IPFIX collector Installation

Introduced in ASN 2.5

IPFIXcol2 Deployment Guide (Aviz ASN)

This guilde mainly focused on KPI templte used for IPFIX element

Platform used for deploying IPFIX collector

• Ubuntu 22.04 LTS

• Docker installed

• Docker Compose installed

• Kafka already running

Each file and directory in ~/ipfixcol2 has a specific purpose. Together, they define how the collector is built, configured, and run.

File/Directory	Purpose	Required?
Dockerfile	Builds a Docker image with libfds and IPFIXcol2 installed.	✅ Yes
docker-compose.yml	Starts the container, maps ports, and mounts configuration files and directories.	✅ Yes
ipfixcol2.xml	Main runtime configuration of IPFIXcol2 (input plugins, output plugins, etc.).	✅ Yes
enterprise/	Stores enterprise Information Element (IE) XML files such as kpi_fields.xml.	✅ Yes (for Aviz Networks enterprise fields)
logs/	Stores collector log files if logging to files is configured.	Optional
output/	Stores exported output (JSON, files, etc.) if file-based output plugins are used.	Optional

Verify Docker:

docker --version
docker compose version
docker ps

Create Ipfix Directory

mkdir -p ~/ipfixcol2
cd ~/ipfixcol2

mkdir enterprise
mkdir logs
mkdir output

Directory structure:

ipfixcol2/

├── Dockerfile
├── docker-compose.yml
├── ipfixcol2.xml
├── enterprise/
├── logs/
└── output/

aviz@aviz:~/ipfixcol2$ ls
docker-compose.yml  Dockerfile  enterprise  ipfixcol2.xml  logs  output
aviz@aviz:~/ipfixcol2$ 

Create Dockerfile

Build IPFIXcol2 from source.

Install dependencies:

• git

• cmake

• build-essential

• pkg-config

• libxml2-dev

• libssl-dev

• zlib1g-dev

• liblz4-dev

• libzstd-dev

• librdkafka-dev

• libcurl4-openssl-dev

• libpcap-dev

Build:

• Clone libfds

• Build libfds

• Install libfds

• Clone ipfixcol2

• Build ipfixcol2

• Install ipfixcol2

Dockerfile

aviz@aviz:~/ipfixcol2$ cat Dockerfile 
FROM ubuntu:22.04
ENV DEBIAN_FRONTEND=noninteractive
# Install build dependencies
RUN apt-get update && apt-get install -y \
    git \
    cmake \
    build-essential \
    pkg-config \
    ca-certificates \
    python3-docutils \
    libssl-dev \
    libxml2-dev \
    zlib1g-dev \
    liblz4-dev \
    libzstd-dev \
    libcurl4-openssl-dev \
    libpcap-dev \
    librdkafka-dev && \
    rm -rf /var/lib/apt/lists/*
WORKDIR /opt
# -----------------------------------------------------------------------------
# Build libfds
# -----------------------------------------------------------------------------
RUN git clone https://github.com/CESNET/libfds.git && \
    cd libfds && \
    mkdir build && \
    cd build && \
    cmake .. && \
    make -j$(nproc) && \
    make install && \
    ldconfig
# -----------------------------------------------------------------------------
# Build ipfixcol2 (collector only)
# -----------------------------------------------------------------------------
RUN git clone https://github.com/CESNET/ipfixcol2.git && \
    cd ipfixcol2 && \
    mkdir build && \
    cd build && \
    cmake .. -DCMAKE_INSTALL_PREFIX=/usr && \
    make -j$(nproc) && \
    make install && \
    ldconfig
RUN mkdir -p /etc/ipfixcol2
RUN mkdir -p /etc/libfds/user/elements
COPY ipfixcol2.xml /etc/ipfixcol2/ipfixcol2.xml
EXPOSE 4739/udp
CMD ["ipfixcol2", "-c", "/etc/ipfixcol2/ipfixcol2.xml"]
aviz@aviz:~/ipfixcol2$ 

Create Collector Configuration

~/ipfixcol2/ipfixcol2.xml

Ipfixcol2.xml :

aviz@aviz:~/ipfixcol2$ cat ipfixcol2.xml
<?xml version="1.0" encoding="UTF-8"?>
<ipfixcol2>
  <!-- Input plugin -->
  <inputPlugins>
    <input>
      <name>UDP input</name>
      <plugin>udp</plugin>
      <params>
        <localPort>4739</localPort>
        <localIPAddress>0.0.0.0</localIPAddress>
      </params>
    </input>
  </inputPlugins>
  <!-- Output plugin -->
  <outputPlugins>
    <output>
      <name>Viewer output</name>
      <plugin>viewer</plugin>
      <params/>
    </output>
  </outputPlugins>
</ipfixcol2>
aviz@aviz:~/ipfixcol2$ 

Create docker-compose.yml

aviz@aviz:~/ipfixcol2$ cat docker-compose.yml 
version: "3.8"
services:
  ipfixcol2:
    build: .
    container_name: ipfixcol2
    restart: unless-stopped
    ports:
      - "4739:4739/udp"
    volumes:
      - ./ipfixcol2.xml:/etc/ipfixcol2/ipfixcol2.xml
      - ./enterprise:/usr/local/etc/libfds/user/elements
      - ./output:/output
      - ./logs:/logs
aviz@aviz:~/ipfixcol2$ 

Configure Aviz Information Elements

~cd /ipfixcol2/enterprise/

Copy:

kpi_fields.xml

Verify:

ls ~/ipfixcol2/enterprise

Expected:

kpi_fields.xml

Update IPFIX Aviz template to kpi_fields.xml

nano kpi_fields.xml

<?xml version="1.0" encoding="utf-8"?>
<ipfix-elements>

  <scope>
    <pen>58564</pen>
    <name>Aviz</name>
    <biflow mode="none"/>
  </scope>

  <!-- ============================================================
       Core KPI fields (IDs 1-30)  MAIN template (256/257)
       ============================================================ -->
   
  <element><id>1</id><name>Seq</name><dataType>unsigned32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>2</id><name>ASN_DEV_ID</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>3</id><name>EXPORT_TYPE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>4</id><name>KPI_INT_AVG_BW</name><dataType>float64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>6</id><name>KPI_INT_TIME</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>7</id><name>KPI_PKT_LOSS</name><dataType>unsigned32</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>8</id><name>KPI_JITTER</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>9</id><name>KPI_MIN_UP_LAT</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>10</id><name>KPI_MAX_UP_LAT</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>11</id><name>KPI_MIN_DOWN_LAT</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>12</id><name>KPI_MAX_DOWN_LAT</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>13</id><name>KPI_INT_AVG_UP_LAT</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>14</id><name>KPI_INT_AVG_DOWN_LAT</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>15</id><name>KPI_RETRANSMIT</name><dataType>unsigned32</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>16</id><name>HashIdx</name><dataType>unsigned32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>17</id><name>TOPIC_KEY</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>18</id><name>PayloadType</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>19</id><name>KPI_INT_ACTIVE_AVG_BW</name><dataType>float64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>360</id><name>KPI_INT_ACTIVE_PKTS</name><dataType>unsigned64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>20</id><name>KPI_INT_ACTIVE_BYTES</name><dataType>unsigned64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>21</id><name>KPI_INT_ACTIVE_TIME</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>22</id><name>KPI_INT_ID</name><dataType>unsigned32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>23</id><name>AppAttribute</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>24</id><name>AppProtocol</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>25</id><name>PubTime_ns</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>26</id><name>PubTime_ms</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>27</id><name>CalStartTime_ns</name><dataType>dateTimeNanoseconds</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>28</id><name>CalEndTime_ns</name><dataType>dateTimeNanoseconds</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>29</id><name>KPI_MIN_AVG_BW</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>30</id><name>KPI_MAX_AVG_BW</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>270</id><name>AppGroup</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>271</id><name>IPProto</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>272</id><name>SrcMac</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>273</id><name>DstMac</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>274</id><name>VlanId</name><dataType>signed16</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>275</id><name>Diameter_RuleBaseName</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- ============================================================
       EPC Diameter correlated fields (appended to EPC control record)
       IDs: 538-543  (gated by diameter enable flag)
       ============================================================ -->
  <element><id>538</id><name>Diameter_IMSI</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>539</id><name>Diameter_MSISDN</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>540</id><name>Session_ID</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>541</id><name>Origin_Host</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>542</id><name>Destination_Host</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>543</id><name>Last_Seen_Msg</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>353</id><name>TOTAL_BYTES</name><dataType>unsigned64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>354</id><name>TOTAL_PKTS</name><dataType>unsigned64</dataType><dataSemantics>totalCounter</dataSemantics></element>
                  <!-- ============================================================      

                             GTP-U / outer-tunnel enterprise IEs (Phase 3)
                             IDs: 67-73
                        ============================================================ -->
 
 <element><id>67</id><name>TEID</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>      
 <element><id>68</id><name>OutSrcIp</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>                  
 <element><id>69</id><name>OutDstIp</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
 <element><id>70</id><name>OutSrcPort</name><dataType>signed16</dataType><dataSemantics>quantity</dataSemantics></element>
 <element><id>71</id><name>OutDstPort</name><dataType>signed16</dataType><dataSemantics>quantity</dataSemantics></element>
 <element><id>72</id><name>OutProto</name><dataType>unsigned8</dataType><dataSemantics>quantity</dataSemantics></element>
 <element><id>73</id><name>Outer_TOS</name><dataType>unsigned8</dataType><dataSemantics>quantity</dataSemantics></element>

