search

ntop / nProbe

Open source components and extensions for nProbe
http://ntop.org
GNU General Public License v2.0
1.65k stars 44 forks source link

Layer 7 related metadata available with Textual dump but partially missing in direct Kafka dump and almost missing in IPFIX format also #356

Open shiv1997narayan opened 5 years ago

shiv1997narayan commented 5 years ago

Add all Layer 7 related metadata available with Textual dump but partially missing in direct Kafka dump and almost missing in IPFIX format. In IPFIX format though they are sending 3/5 parameters as per template but only application id is filled, others are with no value

For Example DNS_QUERY, DNS_QUERY_TYPE, DNS_RET_CODE parameters

==================================== || Cento Logs - Textual Dump ||

FIRST_SWITCHED|LAST_SWITCHED|VLAN_ID|IN_SRC_MAC|IN_DST_MAC|IP_PROTOCOL_VERSION|PROTOCOL|IP_SRC_ADDR|L4_SRC_PORT|IP_DST_ADDR|L4_DST_PORT|DIRECTION|INPUT_SNMP|OUTPUT_SNMP|SRC_PKTS|SRC_BYTES|DST_PKTS|DST_BYTES|TCP_FLAGS|SRC_TOS|DST_TOS|CLIENT_NW_LATENCY_MS|SERVER_NW_LATENCY_MS|L7_PROTO|L7_PROTO_NAME|DNS_QUERY|DNS_QUERY_TYPE|DNS_RET_CODE|HTTP_HOST|HTTP_URL|HTTP_RET_CODE

1556023172.304410|1556023268.606157|0|00:23:9C:F5:30:52|D4:04:FF:2E:B4:17|4|6|117.225.44.236|50076|47.252.102.220|443|R2R|1|2|10|711|0|0|24|0|0|0|0|91|SSL||0|0|| 1556023158.566344|1556023278.626888|0|00:23:9C:F5:36:1F|84:C1:C1:12:40:50|4|6|13.107.42.11|443|223.190.91.7|57187|R2R|1|2|20|9217|12|558|24|0|0|0|0|91|SSL||0|0|| 1556023163.287940|1556023272.309336|0|00:23:9C:F5:35:D0|84:C1:C1:12:40:2F|4|6|49.201.46.25|28363|157.240.16.16|443|R2R|1|2|56|12037|0|0|24|0|0|0|0|119|SSL.Facebook||0|0|lithium.facebook.com| 1556023173.518779|1556023293.446617|0|84:C1:C1:12:47:F9|00:23:9C:F5:36:F2|4|6|119.28.243.122|17500|110.172.135.254|44437|R2R|1|2|48|4555|0|0|24|104|0|0|0|0|Unknown||0|0|| 1556023171.594695|1556023287.517919|0|00:23:9C:F5:30:29|84:C1:C1:12:47:F6|4|17|117.239.224.140|389|51.15.144.131|36439|R2R|1|2|28|36400|0|0|0|0|0|0|0|112|LDAP||0|0|| 1556023159.606407|1556023278.556043|0|00:23:9C:F5:36:9E|D4:04:FF:2E:BB:F9|4|6|13.228.85.158|80|150.242.63.249|47195|R2R|1|2|8|462|0|0|24|0|0|0|0|0|Unknown||0|0|| 1556023177.142562|1556023274.599517|0|D4:04:FF:2E:BC:22|00:23:9C:F5:32:C2|4|17|59.144.144.100|53|182.68.215.225|2285|R2R|1|2|5|275|0|0|0|0|0|0|0|5|DNS|localhost|0|REFUSED||| 1556023176.776758|1556023290.867930|0|D4:04:FF:2E:BB:F9|00:23:9C:F5:36:9E|4|17|173.66.100.16|33543|182.74.79.227|40081|R2R|1|2|17|8867|0|0|0|0|0|0|0|0|Unknown||0|0|| 1556023168.585437|1556023283.937525|0|00:23:9C:F5:34:D5|D4:04:FF:2E:BC:27|4|17|103.93.209.72|65208|117.222.204.73|1025|R2R|1|2|29|3594|0|0|0|0|0|0|0|0|Unknown||0|0|| 1556023177.617739|1556023295.787524|0|84:C1:C1:12:40:50|00:23:9C:F5:36:1F|4|17|197.0.45.98|61491|103.81.215.53|33926|R2R|1|2|293|323196|0|0|0|0|0|0|0|37|BitTorrent||0|0|| 1556023174.476213|1556023288.646248|0|00:23:9C:F5:30:52|D4:04:FF:2E:B4:17|4|6|117.234.63.81|44120|178.152.82.25|49967|R2R|1|2|19|1266|0|0|26|0|0|0|0|0|Unknown||0|0|| 1556023175.102641|1556023293.828305|0|00:23:9C:F5:30:CE|D4:04:FF:2E:BB:EF|4|6|182.68.18.66|39850|182.79.144.141|443|R2R|1|2|510|27746|1207|1781991|26|0|0|15|0|91|SSL||0|0|r2---sn-ci5gup-qxay.gvt1.com| 1556023176.181269|1556023293.647783|0|84:C1:C1:12:48:2A|00:23:9C:F5:36:48|4|6|220.243.208.116|443|223.185.205.115|50731|R2R|1|2|25|1150|0|0|17|0|0|0|0|91|SSL||0|0|| 1556023175.317150|1556023287.384505|0|84:C1:C1:12:40:17|00:23:9C:F5:35:00|4|17|173.66.100.16|50554|182.74.79.227|6600|R2R|1|2|24|11552|0|0|0|0|0|0|0|0|Unknown||0|0|| 1556023163.648935|1556023283.650788|0|D4:04:FF:2E:BC:22|00:23:9C:F5:32:C2|4|17|172.217.26.205|443|182.64.167.170|51542|R2R|1|2|9|450|0|0|0|0|0|0|0|126|QUIC.Google||0|0|| 1556023168.779856|1556023283.607061|0|84:C1:C1:12:40:17|00:23:9C:F5:35:00|4|17|172.217.160.238|443|182.64.126.72|45780|R2R|1|2|15|935|0|0|0|0|0|0|0|126|QUIC.Google||0|0||

