0x80000009)
12 24 bytes reserved
36 32 byte string encoding
68 1 long encoding version
72 1 short iface_info_count
74 1 short filter_rule_count
76 256 chars comment
332 iface_info_count * sizeof(iface_info_t) array of iface_infos
? filter_rule_count * sizeof(filter_rule_t) array of filter_rules (not implemented)
? ? padding to multiple of 512 bytes
header_size? array of any number of data blocks

Interface info (iface_info) layout (version 9):

offset size description
0 1 long hw_type
4 5 long reserved
24 1 long I/O mode flags
28 1 long I/O mode first
32 1 long not used
36 1 long bandwidth
40 1 long time_is_le
44 1 long data link layer type
48 1 long timezone offset, in seconds from UTC
52 2 longs capture time (seconds and nanoseconds since 1970-01-01 00:00:00 Z)

CoralReef block layout:

offset size description
0 1 long interface number
4 1 long cells_per_blk (total number of cells allocated, typically 17475)
8 1 long cell_count (number of cells actually present)
12 1 long cells_lost (number of cells lost)
16 1 long unknown_vpi_vci (cells dropped because vpi/vci unknown)
20 2 long tbegin (time of block start in seconds and nanoseconds)
28 2 long tbegin (time of block end in seconds and nanoseconds)
36 40 bytes pad
76 cells_per_blk * sizeof(coral_atm_cell_t) array of CoralReef ATM cells

CoralReef ATM cell layout, for FATM and POINT cards:

offset size description
0 8 bytes timestamp and FIFO depth
8 1 word ATM header without HEC (note: in format version 3, this was in little endian order for fatm cards)
12 48 bytes payload

Blocks typically (but not always) contain 17475 cells, which when prefixed by a 76 byte block info structure, makes a block exactly 1 Mebibyte (1048576 bytes).

Related Objects

See https://catalog.caida.org/software/coralreef/ to explore related objects to this document in the CAIDA Resource Catalog.