                  <!-- ============================================================    
                                CORRELATION
                                ID : 74
                       ============================================================ -->

 <element><id>74</id><name>CorrStatus</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>     
 
                   <!-- =======================================================
                             CORE SESSION
                             ID :75
                        ============================================================ -->              

<element><id>75</id><name>PublishedTime</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
              
                         
          
   <!-- ============================================================ 
         EPC Bearer SubTemplateList carrier (Template 258, field 500) 
         dataType=subTemplateList tells the collector to decode the   
         variable-length bytes using sub-template 310.               
         ============================================================ -->
    
<element><id>500</id><name>BEARER_STL</name><dataType>subTemplateList</dataType><dataSemantics>default</dataSemantics></element>

    <!-- ============================================================ 
          Bearer Sub-Template Fields (Template ID: 310)               
          12 fields, one value per bearer slot                        
          ============================================================ -->

<element><id>501</id><name>BEARER_ID</name><dataType>signed8</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>502</id><name>MME_GTPC_TEID</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>503</id><name>SGW_GTPC_TEID</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>504</id><name>SGW_GTPU_TEID</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>505</id><name>ENODEB_GTPU_TEID</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>506</id><name>MME_GTPC_IP_ADDR</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>507</id><name>SGW_GTPC_IP_ADDR</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>508</id><name>SGW_GTPU_IP_ADDR</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>509</id><name>ENODEB_GTPU_IP_ADDR</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>510</id><name>UE_IPv4_ADDR</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>511</id><name>UE_IPv6_ADDR</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>512</id><name>UE_IPv6_Prefix</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>

    <!-- ============================================================ 
         Bearer Sub-Template Fields — S5S8 interface variants         
         Sub-Template ID 310 (same template, IE IDs differ from S11)  
         On S5S8: MME→SGW_GTPC, SGW_GTPC→PGW_GTPC,                 
              SGW_GTPU→PGW_GTPU, eNodeB→SGW_GTPU                 
         ============================================================ -->
    
<element><id>513</id><name>SGW_GTPC_TEID_S5S8</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>514</id><name>PGW_GTPC_TEID_S5S8</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>515</id><name>PGW_GTPU_TEID_S5S8</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>516</id><name>SGW_GTPU_TEID_S5S8</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>517</id><name>SGW_GTPC_IP_ADDR_S5S8</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>518</id><name>PGW_GTPC_IP_ADDR_S5S8</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>519</id><name>PGW_GTPU_IP_ADDR_S5S8</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>529</id><name>SGW_GTPU_IP_ADDR_S5S8</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>


                  <!-- ============================================================    
                                 LAST ACTIVE BEARER TEMPLATE
                                 IDs : 88-99 
                       ============================================================ -->        

<element><id>88</id><name>BEARER_ID_LAST</name><dataType>signed8</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>89</id><name>MME_GTPC_TEID_PDU_LAST</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>90</id><name>SGW_GTPC_TEID_PDU_LAST</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>91</id><name>SGW_GTPU_TEID_PDU_LAST</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>92</id><name>ENODEB_GTPU_TEID_PDU_LAST</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>93</id><name>MME_GTPC_IP_ADDR_PDU_LAST</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>94</id><name>SGW_GTPC_IP_ADDR_PDU_LAST</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>95</id><name>SGW_GTPU_IP_ADDR_PDU_LAST</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>96</id><name>ENODEB_GTPU_IP_ADDR_PDU_LAST</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>97</id><name>UE_IPv4_ADDR_PDU_LAST</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>98</id><name>UE_IPv6_ADDR_PDU_LAST</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>99</id><name>UE_IPv6_Prefix_PDU_LAST</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>

    <!-- ============================================================
         Last Active Bearer — S5S8 interface variants (IDs 530-537)
         Same role mapping as bearer sub-template S5S8 IEs:
         MME→SGW_GTPC, SGW_GTPC→PGW_GTPC, SGW_GTPU→PGW_GTPU, eNodeB→SGW_GTPU
         ============================================================ -->
<element><id>530</id><name>SGW_GTPC_TEID_PDU_LAST_S5S8</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>531</id><name>PGW_GTPC_TEID_PDU_LAST_S5S8</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>532</id><name>PGW_GTPU_TEID_PDU_LAST_S5S8</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>533</id><name>SGW_GTPU_TEID_PDU_LAST_S5S8</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>534</id><name>SGW_GTPC_IP_PDU_LAST_S5S8</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>535</id><name>PGW_GTPC_IP_PDU_LAST_S5S8</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>536</id><name>PGW_GTPU_IP_PDU_LAST_S5S8</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>537</id><name>SGW_GTPU_IP_PDU_LAST_S5S8</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

                     <!-- ============================================================    
                                 latency KPIs (EPC + 5GC control records)
                                 IDs : 278 -299, 350-351
                          ============================================================ -->
<element><id>278</id><name>KPI_UPLANE_TOTAL_PACKETS</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>279</id><name>KPI_UPLANE_TOTAL_BYTES</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>280</id><name>KPI_UPLANE_MIN_AVG_BW</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>281</id><name>KPI_UPLANE_MAX_AVG_BW</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>282</id><name>KPI_UPLANE_MIN_UPLINK_LATENCY</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>283</id><name>KPI_UPLANE_MAX_UPLINK_LATENCY</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>284</id><name>KPI_UPLANE_MIN_DOWNLINK_LATENCY</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>285</id><name>KPI_UPLANE_MAX_DOWNLINK_LATENCY</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>286</id><name>CGI_LAC</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>287</id><name>CGI_CI</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>288</id><name>SAI_LAC</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>289</id><name>SAI_SAC</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>290</id><name>RAI_LAC</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>291</id><name>RAI_RAC</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>292</id><name>LAI_LAC</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>293</id><name>ENODEB_MACRO_ENODEB</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>294</id><name>ENODEB_EXT_MACRO_ENODEB</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>295</id><name>INT_CELL_CHANGED</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>296</id><name>LAST_CAUSE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>297</id><name>LAST_CAUSE_MSG_TYPE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>298</id><name>KPI_UPLANE_INT_PKTS_UL</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>299</id><name>KPI_UPLANE_INT_BYTES_UL</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>350</id><name>KPI_UPLANE_INT_PKTS_DL</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>351</id><name>KPI_UPLANE_INT_BYTES_DL</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>355</id><name>PRIO_CAUSE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>356</id><name>DELETE_CAUSE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>544</id><name>FAILURE_CAUSE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>545</id><name>FAILURE_CAUSE_MSG_TYPE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>546</id><name>FAILURE_RESPONSE_TIME</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>357</id><name>KPI_UPLANE_PREV_CALC_TIME</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>

<element><id>358</id><name>KPI_UPLANE_CURR_CALC_TIME</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>

<element><id>359</id><name>KPI_UPLANE_CALC_INT_TIME</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>

                      <!-- ============================================================    
                                 DSCP
                                 IDs : 276-277
                          ============================================================ -->

<element><id>276</id><name>Inner_DSCP</name><dataType>unsigned8</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>277</id><name>Outer_DSCP</name><dataType>unsigned8</dataType><dataSemantics>quantity</dataSemantics></element>

                        <!-- ============================================================    
                                 CONTROL KPIs
                                 IDs : 247-248
                          ============================================================ -->
<element><id>247</id><name>KPI_MAX_CONTROL_LATENCY</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>248</id><name>KPI_MIN_CONTROL_LATENCY</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
                          <!-- ============================================================    
                                 RADIO / LOCATION 
                                 IDs : 249-250
                            ============================================================ --> 
<element><id>352</id><name>TAI_TAC_5GC</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>249</id><name>TAI_TAC</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>250</id><name>ECGI_ECGI</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
                       <!-- ============================================================    
                                 USER SESSION STATS
                                 IDs : 251-252
                       ============================================================ -->
<element><id>251</id><name>TOTAL_USER_SESSIONS_CREATED</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>252</id><name>TOTAL_USER_SESSIONS_TERMINATED</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>

                   <!-- ============================================================
                                                5gc 
                                          IDs: 265 ,268                 
                        ============================================================ -->
<element><id>265</id><name>CELL_CHANGED</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>268</id><name>5G_SA_TYPE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- ============================================================ 
          5gc Sub-Template Fields (Template ID: 311)               
                     IDs: 253-254,262-263
        ============================================================ -->

<element><id>253</id><name>RAN_GTPU_TEID</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>254</id><name>UPF_GTPU_TEID</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>262</id><name>RAN_IP_ADDR</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>263</id><name>UPF_IP_ADDR</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>

  <!-- ============================================================ 
       5GC Bearer SubTemplateList carrier (Template 260, field 520) 
       dataType=subTemplateList tells the collector to decode the   
       variable-length bytes using sub-template 311.               
       ============================================================ -->
  
<element><id>520</id><name>5GC_BEARER_STL</name><dataType>subTemplateList</dataType><dataSemantics>default</dataSemantics></element>

  <!-- ============================================================ 
        5GC Bearer Sub-Template Fields (Template ID: 311)            
        8 fields, one PDU session record per active slot             
       ============================================================ -->
  <element><id>521</id><name>PDU_SESSION_ID</name><dataType>unsigned8</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>522</id><name>RAN_GTPU_TEID_5GC</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>523</id><name>UPF_GTPU_TEID_5GC</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>524</id><name>RAN_IP_ADDR_5GC</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>525</id><name>UPF_IP_ADDR_5GC</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>526</id><name>UE_IPv4_ADDR_5GC</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>527</id><name>UE_IPv6_ADDR_5GC</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>528</id><name>UE_IPv6_Prefix_5GC</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
                     <!-- ============================================================
                                               EPC 
                                          IDs: 266-267
                        ============================================================ -->
<element><id>266</id><name>Session_Created_Time</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>267</id><name>Session_Last_Seen_Time</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>