==================================== || Cento Logs for Kafka type Export ||

{"8":"208.80.127.2","12":"202.56.215.65","10":0,"14":0,"2":1,"1":77,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":53,"11":4540,"6":0,"4":17,"5":0,"57590":5,"57677":"www.frbhjvazapgo.com"} {"8":"117.220.2.131","12":"85.25.103.30","10":0,"14":0,"2":7,"1":372,"24":0,"23":0,"22":1554201350,"21":1554201392,"7":56106,"11":80,"6":19,"4":6,"5":0,"57590":7} {"8":"123.136.203.90","12":"40.68.212.154","10":0,"14":0,"2":20,"1":3040,"24":0,"23":0,"22":1554201390,"21":1554201392,"7":60353,"11":3478,"6":0,"4":17,"5":0,"57590":78} {"8":"106.207.162.1","12":"202.56.215.41","10":0,"14":0,"2":1,"1":62,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":15201,"11":53,"6":0,"4":17,"5":104,"57590":119,"57677":"www.facebook.com"} {"8":"106.207.241.117","12":"202.56.215.41","10":0,"14":0,"2":1,"1":70,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":8420,"11":53,"6":0,"4":17,"5":104,"57590":239,"57677":"people-pa.googleapis.com"} {"8":"106.207.215.83","12":"202.56.215.41","10":0,"14":0,"2":1,"1":64,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":10642,"11":53,"6":0,"4":17,"5":104,"57590":5,"57677":"ap.appcloudbox.net"} {"8":"106.219.255.48","12":"23.57.232.76","10":0,"14":0,"2":2,"1":230,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":39525,"11":443,"6":24,"4":6,"5":104,"57590":91} {"8":"103.212.128.172","12":"51.38.8.84","10":0,"14":0,"2":4,"1":186,"24":0,"23":0,"22":1554201383,"21":1554201392,"7":39149,"11":52569,"6":22,"4":6,"5":0,"57590":0} {"8":"208.100.26.228","12":"49.249.147.87","10":0,"14":0,"2":1,"1":46,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":59277,"11":587,"6":2,"4":6,"5":0,"57590":29} {"8":"106.207.195.3","12":"202.56.215.41","10":0,"14":0,"2":1,"1":72,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":12356,"11":53,"6":0,"4":17,"5":104,"57590":228,"57677":"android.clients.google.com"} {"8":"117.252.70.57","12":"84.201.146.69","10":0,"14":0,"2":5,"1":749,"24":0,"23":0,"22":1554201391,"21":1554201392,"7":8080,"11":63185,"6":91,"4":6,"5":0,"57590":175} {"8":"223.185.53.39","12":"202.56.215.41","10":0,"14":0,"2":1,"1":78,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":17631,"11":53,"6":0,"4":17,"5":104,"57590":124,"57677":"r1---sn-h557sns7.googlevideo.com"} {"8":"182.79.251.161","12":"110.225.82.100","10":0,"14":0,"2":34,"1":1916,"24":0,"23":0,"22":1554201062,"21":1554201392,"7":443,"11":25286,"6":0,"4":17,"5":0,"57590":188} {"8":"27.60.54.111","12":"202.56.215.41","10":0,"14":0,"2":1,"1":59,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":3860,"11":53,"6":0,"4":17,"5":104,"57590":124,"57677":"s.youtube.com"} {"8":"117.234.106.117","12":"47.74.184.229","10":0,"14":0,"2":12,"1":1198,"24":0,"23":0,"22":1554201390,"21":1554201392,"7":60322,"11":443,"6":26,"4":6,"5":0,"57590":91,"57659":"api.cloudmobi.net"} {"8":"223.185.24.82","12":"202.56.215.41","10":0,"14":0,"2":1,"1":68,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":20071,"11":53,"6":0,"4":17,"5":104,"57590":5,"57677":"2.android.pool.ntp.org"} {"8":"185.153.197.231","12":"116.119.135.234","10":0,"14":0,"2":31,"1":1426,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":53802,"11":3325,"6":2,"4":6,"5":0,"57590":0} {"8":"14.102.80.137","12":"27.8.255.253","10":0,"14":0,"2":1,"1":42,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":24103,"11":23,"6":2,"4":6,"5":0,"57590":77} {"8":"223.229.243.74","12":"202.56.215.54","10":0,"14":0,"2":1,"1":61,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":64169,"11":53,"6":0,"4":17,"5":0,"57590":5,"57677":"m30.fcsyzii.com"} {"8":"172.217.167.10","12":"223.225.189.189","10":0,"14":0,"2":18,"1":21458,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":443,"11":62901,"6":24,"4":6,"5":0,"57590":91,"57659":""} {"8":"106.207.193.230","12":"202.56.215.41","10":0,"14":0,"2":1,"1":80,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":12400,"11":53,"6":0,"4":17,"5":104,"57590":5,"57677":"presence-grpc-noneu.truecaller.com"} {"8":"172.217.31.14","12":"223.189.91.228","10":0,"14":0,"2":3,"1":1495,"24":0,"23":0,"22":1554201392,"21":1554201392,"7":443,"11":15933,"6":0,"4":17,"5":0,"57590":188}

