Upgrade a Netflow consumer driver for serializing to the CSV schema suitable for the DCP PALANTIR component

[daniel-gonzalez-sanchez]

For the integration between the SDA and the DCP, the proposed architecture is as follows:

• In 1 the exported packets will be received by the SDA component using Goflow2 as a collector, this Netflow information will be aggregated to give bidirectional information and the aggregated features.

• The output of the SDA (2) will be written in PALANTIR’s Kafka with the schema Raw Netflow Data + Aggregated features:

ts,te,td,sa,da,sp,dp,pr,flg,fwd,stos,ipkt,ibyt,opkt,obyt,in,out,sas,das,smk,dmk,dtos,dir,nh,nhb,svln,dvln,ismc,odmc,idmc,osmc,mpls1,mpls2,mpls3,mpls4,mpls5,mpls6,mpls7,mpls8,mpls9,mpls10,cl,sl,al,ra,eng,exid,tr,zeek_field,pktips,pktops,bytips,bytops,bytippkt,bytoppkt,bytipo,pktipo

The Consumer Driver must be updated to allow serialization of all Netflow fields to this CSV schema. The zeek_extra_field is an extra field to be added because is nedeed to be consider and filled by the Zeek monitoring component in PALANTIR. The Consumer Driver adds the $ default value to this zeek_extra_field