                     <!-- ============================================================      


                             TELCO subscriber identity fields (Phase 2B)
                             IDs: 34-50
                        ============================================================ -->

<element><id>34</id><name>USER_TYPE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>35</id><name>IMSI</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>36</id><name>MCC</name><dataType>signed16</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>37</id><name>MNC</name><dataType>signed16</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>38</id><name>COUNTRY</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>39</id><name>COUNTRY_CODE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>40</id><name>MOBILE_NETWORK</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>41</id><name>IMEI</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>42</id><name>APN</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>43</id><name>MSISDN</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>44</id><name>ECGI</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>45</id><name>NCELL_ID</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>46</id><name>UE_IPv4_ADDR_USR</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>47</id><name>UE_IPv6_ADDR_USR</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>48</id><name>UE_IPv6_Prefix_USR</name><dataType>signed8</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>49</id><name>RAT_TYPE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>50</id><name>Direction</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
 
                   <!-- ============================================================
                             Correlated RADIUS fields
                             IDs: 51-66

                             These IEs serve two roles:
                               1. Correlated RADIUS fields appended to user session
                                  records (templates 256/257, gated by radius flag).
                               2. RADIUS IPFIX template 263 (ODID 5) — standalone
                                  RADIUS session records exported from lcore_kafka_radius.

                             Template 263 field order (20 fields, all pre-existing IEs):
                               [0]  35  IMSI                   (varlen)
                               [1]  41  IMEI                   (varlen)
                               [2]  43  MSISDN                 (varlen)
                               [3]  42  APN                    (varlen)
                               [4]  51  Virtual_APN            (varlen)
                               [5]  52  User_Name              (varlen)
                               [6]  53  Packet_Code            (varlen)
                               [7]  54  Packet_Identifier      (signed32;  -1 = absent)
                               [8]  55  Packet_Arrival_Time    (unsigned64; nanosecond epoch)
                               [9]  56  PGW_IP                 (varlen)
                               [10] 46  UE_IPv4_ADDR_USR       (varlen) — assigned IPv4
                               [11] 47  UE_IPv6_ADDR_USR       (varlen) — assigned IPv6
                               [12] 59  Assigned_IPv6_prefix   (signed16;  -1 = absent)
                               [13] 60  Auth_Status            (varlen)
                               [14] 61  Accounting_Input_Bytes (signed32;  -1 = absent)
                               [15] 62  Accounting_Output_Bytes(signed32;  -1 = absent)
                               [16] 63  Accounting_Input_Packets(signed32; -1 = absent)
                               [17] 64  Accounting_Output_Packets(signed32;-1 = absent)
                               [18] 65  Session_Time           (signed32;  -1 = absent)
                               [19] 66  Rulebase               (varlen)

                             Firing: one record per Kafka event (request + response),
                             same trigger as the Kafka path.  No new IE IDs required.
                        ============================================================ -->

<element><id>51</id><name>Virtual_APN</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>52</id><name>User_Name</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>53</id><name>Packet_Code</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>54</id><name>Packet_Identifier</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>55</id><name>Packet_Arrival_Time</name><dataType>unsigned64</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>56</id><name>PGW_IP</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>57</id><name>Assigned_IPv4_address</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>58</id><name>Assigned_IPv6_address</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>59</id><name>Assigned_IPv6_prefix</name><dataType>signed16</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>60</id><name>Auth_Status</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<element><id>61</id><name>Accounting_Input_Bytes</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>62</id><name>Accounting_Output_Bytes</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>63</id><name>Accounting_Input_Packets</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>64</id><name>Accounting_Output_Packets</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>65</id><name>Session_Time</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
<element><id>66</id><name>Rulebase</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

 <!-- ============================================================
       DNS fields — flat in base template 256/257 (gated by dns_data flag)
       IDs: 100-108
       ============================================================ -->

  <element><id>100</id><name>DNS_DomainName</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>101</id><name>DNS_QueryType</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>102</id><name>DNS_QueryClassType</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>103</id><name>DNS_RespType</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>104</id><name>DNS_RespClassType</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>105</id><name>DNS_RespCode</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>106</id><name>DNS_IPv4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>107</id><name>DNS_IPv6</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>108</id><name>DNS_Answer_TTL</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- ============================================================
       SSL fields — flat in base template 256/257 (gated by ssl_data flag)
       IDs: 110-144
       ============================================================ -->

  <element><id>110</id><name>SSL_ServerName</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>111</id><name>SSL_ServerVersion</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>112</id><name>SSL_CipherSuite</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>113</id><name>SSL_ClientVersion</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>114</id><name>SSL_ClientSessionId</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>115</id><name>SSL_SerialNumber</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>116</id><name>SSL_ValidityStart</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>117</id><name>SSL_ValidityEnd</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>118</id><name>SSL_Subject_Country</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>119</id><name>SSL_Subject_PostalCode</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>120</id><name>SSL_Subject_State</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>121</id><name>SSL_Subject_Locality</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>122</id><name>SSL_Subject_Street</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>123</id><name>SSL_Subject_Organization</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>124</id><name>SSL_Subject_OrgUnit</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>125</id><name>SSL_Subject_CommonName</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>126</id><name>SSL_ServerSessionId</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>127</id><name>SSL_Compression</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>128</id><name>SSL_SKE_CurveType</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>129</id><name>SSL_SKE_NamedCurve</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>130</id><name>SSL_SKE_PublicKeyLength</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>131</id><name>SSL_SKE_HashAlgorithm</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>132</id><name>SSL_SKE_SignatureAlgorithm</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>133</id><name>SSL_SKE_SignatureKeyLength</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>134</id><name>SSL_CertVersion</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>135</id><name>SSL_Issuer_Country</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>136</id><name>SSL_Issuer_State</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>137</id><name>SSL_Issuer_Locality</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>138</id><name>SSL_Issuer_Organization</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>139</id><name>SSL_Issuer_OrgUnit</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>140</id><name>SSL_Issuer_CommonName</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>141</id><name>SSL_ClientJA3Fingerprint</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>142</id><name>SSL_ServerJA3Fingerprint</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>143</id><name>SSL_ClientJA4Fingerprint</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>144</id><name>SSL_TLS_SignatureScheme</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- ============================================================
       HTTP fields — flat in base template 256/257 (gated by http_data flag)
       IDs: 150-168
       ============================================================ -->

  <element><id>150</id><name>HTTP_URL</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>151</id><name>HTTP_DetectedOS</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>152</id><name>HTTP_Referer</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>153</id><name>HTTP_ClientContentType</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>154</id><name>HTTP_ClientContentLen</name><dataType>unsigned64</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>155</id><name>HTTP_Accept</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>156</id><name>HTTP_Origin</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>157</id><name>HTTP_ClientConnection</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>158</id><name>HTTP_X_Forwarded_For</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>159</id><name>HTTP_X_Session_Type</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>160</id><name>HTTP_X_Stream_Type</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>161</id><name>HTTP_X_Online_Host</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>162</id><name>HTTP_X_Requested_With</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>163</id><name>HTTP_ServerContentType</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>164</id><name>HTTP_ServerContentLen</name><dataType>unsigned64</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>165</id><name>HTTP_ServerContentEnc</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>166</id><name>HTTP_TransferEncoding</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>167</id><name>HTTP_Server</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>168</id><name>HTTP_ServerConnection</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
 
  <!--  ============================================================
        HTTP/2 fields — flat in base template 256/257 (gated by http2_data flag)
        IDs: 170-181
        ============================================================-->
  
  <element><id>170</id><name>HTTP2_Authority</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>171</id><name>HTTP2_Path</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>172</id><name>HTTP2_Method</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>173</id><name>HTTP2_Status</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>174</id><name>HTTP2_UserAgent</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>175</id><name>HTTP2_Referer</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>176</id><name>HTTP2_Host</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>177</id><name>HTTP2_Server</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>178</id><name>HTTP2_XRequestedWith</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>179</id><name>HTTP2_XAndroidPackage</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>180</id><name>HTTP2_XAppKey</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>181</id><name>HTTP2_Location</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!--  ============================================================
        RTP fields — flat in base template 256/257 (gated by rtp_data flag)
        IDs: 190-209
        ============================================================ -->

  <element><id>190</id><name>RTP_SessionId</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>191</id><name>RTP_AvSessionId</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>192</id><name>RTP_SenderId</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>193</id><name>RTP_ReceiverId</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>194</id><name>RTP_EncodingName</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>195</id><name>RTP_MediaType</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>196</id><name>RTP_ClockRate</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>197</id><name>RTP_Channels</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>198</id><name>RTP_Timestamp</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>199</id><name>RTP_PayloadType</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>200</id><name>RTP_PacketInterval</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>201</id><name>RTP_PacketIntervalMeas</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>202</id><name>RTP_PacketsLost</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>203</id><name>RTP_Jitter</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>204</id><name>RTP_JitterMs</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>205</id><name>RTP_Frequency</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>206</id><name>RTP_PacketsOverhead</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>207</id><name>RTP_PacketsOoo</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>208</id><name>RTP_PacketsDuplicate</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>209</id><name>RTP_SeqNo</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>