================================================= || Cento Logs for IPFIX type Export collected by ipfixcol and converted into JSON ||

{"@type": "ipfix.entry", "ipfix.58": 0, "ipfix.sourceMacAddress": "d4:04:ff:2e:bc:22", "ipfix.postDestinationMacAddress": "00:23:9c:f5:32:c2", "ipfix.4": 17, "ipfix.8": "106.215.131.85", "ipfix.7": 6153, "ipfix.12": "202.56.215.41", "ipfix.11": 53, "ipfix.10": 1, "ipfix.14": 2, "ipfix.2": 1, "ipfix.1": 61, "ipfix.152": 1554206414178, "ipfix.153": 1554206414178, "ipfix.6": "......", "ipfix.5": 0, "ipfix.postIpClassOfService": 104, "ipfix.cento_118": 211, "ipfix.cento_123": "", "ipfix.cento_124": "", "ipfix.IPFIXReverseIEPEN_PKTS": 0, "ipfix.IPFIXReverseIEPEN_BYTES": 0}

{"@type": "ipfix.entry", "ipfix.58": 0, "ipfix.sourceMacAddress": "d4:04:ff:2e:bb:ef", "ipfix.postDestinationMacAddress": "00:23:9c:f5:30:ce", "ipfix.4": 17, "ipfix.8": "106.215.213.69", "ipfix.7": 60467, "ipfix.12": "202.56.215.41", "ipfix.11": 53, "ipfix.10": 1, "ipfix.14": 2, "ipfix.2": 1, "ipfix.1": 81, "ipfix.152": 1554206414169, "ipfix.153": 1554206414169, "ipfix.6": "......", "ipfix.5": 104, "ipfix.postIpClassOfService": 0, "ipfix.cento_118": 124, "ipfix.cento_123": "", "ipfix.cento_124": "", "ipfix.IPFIXReverseIEPEN_PKTS": 0, "ipfix.IPFIXReverseIEPEN_BYTES": 0}

