sniffing – What data can be sniffed in a LoRaWAN network at various points?

What data or metadata can be sniffed in a LoRaWAN network at various points like the end-device (node), the gateway, the network server and the application server? Is there exists a standardized data format for transmitting the messages since I need to sniff the data for any anomalous activity on every point on the network?

I referred this this article, however it doesn’t clearly specify the points from where the data has been collected. It may be possible that some data has been scrapped at gateway or the network server.