  <!-- ============================================================
       QUIC fields — flat in base template 256/257 (gated by quic_data flag)
       IDs: 210-238
       ============================================================ -->
  
  <element><id>210</id><name>QUIC_SNI</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>211</id><name>QUIC_UAID</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>212</id><name>QUIC_STK</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>213</id><name>QUIC_CCS</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>214</id><name>QUIC_SCID</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>215</id><name>QUIC_CID</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>216</id><name>QUIC_DCID</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>217</id><name>QUIC_VERSION</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>218</id><name>QUIC_TP_MaxIdleTimeout</name><dataType>unsigned64</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>219</id><name>QUIC_TP_MaxUdpPayloadSize</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>220</id><name>QUIC_TP_InitialMaxData</name><dataType>unsigned64</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>221</id><name>QUIC_TP_InitialMaxStreamDataBidiLocal</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>222</id><name>QUIC_TP_InitialMaxStreamDataBidiRemote</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>223</id><name>QUIC_TP_InitialMaxStreamDataUni</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>224</id><name>QUIC_TP_InitialMaxStreamsBidi</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>225</id><name>QUIC_TP_InitialMaxStreamsUni</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>226</id><name>QUIC_TP_AckDelayExponent</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>227</id><name>QUIC_TP_MaxAckDelay</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>228</id><name>QUIC_TP_ActiveConnectionIdLimit</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>229</id><name>QUIC_TP_InitialSCID</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>230</id><name>QUIC_TP_MaxDatagramFrameSize</name><dataType>unsigned32</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>231</id><name>QUIC_TP_ChosenVersion</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>232</id><name>QUIC_TP_AvailableVersion</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>233</id><name>QUIC_TP_FurtherVersions</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>234</id><name>QUIC_TP_GreaseBit</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>235</id><name>QUIC_TP_DisableActiveMigration</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>236</id><name>QUIC_DetectedOS</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>237</id><name>QUIC_ClientJA3Fingerprint</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>238</id><name>QUIC_ClientJA4Fingerprint</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!--  ============================================================
        DHCP fields — flat in base template 256/257 (gated by dhcp_data flag)
        IDs: 240-242
        ============================================================ -->

  <element><id>240</id><name>DHCP_YourIpAddr</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>241</id><name>DHCP_ClientMacAddr</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>242</id><name>DHCP_LeaseTime</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- ============================================================
       Diameter (Gx) session enterprise IEs — template 261 (IDs 547–599)
       All fields use PEN 58564.  Names mirror Kafka JSON field names.
       String fields are variable-length; numeric fields carry fixed widths.

       Disambiguation prefixes match Kafka JSON section names:
         (none)            — unique leaf name, no ambiguity
         Charging_         — charging_rule_definition.Qos_information block
         Qos_              — interface_Gx.Qos (session-level) block
         Default_Bearer_Qos_ — interface_Gx.Default_Bearer_Qos block
       ============================================================ -->

  <!-- Subscriber identity (SUBSCRIBER_INFO group)
       imsi (35), imei (41), msisdn (43) re-use existing TELCO IEs -->

  <!-- interface_Gx / Gx_general (INTERFACE_INFO group) -->
  <element><id>547</id><name>Origin_Realm</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>548</id><name>Destination_Realm</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>549</id><name>an_gw_ipv6_address</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- 550 reserved (was command_code — removed, not in Kafka export) -->
  <element><id>551</id><name>command_name</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- 552 reserved (was result_code — removed, not in Kafka export) -->
  <!-- 553 reserved (was termination_cause — removed, not in Kafka export) -->
  <element><id>554</id><name>Diameter_interface</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- interface_Gx / user_information / access_nodes (SESSION_INFO group) -->
  <element><id>555</id><name>sgsn_ipv4_address</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>556</id><name>sgsn_ipv6_address</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>557</id><name>ggsn_ipv4_address</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>558</id><name>ggsn_ipv6_address</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>559</id><name>an_gw_ipv4_address</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>560</id><name>access_network_charging_ipv4_address</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>561</id><name>access_network_charging_ipv6_address</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- interface_Gx / Charging_rule_info (CHARGING_INFO group) -->
  <element><id>562</id><name>charging_rule_name</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>563</id><name>rating_group</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <!-- 564 repurposed: was service_identifier (not in Kafka export); now static_rule_name_3 (see charging_rule_names block below) -->
  <element><id>565</id><name>charging_mode</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>566</id><name>flow_rule_ul</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- Charging_rule_definition.Qos_information — prefixed "Charging_" to distinguish from Qos/DB blocks -->
  <element><id>567</id><name>Charging_qci</name><dataType>signed8</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>568</id><name>Charging_max_req_ul_bw</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>569</id><name>Charging_max_req_dl_bw</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>570</id><name>prio_cause</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- interface_Gx / user_information.bearer_usage -->
  <element><id>571</id><name>bearer_usage</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>572</id><name>Charging_apn_agg_ul_bps</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>573</id><name>Charging_apn_agg_dl_bps</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>574</id><name>Charging_priority_level</name><dataType>signed8</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>575</id><name>Charging_pre_emption_capability</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>576</id><name>Charging_pre_emption_vulnerability</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>577</id><name>ip_can_type</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- static rule name slots (up to 3; maps to static_rule_names[0..2])
       578 = static_rule_names[0], 579 = static_rule_names[1]
       564 = static_rule_names[2] (repurposed from removed service_identifier) -->
  <element><id>578</id><name>charging_rule_name_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>579</id><name>charging_rule_name_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>564</id><name>charging_rule_name_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>580</id><name>rule_type</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- charging_rule_definition.bearer_usage — prefixed to avoid clash with user_information.bearer_usage (571) -->
  <element><id>581</id><name>Charging_bearer_usage</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>582</id><name>flow_status</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>583</id><name>flow_rule_dl</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- interface_Gx / Qos (session-level) — prefixed "Qos_" -->
  <element><id>584</id><name>Qos_qci</name><dataType>signed8</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>585</id><name>Qos_max_req_ul_bw</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>586</id><name>Qos_max_req_dl_bw</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>587</id><name>Qos_apn_agg_ul_bps</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>588</id><name>Qos_apn_agg_dl_bps</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>589</id><name>Qos_priority_level</name><dataType>signed8</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>590</id><name>Qos_pre_emption_capability</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>591</id><name>Qos_pre_emption_vulnerability</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- interface_Gx / Default_Bearer_Qos — prefixed "Default_Bearer_Qos_" -->
  <element><id>592</id><name>Default_Bearer_Qos_qci</name><dataType>signed8</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>593</id><name>Default_Bearer_Qos_max_req_ul_bw</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>594</id><name>Default_Bearer_Qos_max_req_dl_bw</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>595</id><name>Default_Bearer_Qos_apn_agg_ul_bps</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>596</id><name>Default_Bearer_Qos_apn_agg_dl_bps</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>597</id><name>Default_Bearer_Qos_priority_level</name><dataType>signed8</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>598</id><name>Default_Bearer_Qos_pre_emption_capability</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>599</id><name>Default_Bearer_Qos_pre_emption_vulnerability</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>600</id><name>charging_rulebasename</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!--  ============================================================
        NetBIOS fields — flat in base template 256/257 (gated by netbios_data flag)
        All 10 fields always present; absent query/answer fields default to "NULL".
        IDs: 76-85
        ============================================================ -->

  <element><id>76</id><name>NetBIOS_QRY_Name</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>77</id><name>NetBIOS_QRY_Type</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>78</id><name>NetBIOS_QRY_Class</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>79</id><name>NetBIOS_ANS_Name</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>80</id><name>NetBIOS_ANS_Type</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>81</id><name>NetBIOS_ANS_Class</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>82</id><name>NetBIOS_ANS_NB_FLAGS</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>83</id><name>NetBIOS_ANS_IP</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>84</id><name>NetBIOS_ANS_TTL</name><dataType>unsigned32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>85</id><name>NetBIOS_ANS_RDataHex</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- ============================================================
       PFCP SxB session fields (Template ID 262, ODID 4)
       PEN 58564 enterprise IEs unless noted as standard.

