News Archive

CAIDA Releases New Version of Coral Reef Network Monitoring Toolkit with Support for Off-the-Shelf Network Cards

Published 02/22/2001

Network operators, researchers, engineers, and system administrators in academic or corporate settings now have easier access to research network analysis tools. The San Diego Supercomputer Center's (SDSC) Cooperative Association for Internet Data Analysis (CAIDA) has released version 3.4 of its CoralReef software suite - a set of drivers, libraries, utilities, and analysis software for networks. This latest version adds support for easily available over-the-counter network interface cards.

"With CoralReef, network managers can see what applications are consuming their network bandwidth and identify troublesome applications, unexpected bottlenecks, and other problems," said David Moore, project lead for CAIDA's passive monitoring efforts. "CoralReef can show how much bandwidth is used by Web browsing, DNS lookups, instant messaging, games, file exchange, and other applications. Armed with this information, network managers can take appropriate steps to tune their network connections."

The CoralReef suite (demonstration version at was designed to provide a uniform interface to passive network data for a wide range of applications - from raw capture, which involves getting information off the network as it happens, to real-time report generation, an "after-the-fact" summary. Network and system administrators can use the CoralReef suite to monitor and interpret a wide range of network situations.

CoralReef applications are typically used for detailed workload flow characterization, operational traffic reporting, as well as network debugging. Additionally, developers may build their own customized network monitoring applications, since CoralReef includes modules for the storage and manipulation of frequently collected data including source and destination hosts, IP protocols, ports, and amounts of traffic in bytes, packets, and flows.

"By supporting off-the-shelf network cards using standard UNIX drivers, the analysis tools and reporting capabilities of CoralReef are now available to a wide audience of network operators, researchers, and engineers," Moore said. "In the past, CoralReef only supported certain hardware specialized for capture on high-speed networks. In the latest release, reports can be made on usage patterns for local-area networks or intranets as well, by using the libpcap API developed at LBL."

CoralReef 3.4 new features include:

  • Support for live pcap interfaces, which allows use of off-the-shelf network cards
  • Support for DAG capture cards and file formats
  • Support for POS, CHDLC, PPP (over POS, ATM, or Ethernet), and also Bridged Ethernet over PPP
  • Tcpdump style packet filtering in all CoralReef packet applications
  • Many other enhancements and fixes to applications and C and Perl APIs

While previous CoralReef versions supported various OC3mon, OC12mon, and OC48mon capture hardware, the new release can be used with any hardware interface card that can be read by the tcpdump or libpcap utilities. This greatly extends the ability for network operations personnel to deploy state-of-the-art passive monitoring within their local Internet infrastructures.

CoralReef is known to work under FreeBSD (2.7, 2.8, 3.x, and 4.x), Linux (2.0.36 and 2.2*) and Solaris (2.5, 2.7), and is expected to work on all POSIX systems. The POINT and FORE card drivers work only under FreeBSD; the DAG card is supported only under Linux.

For more information and a real-time demo of CoralReef on UCSD's campus link to the commodity Internet, please see CoralReef has been licensed by Caimis, Inc (

Formed in 1997, CAIDA is a collaborative undertaking among organizations in the commercial, government, and research sectors aimed at promoting greater cooperation in the engineering and maintenance of a robust, scalable global Internet infrastructure. CAIDA provides a neutral framework to support cooperative technical endeavors. Support for CAIDA's CoralReef project is provided by DARPA's Next Generation Internet program, the National Science Foundation, and CAIDA members.

SDSC ( is an organized research unit of the University of California, San Diego, and the leading-edge site of the National Partnership for Advanced Infrastructure (NPACI) ( SDSC is funded by the National Science Foundation through NPACI and other federal agencies, the State and University of California, and private organizations. For additional information about SDSC and NPACI, contact David Hart,, 858-534-8314.

David Hart, SDSC, 858-534-8314,