{"@type": "ipfix.entry", "ipfix.58": 0, "ipfix.sourceMacAddress": "00:23:9c:f5:30:ce", "ipfix.postDestinationMacAddress": "d4:04:ff:2e:bb:ef", "ipfix.4": 6, "ipfix.8": "49.201.201.232", "ipfix.7": 63067, "ipfix.12": "8.37.239.4", "ipfix.11": 443, "ipfix.10": 1, "ipfix.14": 2, "ipfix.2": 8, "ipfix.1": 1284, "ipfix.152": 1554206407018, "ipfix.153": 1554206414755, "ipfix.6": ".APR.F", "ipfix.5": 0, "ipfix.postIpClassOfService": 0, "ipfix.cento_118": 91, "ipfix.cento_123": "", "ipfix.cento_124": "", "ipfix.IPFIXReverseIEPEN_PKTS": 0, "ipfix.IPFIXReverseIEPEN_BYTES": 0}

{"@type": "ipfix.entry", "ipfix.58": 0, "ipfix.sourceMacAddress": "00:23:9c:f5:30:ce", "ipfix.postDestinationMacAddress": "d4:04:ff:2e:bb:ef", "ipfix.4": 6, "ipfix.8": "14.102.8.38", "ipfix.7": 51955, "ipfix.12": "152.195.35.250", "ipfix.11": 443, "ipfix.10": 1, "ipfix.14": 2, "ipfix.2": 14, "ipfix.1": 2732, "ipfix.152": 1554206413037, "ipfix.153": 1554206414436, "ipfix.6": ".AP..F", "ipfix.5": 0, "ipfix.postIpClassOfService": 0, "ipfix.cento_118": 91, "ipfix.cento_123": "", "ipfix.cento_124": "", "ipfix.IPFIXReverseIEPEN_PKTS": 0, "ipfix.IPFIXReverseIEPEN_BYTES": 0}

{"@type": "ipfix.entry", "ipfix.58": 0, "ipfix.sourceMacAddress": "84:c1:c1:12:40:17", "ipfix.postDestinationMacAddress": "00:23:9c:f5:35:00", "ipfix.4": 17, "ipfix.8": "23.61.199.131", "ipfix.7": 53, "ipfix.12": "202.56.215.65", "ipfix.11": 35712, "ipfix.10": 1, "ipfix.14": 2, "ipfix.2": 1, "ipfix.1": 195, "ipfix.152": 1554206414105, "ipfix.153": 1554206414105, "ipfix.6": "......", "ipfix.5": 0, "ipfix.postIpClassOfService": 0, "ipfix.cento_118": 5, "ipfix.cento_123": "", "ipfix.cento_124": "", "ipfix.IPFIXReverseIEPEN_PKTS": 0, "ipfix.IPFIXReverseIEPEN_BYTES": 0}

{"@type": "ipfix.entry", "ipfix.58": 0, "ipfix.sourceMacAddress": "d4:04:ff:2e:bb:ef", "ipfix.postDestinationMacAddress": "00:23:9c:f5:30:ce", "ipfix.4": 17, "ipfix.8": "106.215.169.230", "ipfix.7": 64206, "ipfix.12": "202.56.215.41", "ipfix.11": 53, "ipfix.10": 1, "ipfix.14": 2, "ipfix.2": 1, "ipfix.1": 71, "ipfix.152": 1554206414548, "ipfix.153": 1554206414548, "ipfix.6": "......", "ipfix.5": 104, "ipfix.postIpClassOfService": 0, "ipfix.cento_118": 126, "ipfix.cento_123": "", "ipfix.cento_124": "", "ipfix.IPFIXReverseIEPEN_PKTS": 0, "ipfix.IPFIXReverseIEPEN_BYTES": 0}

{"@type": "ipfix.entry", "ipfix.58": 0, "ipfix.sourceMacAddress": "84:c1:c1:12:40:17", "ipfix.postDestinationMacAddress": "00:23:9c:f5:35:00", "ipfix.4": 17, "ipfix.8": "106.207.134.52", "ipfix.7": 9841, "ipfix.12": "202.56.215.41", "ipfix.11": 53, "ipfix.10": 1, "ipfix.14": 2, "ipfix.2": 1, "ipfix.1": 60, "ipfix.152": 1554206414275, "ipfix.153": 1554206414275, "ipfix.6": "......", "ipfix.5": 104, "ipfix.postIpClassOfService": 0, "ipfix.cento_118": 5, "ipfix.cento_123": "", "ipfix.cento_124": "", "ipfix.IPFIXReverseIEPEN_PKTS": 0, "ipfix.IPFIXReverseIEPEN_BYTES": 0}

lucaderi commented 5 years ago

What cento version are you using? The Kafka export and JSON dump are sharing the same JSON conversion code