       Header (always present):
         17  TOPIC_KEY              — IMSI used as partition key
          3  EXP_TYPE               — "NORMAL" or "PRIO"
         std flowStartMilliseconds  — sess_create_time (ms)
         std flowEndMilliseconds    — sess_last_seen_time (ms)
         std observationTimeMs      — published_time (ms)

       Gated sections (each toggled independently via pfcp_sxb_exp_attr):
         subscriber_info  : 35, 43, 608-610
         pfcp_seid_info   : 602-605
         charging_info    : 611-613
         pdr              : slot1=621-629  slot2=680-688  slot3=689-697  slot4=698-706
         far              : slot1=641-646  slot2=707-712  slot3=713-718  slot4=719-724
         qer              : slot1=651-655  slot2=725-729  slot3=730-734  slot4=735-739
         urr              : slot1=656-667  slot2=740-751  slot3=752-763  slot4=764-775
         usage_report     : slot1=668-671  slot2=776-779  slot3=780-783  slot4=784-787
         traffic_endpoint : 46, 47, slot1=672-678  slot2=788-794
         last_cause       : 679
       ============================================================ -->

  <!-- subscriber_info (IDs 608-610; 35 and 43 already defined above) -->
  <element><id>608</id><name>PFCP_CISCO_RAT_TYPE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>609</id><name>PFCP_CISCO_USERNAME</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>610</id><name>PFCP_CISCO_SESS_ID</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- pfcp_seid_info (IDs 602-605) -->
  <element><id>602</id><name>PFCP_CP_FSEID_SEID</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>603</id><name>PFCP_CP_FSEID_IP</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>604</id><name>PFCP_UP_FSEID_SEID</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>605</id><name>PFCP_UP_FSEID_IP</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- charging_info (IDs 611-613) -->
  <element><id>611</id><name>PFCP_CISCO_GTPP_GRP</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>612</id><name>PFCP_CISCO_AAA_GRP</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>613</id><name>PFCP_CISCO_CHRG_GRP</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- pdr — 9 IEs per slot × 4 slots -->
  <!-- slot 1 (IDs 621-629) -->
  <element><id>621</id><name>PFCP_PDR_ID_1</name><dataType>signed16</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>622</id><name>PFCP_PDR_PRECEDENCE_1</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>623</id><name>PFCP_PDR_SRC_INTF_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>624</id><name>PFCP_PDR_TEP_REF_1</name><dataType>signed8</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>625</id><name>PFCP_PDR_OUTER_HDR_RM_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>626</id><name>PFCP_PDR_FAR_REF_1</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>627</id><name>PFCP_PDR_QER_REF_1</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>628</id><name>PFCP_PDR_URR_REFS_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>629</id><name>PFCP_PDR_SDF_FILTER_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- slot 2 (IDs 680-688) -->
  <element><id>680</id><name>PFCP_PDR_ID_2</name><dataType>signed16</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>681</id><name>PFCP_PDR_PRECEDENCE_2</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>682</id><name>PFCP_PDR_SRC_INTF_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>683</id><name>PFCP_PDR_TEP_REF_2</name><dataType>signed8</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>684</id><name>PFCP_PDR_OUTER_HDR_RM_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>685</id><name>PFCP_PDR_FAR_REF_2</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>686</id><name>PFCP_PDR_QER_REF_2</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>687</id><name>PFCP_PDR_URR_REFS_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>688</id><name>PFCP_PDR_SDF_FILTER_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- slot 3 (IDs 689-697) -->
  <element><id>689</id><name>PFCP_PDR_ID_3</name><dataType>signed16</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>690</id><name>PFCP_PDR_PRECEDENCE_3</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>691</id><name>PFCP_PDR_SRC_INTF_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>692</id><name>PFCP_PDR_TEP_REF_3</name><dataType>signed8</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>693</id><name>PFCP_PDR_OUTER_HDR_RM_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>694</id><name>PFCP_PDR_FAR_REF_3</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>695</id><name>PFCP_PDR_QER_REF_3</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>696</id><name>PFCP_PDR_URR_REFS_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>697</id><name>PFCP_PDR_SDF_FILTER_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- slot 4 (IDs 698-706) -->
  <element><id>698</id><name>PFCP_PDR_ID_4</name><dataType>signed16</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>699</id><name>PFCP_PDR_PRECEDENCE_4</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>700</id><name>PFCP_PDR_SRC_INTF_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>701</id><name>PFCP_PDR_TEP_REF_4</name><dataType>signed8</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>702</id><name>PFCP_PDR_OUTER_HDR_RM_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>703</id><name>PFCP_PDR_FAR_REF_4</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>704</id><name>PFCP_PDR_QER_REF_4</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>705</id><name>PFCP_PDR_URR_REFS_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>706</id><name>PFCP_PDR_SDF_FILTER_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- far — 6 IEs per slot × 4 slots -->
  <!-- slot 1 (IDs 641-646) -->
  <element><id>641</id><name>PFCP_FAR_ID_1</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>642</id><name>PFCP_FAR_ACTION_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>643</id><name>PFCP_FAR_DST_INTF_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>644</id><name>PFCP_FAR_OHC_TEID_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>645</id><name>PFCP_FAR_OHC_IP_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>646</id><name>PFCP_FAR_TEP_REF_1</name><dataType>signed8</dataType><dataSemantics>identifier</dataSemantics></element>
  <!-- slot 2 (IDs 707-712) -->
  <element><id>707</id><name>PFCP_FAR_ID_2</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>708</id><name>PFCP_FAR_ACTION_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>709</id><name>PFCP_FAR_DST_INTF_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>710</id><name>PFCP_FAR_OHC_TEID_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>711</id><name>PFCP_FAR_OHC_IP_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>712</id><name>PFCP_FAR_TEP_REF_2</name><dataType>signed8</dataType><dataSemantics>identifier</dataSemantics></element>
  <!-- slot 3 (IDs 713-718) -->
  <element><id>713</id><name>PFCP_FAR_ID_3</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>714</id><name>PFCP_FAR_ACTION_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>715</id><name>PFCP_FAR_DST_INTF_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>716</id><name>PFCP_FAR_OHC_TEID_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>717</id><name>PFCP_FAR_OHC_IP_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>718</id><name>PFCP_FAR_TEP_REF_3</name><dataType>signed8</dataType><dataSemantics>identifier</dataSemantics></element>
  <!-- slot 4 (IDs 719-724) -->
  <element><id>719</id><name>PFCP_FAR_ID_4</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>720</id><name>PFCP_FAR_ACTION_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>721</id><name>PFCP_FAR_DST_INTF_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>722</id><name>PFCP_FAR_OHC_TEID_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>723</id><name>PFCP_FAR_OHC_IP_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>724</id><name>PFCP_FAR_TEP_REF_4</name><dataType>signed8</dataType><dataSemantics>identifier</dataSemantics></element>

  <!-- qer — 5 IEs per slot × 4 slots -->
  <!-- slot 1 (IDs 651-655) -->
  <element><id>651</id><name>PFCP_QER_ID_1</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>652</id><name>PFCP_QER_UL_GATE_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>653</id><name>PFCP_QER_DL_GATE_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>654</id><name>PFCP_QER_UL_MBR_1</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>655</id><name>PFCP_QER_DL_MBR_1</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <!-- slot 2 (IDs 725-729) -->
  <element><id>725</id><name>PFCP_QER_ID_2</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>726</id><name>PFCP_QER_UL_GATE_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>727</id><name>PFCP_QER_DL_GATE_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>728</id><name>PFCP_QER_UL_MBR_2</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>729</id><name>PFCP_QER_DL_MBR_2</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <!-- slot 3 (IDs 730-734) -->
  <element><id>730</id><name>PFCP_QER_ID_3</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>731</id><name>PFCP_QER_UL_GATE_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>732</id><name>PFCP_QER_DL_GATE_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>733</id><name>PFCP_QER_UL_MBR_3</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>734</id><name>PFCP_QER_DL_MBR_3</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <!-- slot 4 (IDs 735-739) -->
  <element><id>735</id><name>PFCP_QER_ID_4</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>736</id><name>PFCP_QER_UL_GATE_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>737</id><name>PFCP_QER_DL_GATE_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>738</id><name>PFCP_QER_UL_MBR_4</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>
  <element><id>739</id><name>PFCP_QER_DL_MBR_4</name><dataType>signed64</dataType><dataSemantics>quantity</dataSemantics></element>

  <!-- urr — 12 IEs per slot × 4 slots -->
  <!-- slot 1 (IDs 656-667) -->
  <element><id>656</id><name>PFCP_URR_ID_1</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>657</id><name>PFCP_URR_MEAS_METHOD_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>658</id><name>PFCP_URR_TRIG_VOL_QUOTA_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>659</id><name>PFCP_URR_TRIG_VOL_THRESH_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>660</id><name>PFCP_URR_TRIG_TIME_THRESH_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>661</id><name>PFCP_URR_VOL_QUOTA_TOTAL_1</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>662</id><name>PFCP_URR_VOL_QUOTA_UL_1</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>663</id><name>PFCP_URR_VOL_QUOTA_DL_1</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>664</id><name>PFCP_URR_VOL_THRESH_TOTAL_1</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>665</id><name>PFCP_URR_VOL_THRESH_UL_1</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>666</id><name>PFCP_URR_VOL_THRESH_DL_1</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>667</id><name>PFCP_URR_TIME_THRESH_1</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <!-- slot 2 (IDs 740-751) -->
  <element><id>740</id><name>PFCP_URR_ID_2</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>741</id><name>PFCP_URR_MEAS_METHOD_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>742</id><name>PFCP_URR_TRIG_VOL_QUOTA_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>743</id><name>PFCP_URR_TRIG_VOL_THRESH_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>744</id><name>PFCP_URR_TRIG_TIME_THRESH_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>745</id><name>PFCP_URR_VOL_QUOTA_TOTAL_2</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>746</id><name>PFCP_URR_VOL_QUOTA_UL_2</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>747</id><name>PFCP_URR_VOL_QUOTA_DL_2</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>748</id><name>PFCP_URR_VOL_THRESH_TOTAL_2</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>749</id><name>PFCP_URR_VOL_THRESH_UL_2</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>750</id><name>PFCP_URR_VOL_THRESH_DL_2</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>751</id><name>PFCP_URR_TIME_THRESH_2</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <!-- slot 3 (IDs 752-763) -->
  <element><id>752</id><name>PFCP_URR_ID_3</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>753</id><name>PFCP_URR_MEAS_METHOD_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>754</id><name>PFCP_URR_TRIG_VOL_QUOTA_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>755</id><name>PFCP_URR_TRIG_VOL_THRESH_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>756</id><name>PFCP_URR_TRIG_TIME_THRESH_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>757</id><name>PFCP_URR_VOL_QUOTA_TOTAL_3</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>758</id><name>PFCP_URR_VOL_QUOTA_UL_3</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>759</id><name>PFCP_URR_VOL_QUOTA_DL_3</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>760</id><name>PFCP_URR_VOL_THRESH_TOTAL_3</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>761</id><name>PFCP_URR_VOL_THRESH_UL_3</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>762</id><name>PFCP_URR_VOL_THRESH_DL_3</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>763</id><name>PFCP_URR_TIME_THRESH_3</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <!-- slot 4 (IDs 764-775) -->
  <element><id>764</id><name>PFCP_URR_ID_4</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>765</id><name>PFCP_URR_MEAS_METHOD_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>766</id><name>PFCP_URR_TRIG_VOL_QUOTA_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>767</id><name>PFCP_URR_TRIG_VOL_THRESH_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>768</id><name>PFCP_URR_TRIG_TIME_THRESH_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>769</id><name>PFCP_URR_VOL_QUOTA_TOTAL_4</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>770</id><name>PFCP_URR_VOL_QUOTA_UL_4</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>771</id><name>PFCP_URR_VOL_QUOTA_DL_4</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>772</id><name>PFCP_URR_VOL_THRESH_TOTAL_4</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>773</id><name>PFCP_URR_VOL_THRESH_UL_4</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>774</id><name>PFCP_URR_VOL_THRESH_DL_4</name><dataType>signed64</dataType><dataSemantics>totalCounter</dataSemantics></element>
  <element><id>775</id><name>PFCP_URR_TIME_THRESH_4</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>