ResearchIntern98 commented 5 years ago

Have updated it to v.1.8.190606 as on date and could see some fields in kafka, after enabling dpi level 2. Could you tell what these PEN fields are as per kafka logs below? 35632.57590 is Application protocol id. Others are not clear. Do these fields cover all DNS, HTTP related metadata like DNS QUERY TYPE, RET CODE etc ? Is there any provision to provide BGP related metadata ?

{ "58": 0, "56": "D4:04:FF:2E:BC:22", "80": "00:23:9C:F5:32:C2", "60": 4, "8": "223.231.110.201", "12": "216.58.196.202", "61": "R2R", "10": 10, "14": 11, "2": 10, "1": 7040, "24": 0, "23": 0, "22": "1561452121", "21": "1561452124", "7": 16161, "11": 443, "6": 24, "4": 6, "5": 0, "55": 56, "35632.123": 0, "35632.124": 0, "35632.57590": 91, "35632.119": "SSL", "35632.57660": "" } { "58": 0, "56": "00:23:9C:F5:35:D0", "80": "84:C1:C1:12:40:2F", "60": 4, "8": "23.15.34.106", "12": "171.76.143.72", "61": "R2R", "10": 10, "14": 11, "2": 1, "1": 60, "24": 0, "23": 0, "22": "1561452129", "21": "1561452129", "7": 80, "11": 25286, "6": 18, "4": 6, "5": 0, "55": 0, "35632.123": 0, "35632.124": 0, "35632.57590": 7, "35632.119": "HTTP" } { "58": 0, "56": "84:C1:C1:12:47:F9", "80": "00:23:9C:F5:36:F2", "60": 4, "8": "223.238.160.29", "12": "202.56.215.41", "61": "R2R", "10": 10, "14": 11, "2": 1, "1": 70, "24": 0, "23": 0, "22": "1561452114", "21": "1561452114", "7": 33067, "11": 53, "6": 0, "4": 17, "5": 0, "55": 104, "35632.123": 0, "35632.124": 0, "35632.57590": 0, "35632.119": "DNS", "35632.57677": "www.googleadservices.com", "35632.207": 1, "35632.57680": 0 } { "58": 0, "56": "D4:04:FF:2E:BC:22", "80": "00:23:9C:F5:32:C2", "60": 4, "8": "106.202.8.44", "12": "202.56.215.41", "61": "R2R", "10": 10, "14": 11, "2": 1, "1": 60, "24": 0, "23": 0, "22": "1561452129", "21": "1561452129", "7": 63474, "11": 53, "6": 0, "4": 17, "5": 104, "55": 0, "35632.123": 0, "35632.124": 0, "35632.57590": 0, "35632.119": "DNS", "35632.57677": "rfrvuecskmjfyf", "35632.207": 1, "35632.57680": 0 } { "58": 0, "56": "D4:04:FF:2E:B4:17", "80": "00:23:9C:F5:30:52", "60": 4, "8": "110.225.46.141", "12": "216.58.196.74", "61": "R2R", "10": 10, "14": 11, "2": 1, "1": 52, "24": 0, "23": 0, "22": "1561452129", "21": "1561452129", "7": 19774, "11": 443, "6": 16, "4": 6, "5": 104, "55": 0, "35632.123": 0, "35632.124": 0, "35632.57590": 91, "35632.119": "SSL" } { "58": 0, "56": "84:C1:C1:12:48:2A", "80": "00:23:9C:F5:36:48", "60": 4, "8": "106.205.43.97", "12": "202.56.215.41", "61": "R2R", "10": 10, "14": 11, "2": 1, "1": 65, "24": 0, "23": 0, "22": "1561452120", "21": "1561452120", "7": 49503, "11": 53, "6": 0, "4": 17, "5": 104, "55": 0, "35632.123": 0, "35632.124": 0, "35632.57590": 0, "35632.119": "DNS", "35632.57677": "proxy.googlezip.net", "35632.207": 28, "35632.57680": 0 } { "58": 0, "56": "D4:04:FF:2E:B4:48", "80": "00:23:9C:F5:32:99", "60": 4, "8": "106.205.117.99", "12": "216.58.196.68", "61": "R2R", "10": 10, "14": 11, "2": 8, "1": 1205, "24": 