  <!-- usage_report — 4 IEs per slot × 4 slots -->
  <!-- slot 1 (IDs 668-671) -->
  <element><id>668</id><name>PFCP_UR_URR_ID_1</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>669</id><name>PFCP_UR_START_TIME_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>670</id><name>PFCP_UR_END_TIME_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>671</id><name>PFCP_UR_DURATION_1</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <!-- slot 2 (IDs 776-779) -->
  <element><id>776</id><name>PFCP_UR_URR_ID_2</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>777</id><name>PFCP_UR_START_TIME_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>778</id><name>PFCP_UR_END_TIME_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>779</id><name>PFCP_UR_DURATION_2</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <!-- slot 3 (IDs 780-783) -->
  <element><id>780</id><name>PFCP_UR_URR_ID_3</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>781</id><name>PFCP_UR_START_TIME_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>782</id><name>PFCP_UR_END_TIME_3</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>783</id><name>PFCP_UR_DURATION_3</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>
  <!-- slot 4 (IDs 784-787) -->
  <element><id>784</id><name>PFCP_UR_URR_ID_4</name><dataType>signed32</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>785</id><name>PFCP_UR_START_TIME_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>786</id><name>PFCP_UR_END_TIME_4</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>787</id><name>PFCP_UR_DURATION_4</name><dataType>signed32</dataType><dataSemantics>quantity</dataSemantics></element>

  <!-- traffic_endpoint — UE IPs (46, 47 already defined) + 7 IEs × 2 slots -->
  <!-- slot 1 (IDs 672-678) -->
  <element><id>672</id><name>PFCP_TEP_ID_1</name><dataType>signed8</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>673</id><name>PFCP_TEP_NETWORK_INST_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>674</id><name>PFCP_TEP_UE_IPV4_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>675</id><name>PFCP_TEP_UE_IPV6_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>676</id><name>PFCP_TEP_QCI_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>677</id><name>PFCP_TEP_CREATED_TEID_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>678</id><name>PFCP_TEP_CREATED_IP_1</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <!-- slot 2 (IDs 788-794) -->
  <element><id>788</id><name>PFCP_TEP_ID_2</name><dataType>signed8</dataType><dataSemantics>identifier</dataSemantics></element>
  <element><id>789</id><name>PFCP_TEP_NETWORK_INST_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>790</id><name>PFCP_TEP_UE_IPV4_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>791</id><name>PFCP_TEP_UE_IPV6_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>792</id><name>PFCP_TEP_QCI_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>793</id><name>PFCP_TEP_CREATED_TEID_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
  <element><id>794</id><name>PFCP_TEP_CREATED_IP_2</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>

  <!-- last_cause (ID 679) -->
  <element><id>679</id><name>PFCP_LAST_CAUSE</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
<!-- ============================================================

                             GTP-U / inner ip enterprise IEs (Hash feature fix)
                             IDs: 300-301
                        ============================================================ -->

 <element><id>300</id><name>InSrcIp</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
 <element><id>301</id><name>InDstIp</name><dataType>string</dataType><dataSemantics>default</dataSemantics></element>
</ipfix-elements>

Build Docker Image

cd ~/ipfixcol2
docker compose build --no-cache

Verify image:

docker images

Start Collector

docker compose up -d

Verify

docker ps

View logs:

docker logs -f ipfixcol2

Expect

no error

Verify UDP Port

sudo netstat -lunp | grep 4739

Expected

udp 0 0 0.0.0.0:4739
aviz@aviz:~/ipfixcol2$ sudo netstat -lunp | grep 4739
[sudo] password for aviz: 
Sorry, try again.
[sudo] password for aviz: 
udp        0      0 0.0.0.0:4739            0.0.0.0:*                           1633783/docker-prox 
udp6       0      0 :::4739                 :::*                                1633789/docker-prox 
aviz@aviz:~/ipfixcol2$ 

Verify Enterprise XML

Check mount:

docker exec -it ipfixcol2 sh

Inside container:

ls /usr/local/etc/libfds/user/elements

Expected:

kpi_fields.xml

Verify installation:

# find /usr/local/etc/libfds
/usr/local/etc/libfds
/usr/local/etc/libfds/system
/usr/local/etc/libfds/system/elements
/usr/local/etc/libfds/system/elements/netflow.xml
/usr/local/etc/libfds/system/elements/netscaler.xml
/usr/local/etc/libfds/system/elements/cisco.xml
/usr/local/etc/libfds/system/elements/iana.xml
/usr/local/etc/libfds/system/elements/cesnet.xml
/usr/local/etc/libfds/system/elements/flowmon.xml
/usr/local/etc/libfds/system/elements/netflowExtra.xml
/usr/local/etc/libfds/system/elements/vmware.xml
/usr/local/etc/libfds/system/elements/muni.xml
/usr/local/etc/libfds/system/elements/cert.xml
/usr/local/etc/libfds/system/aliases.xml
/usr/local/etc/libfds/system/mappings.xml
/usr/local/etc/libfds/user
/usr/local/etc/libfds/user/elements
/usr/local/etc/libfds/user/elements/kpi_fields.xml
# 

Verify IPFIX Reception

Monitor collector:

docker logs -f ipfixcol2

Verify traffic from ASN

Logs:

# ipfixcol2 -c /etc/ipfixcol2/ipfixcol2.xml
--------------------------------------------------------------------------------
IPFIX Message header:
	Version:      10
	Length:       748
	Export time:  1783799583
	Sequence no.: 620
	ODID:         1
Set Header:
	Set ID: 258 (Data Set)
	Length: 732
--------------------------------------------------------------------------------
IPFIX Message header:
	Version:      10
	Length:       748
	Export time:  1783799613
	Sequence no.: 621
	ODID:         1
Set Header:
	Set ID: 258 (Data Set)
	Length: 732
--------------------------------------------------------------------------------
IPFIX Message header:
	Version:      10
	Length:       3392
	Export time:  1783799642
	Sequence no.: 18996
	ODID:         2
Set Header:
	Set ID: 2 (Template Set)
	Length: 1688
- Template Record (#1)
	Template ID: 256
	Field Count: 219
	EN: 58564    ID: 1      Size: 8      |         Aviz:Seq
	EN: 58564    ID: 16     Size: 4      |         Aviz:HashIdx
	EN: 58564    ID: 17     Size: var.   |         Aviz:TOPIC_KEY
	EN: 58564    ID: 2      Size: var.   |         Aviz:ASN_DEV_ID
	EN: 58564    ID: 3      Size: var.   |         Aviz:EXPORT_TYPE
	EN: 58564    ID: 18     Size: var.   |         Aviz:PayloadType
	EN: 58564    ID: 4      Size: 8      |         Aviz:KPI_INT_AVG_BW
	EN: 0        ID: 2      Size: 8      |         iana:packetDeltaCount
	EN: 0        ID: 1      Size: 8      |         iana:octetDeltaCount
	EN: 58564    ID: 6      Size: 8      |         Aviz:KPI_INT_TIME
	EN: 58564    ID: 19     Size: 8      |         Aviz:KPI_INT_ACTIVE_AVG_BW
	EN: 58564    ID: 360    Size: 8      |         Aviz:KPI_INT_ACTIVE_PKTS
	EN: 58564    ID: 20     Size: 8      |         Aviz:KPI_INT_ACTIVE_BYTES
	EN: 58564    ID: 21     Size: 8      |         Aviz:KPI_INT_ACTIVE_TIME
	EN: 58564    ID: 22     Size: 8      |         Aviz:KPI_INT_ID
	EN: 58564    ID: 74     Size: var.   |         Aviz:CorrStatus
	EN: 0        ID: 60     Size: 1      |         iana:ipVersion
	EN: 58564    ID: 272    Size: var.   |         Aviz:SrcMac
	EN: 58564    ID: 273    Size: var.   |         Aviz:DstMac
	EN: 58564    ID: 274    Size: 2      |         Aviz:VlanId
	EN: 58564    ID: 300    Size: var.   |         Aviz:InSrcIp
	EN: 58564    ID: 301    Size: var.   |         Aviz:InDstIp
	EN: 0        ID: 7      Size: 2      |         iana:sourceTransportPort
	EN: 0        ID: 11     Size: 2      |         iana:destinationTransportPort
	EN: 0        ID: 4      Size: 1      |         iana:protocolIdentifier
	EN: 58564    ID: 271    Size: var.   |         Aviz:IPProto
	EN: 58564    ID: 67     Size: 4      |         Aviz:TEID
	EN: 0        ID: 5      Size: 1      |         iana:ipClassOfService
	EN: 58564    ID: 276    Size: 1      |         Aviz:Inner_DSCP
	EN: 58564    ID: 68     Size: var.   |         Aviz:OutSrcIp
	EN: 58564    ID: 69     Size: var.   |         Aviz:OutDstIp
	EN: 58564    ID: 70     Size: 4      |         Aviz:OutSrcPort
	EN: 58564    ID: 71     Size: 4      |         Aviz:OutDstPort
	EN: 58564    ID: 72     Size: 1      |         Aviz:OutProto
	EN: 58564    ID: 73     Size: 1      |         Aviz:Outer_TOS
	EN: 58564    ID: 277    Size: 1      |         Aviz:Outer_DSCP
	EN: 0        ID: 96     Size: var.   |         iana:applicationName
	EN: 58564    ID: 23     Size: var.   |         Aviz:AppAttribute
	EN: 58564    ID: 24     Size: var.   |         Aviz:AppProtocol
	EN: 58564    ID: 270    Size: var.   |         Aviz:AppGroup
	EN: 58564    ID: 353    Size: 8      |         Aviz:TOTAL_BYTES
	EN: 58564    ID: 354    Size: 8      |         Aviz:TOTAL_PKTS
	EN: 0        ID: 156    Size: 8      |         iana:flowStartNanoseconds
	EN: 0        ID: 157    Size: 8      |         iana:flowEndNanoseconds
	EN: 0        ID: 325    Size: 8      |         iana:observationTimeNanoseconds
	EN: 0        ID: 152    Size: 8      |         iana:flowStartMilliseconds
	EN: 0        ID: 153    Size: 8      |         iana:flowEndMilliseconds
	EN: 0        ID: 323    Size: 8      |         iana:observationTimeMilliseconds
	EN: 58564    ID: 27     Size: 8      |         Aviz:CalStartTime_ns
	EN: 58564    ID: 28     Size: 8      |         Aviz:CalEndTime_ns
	EN: 58564    ID: 7      Size: 4      |         Aviz:KPI_PKT_LOSS
	EN: 58564    ID: 8      Size: 4      |         Aviz:KPI_JITTER
	EN: 58564    ID: 29     Size: 8      |         Aviz:KPI_MIN_AVG_BW
	EN: 58564    ID: 30     Size: 8      |         Aviz:KPI_MAX_AVG_BW
	EN: 58564    ID: 9      Size: 8      |         Aviz:KPI_MIN_UP_LAT
	EN: 58564    ID: 10     Size: 8      |         Aviz:KPI_MAX_UP_LAT
	EN: 58564    ID: 11     Size: 8      |         Aviz:KPI_MIN_DOWN_LAT
	EN: 58564    ID: 12     Size: 8      |         Aviz:KPI_MAX_DOWN_LAT
	EN: 58564    ID: 13     Size: 8      |         Aviz:KPI_INT_AVG_UP_LAT
	EN: 58564    ID: 14     Size: 8      |         Aviz:KPI_INT_AVG_DOWN_LAT
	EN: 58564    ID: 15     Size: 4      |         Aviz:KPI_RETRANSMIT
	EN: 58564    ID: 34     Size: var.   |         Aviz:USER_TYPE
	EN: 58564    ID: 35     Size: var.   |         Aviz:IMSI
	EN: 58564    ID: 36     Size: 2      |         Aviz:MCC
	EN: 58564    ID: 37     Size: 2      |         Aviz:MNC
	EN: 58564    ID: 38     Size: var.   |         Aviz:COUNTRY
	EN: 58564    ID: 39     Size: var.   |         Aviz:COUNTRY_CODE
	EN: 58564    ID: 40     Size: var.   |         Aviz:MOBILE_NETWORK
	EN: 58564    ID: 41     Size: var.   |         Aviz:IMEI
	EN: 58564    ID: 42     Size: var.   |         Aviz:APN
	EN: 58564    ID: 43     Size: var.   |         Aviz:MSISDN
	EN: 58564    ID: 44     Size: var.   |         Aviz:ECGI
	EN: 58564    ID: 45     Size: var.   |         Aviz:NCELL_ID
	EN: 58564    ID: 46     Size: var.   |         Aviz:UE_IPv4_ADDR_USR
	EN: 58564    ID: 47     Size: var.   |         Aviz:UE_IPv6_ADDR_USR
	EN: 58564    ID: 48     Size: 1      |         Aviz:UE_IPv6_Prefix_USR
	EN: 58564    ID: 49     Size: var.   |         Aviz:RAT_TYPE
	EN: 58564    ID: 50     Size: var.   |         Aviz:Direction
	EN: 58564    ID: 100    Size: var.   |         Aviz:DNS_DomainName
	EN: 58564    ID: 101    Size: var.   |         Aviz:DNS_QueryType
	EN: 58564    ID: 102    Size: var.   |         Aviz:DNS_QueryClassType
	EN: 58564    ID: 103    Size: var.   |         Aviz:DNS_RespType
	EN: 58564    ID: 104    Size: var.   |         Aviz:DNS_RespClassType
	EN: 58564    ID: 105    Size: var.   |         Aviz:DNS_RespCode
	EN: 58564    ID: 106    Size: var.   |         Aviz:DNS_IPv4
	EN: 58564    ID: 107    Size: var.   |         Aviz:DNS_IPv6
	EN: 58564    ID: 108    Size: var.   |         Aviz:DNS_Answer_TTL
	EN: 58564    ID: 110    Size: var.   |         Aviz:SSL_ServerName
	EN: 58564    ID: 111    Size: var.   |         Aviz:SSL_ServerVersion
	EN: 58564    ID: 112    Size: var.   |         Aviz:SSL_CipherSuite
	EN: 58564    ID: 113    Size: var.   |         Aviz:SSL_ClientVersion
	EN: 58564    ID: 114    Size: var.   |         Aviz:SSL_ClientSessionId
	EN: 58564    ID: 115    Size: var.   |         Aviz:SSL_SerialNumber
	EN: 58564    ID: 116    Size: var.   |         Aviz:SSL_ValidityStart
	EN: 58564    ID: 117    Size: var.   |         Aviz:SSL_ValidityEnd
	EN: 58564    ID: 118    Size: var.   |         Aviz:SSL_Subject_Country
	EN: 58564    ID: 119    Size: var.   |         Aviz:SSL_Subject_PostalCode
	EN: 58564    ID: 120    Size: var.   |         Aviz:SSL_Subject_State
	EN: 58564    ID: 121    Size: var.   |         Aviz:SSL_Subject_Locality
	EN: 58564    ID: 122    Size: var.   |         Aviz:SSL_Subject_Street
	EN: 58564    ID: 123    Size: var.   |         Aviz:SSL_Subject_Organization
	EN: 58564    ID: 124    Size: var.   |         Aviz:SSL_Subject_OrgUnit
	EN: 58564    ID: 125    Size: var.   |         Aviz:SSL_Subject_CommonName
	EN: 58564    ID: 126    Size: var.   |         Aviz:SSL_ServerSessionId
	EN: 58564    ID: 127    Size: var.   |         Aviz:SSL_Compression
	EN: 58564    ID: 128    Size: var.   |         Aviz:SSL_SKE_CurveType
	EN: 58564    ID: 129    Size: var.   |         Aviz:SSL_SKE_NamedCurve
	EN: 58564    ID: 130    Size: 4      |         Aviz:SSL_SKE_PublicKeyLength
	EN: 58564    ID: 131    Size: var.   |         Aviz:SSL_SKE_HashAlgorithm
	EN: 58564    ID: 132    Size: var.   |         Aviz:SSL_SKE_SignatureAlgorithm
	EN: 58564    ID: 133    Size: 4      |         Aviz:SSL_SKE_SignatureKeyLength
	EN: 58564    ID: 134    Size: var.   |         Aviz:SSL_CertVersion
	EN: 58564    ID: 135    Size: var.   |         Aviz:SSL_Issuer_Country
	EN: 58564    ID: 136    Size: var.   |         Aviz:SSL_Issuer_State
	EN: 58564    ID: 137    Size: var.   |         Aviz:SSL_Issuer_Locality
	EN: 58564    ID: 138    Size: var.   |         Aviz:SSL_Issuer_Organization
	EN: 58564    ID: 139    Size: var.   |         Aviz:SSL_Issuer_OrgUnit
	EN: 58564    ID: 140    Size: var.   |         Aviz:SSL_Issuer_CommonName
	EN: 58564    ID: 141    Size: var.   |         Aviz:SSL_ClientJA3Fingerprint
	EN: 58564    ID: 142    Size: var.   |         Aviz:SSL_ServerJA3Fingerprint
	EN: 58564    ID: 143    Size: var.   |         Aviz:SSL_ClientJA4Fingerprint
	EN: 58564    ID: 144    Size: var.   |         Aviz:SSL_TLS_SignatureScheme
	EN: 0        ID: 460    Size: var.   |         iana:httpRequestHost
	EN: 58564    ID: 150    Size: var.   |         Aviz:HTTP_URL
	EN: 0        ID: 468    Size: var.   |         iana:httpUserAgent
	EN: 58564    ID: 151    Size: var.   |         Aviz:HTTP_DetectedOS
	EN: 0        ID: 459    Size: var.   |         iana:httpRequestMethod
	EN: 58564    ID: 152    Size: var.   |         Aviz:HTTP_Referer
	EN: 58564    ID: 153    Size: var.   |         Aviz:HTTP_ClientContentType
	EN: 58564    ID: 154    Size: 8      |         Aviz:HTTP_ClientContentLen
	EN: 58564    ID: 155    Size: var.   |         Aviz:HTTP_Accept
	EN: 58564    ID: 156    Size: var.   |         Aviz:HTTP_Origin
	EN: 58564    ID: 157    Size: var.   |         Aviz:HTTP_ClientConnection
	EN: 58564    ID: 158    Size: var.   |         Aviz:HTTP_X_Forwarded_For
	EN: 58564    ID: 159    Size: var.   |         Aviz:HTTP_X_Session_Type
	EN: 58564    ID: 160    Size: var.   |         Aviz:HTTP_X_Stream_Type
	EN: 58564    ID: 161    Size: var.   |         Aviz:HTTP_X_Online_Host
	EN: 58564    ID: 162    Size: var.   |         Aviz:HTTP_X_Requested_With
	EN: 58564    ID: 163    Size: var.   |         Aviz:HTTP_ServerContentType
	EN: 58564    ID: 164    Size: 8      |         Aviz:HTTP_ServerContentLen
	EN: 0        ID: 457    Size: 4      |         iana:httpStatusCode
	EN: 58564    ID: 165    Size: var.   |         Aviz:HTTP_ServerContentEnc
	EN: 58564    ID: 166    Size: var.   |         Aviz:HTTP_TransferEncoding
	EN: 58564    ID: 167    Size: var.   |         Aviz:HTTP_Server
	EN: 58564    ID: 168    Size: var.   |         Aviz:HTTP_ServerConnection
	EN: 58564    ID: 170    Size: var.   |         Aviz:HTTP2_Authority
	EN: 58564    ID: 171    Size: var.   |         Aviz:HTTP2_Path
	EN: 58564    ID: 172    Size: var.   |         Aviz:HTTP2_Method
	EN: 58564    ID: 173    Size: 4      |         Aviz:HTTP2_Status
	EN: 58564    ID: 174    Size: var.   |         Aviz:HTTP2_UserAgent
	EN: 58564    ID: 175    Size: var.   |         Aviz:HTTP2_Referer
	EN: 58564    ID: 176    Size: var.   |         Aviz:HTTP2_Host
	EN: 58564    ID: 177    Size: var.   |         Aviz:HTTP2_Server
	EN: 58564    ID: 178    Size: var.   |         Aviz:HTTP2_XRequestedWith
	EN: 58564    ID: 179    Size: var.   |         Aviz:HTTP2_XAndroidPackage
	EN: 58564    ID: 180    Size: var.   |         Aviz:HTTP2_XAppKey
	EN: 58564    ID: 181    Size: var.   |         Aviz:HTTP2_Location
	EN: 58564    ID: 190    Size: var.   |         Aviz:RTP_SessionId
	EN: 58564    ID: 191    Size: var.   |         Aviz:RTP_AvSessionId
	EN: 58564    ID: 192    Size: var.   |         Aviz:RTP_SenderId
	EN: 58564    ID: 193    Size: var.   |         Aviz:RTP_ReceiverId
	EN: 58564    ID: 194    Size: var.   |         Aviz:RTP_EncodingName
	EN: 58564    ID: 195    Size: var.   |         Aviz:RTP_MediaType
	EN: 58564    ID: 196    Size: 4      |         Aviz:RTP_ClockRate
	EN: 58564    ID: 197    Size: 4      |         Aviz:RTP_Channels
	EN: 58564    ID: 209    Size: 4      |         Aviz:RTP_SeqNo
	EN: 58564    ID: 198    Size: 4      |         Aviz:RTP_Timestamp
	EN: 58564    ID: 199    Size: 4      |         Aviz:RTP_PayloadType
	EN: 58564    ID: 200    Size: 4      |         Aviz:RTP_PacketInterval
	EN: 58564    ID: 201    Size: 4      |         Aviz:RTP_PacketIntervalMeas
	EN: 58564    ID: 202    Size: 4      |         Aviz:RTP_PacketsLost
	EN: 58564    ID: 203    Size: 4      |         Aviz:RTP_Jitter
	EN: 58564    ID: 204    Size: 4      |         Aviz:RTP_JitterMs
	EN: 58564    ID: 205    Size: 4      |         Aviz:RTP_Frequency
	EN: 58564    ID: 206    Size: 4      |         Aviz:RTP_PacketsOverhead
	EN: 58564    ID: 207    Size: 4      |         Aviz:RTP_PacketsOoo
	EN: 58564    ID: 208    Size: 4      |         Aviz:RTP_PacketsDuplicate
	EN: 58564    ID: 210    Size: var.   |         Aviz:QUIC_SNI
	EN: 58564    ID: 211    Size: var.   |         Aviz:QUIC_UAID
	EN: 58564    ID: 212    Size: var.   |         Aviz:QUIC_STK
	EN: 58564    ID: 213    Size: var.   |         Aviz:QUIC_CCS
	EN: 58564    ID: 214    Size: var.   |         Aviz:QUIC_SCID
	EN: 58564    ID: 215    Size: var.   |         Aviz:QUIC_CID
	EN: 58564    ID: 216    Size: var.   |         Aviz:QUIC_DCID
	EN: 58564    ID: 217    Size: var.   |         Aviz:QUIC_VERSION
	EN: 58564    ID: 218    Size: 8      |         Aviz:QUIC_TP_MaxIdleTimeout
	EN: 58564    ID: 219    Size: 4      |         Aviz:QUIC_TP_MaxUdpPayloadSize
	EN: 58564    ID: 220    Size: 8      |         Aviz:QUIC_TP_InitialMaxData
	EN: 58564    ID: 221    Size: 4      |         Aviz:QUIC_TP_InitialMaxStreamDataBidiLocal
	EN: 58564    ID: 222    Size: 4      |         Aviz:QUIC_TP_InitialMaxStreamDataBidiRemote
	EN: 58564    ID: 223    Size: 4      |         Aviz:QUIC_TP_InitialMaxStreamDataUni
	EN: 58564    ID: 224    Size: 4      |         Aviz:QUIC_TP_InitialMaxStreamsBidi
	EN: 58564    ID: 225    Size: 4      |         Aviz:QUIC_TP_InitialMaxStreamsUni
	EN: 58564    ID: 226    Size: 4      |         Aviz:QUIC_TP_AckDelayExponent
	EN: 58564    ID: 227    Size: 4      |         Aviz:QUIC_TP_MaxAckDelay
	EN: 58564    ID: 228    Size: 4      |         Aviz:QUIC_TP_ActiveConnectionIdLimit
	EN: 58564    ID: 229    Size: var.   |         Aviz:QUIC_TP_InitialSCID
	EN: 58564    ID: 230    Size: 4      |         Aviz:QUIC_TP_MaxDatagramFrameSize
	EN: 58564    ID: 231    Size: var.   |         Aviz:QUIC_TP_ChosenVersion
	EN: 58564    ID: 232    Size: var.   |         Aviz:QUIC_TP_AvailableVersion
	EN: 58564    ID: 233    Size: var.   |         Aviz:QUIC_TP_FurtherVersions
	EN: 58564    ID: 234    Size: var.   |         Aviz:QUIC_TP_GreaseBit
	EN: 58564    ID: 235    Size: var.   |         Aviz:QUIC_TP_DisableActiveMigration
	EN: 58564    ID: 236    Size: var.   |         Aviz:QUIC_DetectedOS
	EN: 58564    ID: 237    Size: var.   |         Aviz:QUIC_ClientJA3Fingerprint
	EN: 58564    ID: 238    Size: var.   |         Aviz:QUIC_ClientJA4Fingerprint
	EN: 58564    ID: 240    Size: var.   |         Aviz:DHCP_YourIpAddr
	EN: 58564    ID: 241    Size: var.   |         Aviz:DHCP_ClientMacAddr
	EN: 58564    ID: 242    Size: var.   |         Aviz:DHCP_LeaseTime
	EN: 58564    ID: 76     Size: var.   |         Aviz:NetBIOS_QRY_Name
	EN: 58564    ID: 77     Size: var.   |         Aviz:NetBIOS_QRY_Type
	EN: 58564    ID: 78     Size: var.   |         Aviz:NetBIOS_QRY_Class
	EN: 58564    ID: 79     Size: var.   |         Aviz:NetBIOS_ANS_Name
	EN: 58564    ID: 80     Size: var.   |         Aviz:NetBIOS_ANS_Type
	EN: 58564    ID: 81     Size: var.   |         Aviz:NetBIOS_ANS_Class
	EN: 58564    ID: 82     Size: var.   |         Aviz:NetBIOS_ANS_NB_FLAGS
	EN: 58564    ID: 83     Size: var.   |         Aviz:NetBIOS_ANS_IP
	EN: 58564    ID: 84     Size: 4      |         Aviz:NetBIOS_ANS_TTL
	EN: 58564    ID: 85     Size: var.   |         Aviz:NetBIOS_ANS_RDataHex