0, "23": 0, "22": "1561452112", "21": "1561452112", "7": 41899, "11": 443, "6": 26, "4": 6, "5": 104, "55": 0, "35632.123": 0, "35632.124": 0, "35632.57590": 126, "35632.119": "SSL.Google", "35632.57660": "www.google.com" } { "58": 0, "56": "00:23:9C:F5:30:52", "80": "D4:04:FF:2E:B4:17", "60": 4, "8": "172.217.166.237", "12": "106.205.112.201", "61": "R2R", "10": 10, "14": 11, "2": 2, "1": 112, "24": 0, "23": 0, "22": "1561452108", "21": "1561452108", "7": 443, "11": 37107, "6": 19, "4": 6, "5": 0, "55": 0, "35632.123": 0, "35632.124": 0, "35632.57590": 91, "35632.119": "SSL" } { "58": 0, "56": "D4:04:FF:2E:BC:22", "80": "00:23:9C:F5:32:C2", "60": 4, "8": "223.185.45.26", "12": "172.217.27.194", "61": "R2R", "10": 10, "14": 11, "2": 1, "1": 46, "24": 0, "23": 0, "22": "1561452122", "21": "1561452122", "7": 37547, "11": 443, "6": 20, "4": 6, "5": 104, "55": 0, "35632.123": 0, "35632.124": 0, "35632.57590": 91, "35632.119": "SSL" } { "58": 0, "56": "00:23:9C:F5:30:CE", "80": "D4:04:FF:2E:BB:EF", "60": 4, "8": "216.58.196.193", "12": "59.145.174.78", "61": "R2R", "10": 10, "14": 11, "2": 3, "1": 156, "24": 0, "23": 0, "22": "1561452127", "21": "1561452127", "7": 443, "11": 45577, "6": 17, "4": 6, "5": 0, "55": 0, "35632.123": 0, "35632.124": 0, "35632.57590": 91, "35632.119": "SSL" } { "58": 0, "56": "00:23:9C:F5:35:D0", "80": "84:C1:C1:12:40:2F", "60": 4, "8": "125.16.69.229", "12": "115.112.116.113", "61": "R2R", "10": 10, "14": 11, "2": 5, "1": 319, "24": 0, "23": 0, "22": "1561452123", "21": "1561452123", "7": 443, "11": 51012, "6": 26, "4": 6, "5": 0, "55": 0, "35632.123": 28, "35632.124": 0, "35632.57590": 91, "35632.119": "SSL" } { "58": 0, "56": "84:C1:C1:12:48:27", "80": "00:23:9C:F5:30:7C", "60": 4, "8": "106.207.143.92", "12": "202.56.215.41", "61": "R2R", "10": 10, "14": 11, "2": 1, "1": 61, "24": 0, "23": 0, "22": "1561452114", "21": "1561452114", "7": 14549, "11": 53, "6": 0, "4": 17, "5": 104, "55": 0, "35632.123": 0, "35632.124": 0, "35632.57590": 0, "35632.119": "DNS", "35632.57677": "m.gaoxiaola.com", "35632.207": 28, "35632.57680": 0 } { "58": 0, "56": "D4:04:FF:2E:BB:EF", "80": "00:23:9C:F5:30:CE", "60": 4, "8": "223.189.81.242", "12": "23.15.34.90", "61": "R2R", "10": 10, "14": 11, "2": 1, "1": 60, "24": 0, "23": 0, "22": "1561452128", "21": "1561452128", "7": 10818, "11": 80, "6": 2, "4": 6, "5": 104, "55": 0, "35632.123": 0, "35632.124": 0, "35632.57590": 7, "35632.119": "HTTP" } { "58": 0, "56": "00:23:9C:F5:35:D0", "80": "84:C1:C1:12:40:2F", "60": 4, "8": "103.209.140.101", "12": "169.21.204.155", "61": "R2R", "10": 10, "14": 11, "2": 1, "1": 46, "24": 0, "23": 0, "22": "1561452119", "21": "1561452119", "7": 11967, "11": 80, "6": 2, "4": 6, "5": 0, "55": 0, "35632.123": 0, "35632.124": 0, "35632.57590": 7, "35632.119": "HTTP" }

What L7 metadata is the cento providing in ipfix format. Earlier it provided only 118, 123 amd 124 with PEN 35632 ? We need all L7 metadata in ipfix and kafka format both.