I disagree. I think a network connection is the very basic concept of a device making a connection. But all of the fields and properties and extensions are really part of the details of a network flow. A network flow is more than the basic 7-tuple net flow stuff. Netflow, SFlow, JFlow are just representations of a subset of a full network flow, basically just the statistical information.
Thanks,
Bret Bret Jordan CISSPDirector of Security Architecture and Standards | Office of the CTO Blue Coat Systems PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
I’m not really a fan of “Network Flow”. Our current Network Connection Object includes extensions such as HTTP and Network Socket that go far beyond simple network flow. When I hear “network flow”, I think of the basic 7-tuple netflow representation, and my concern is that users will think the same when seeing the name of this Object, which is misleading. Regards, Ivan I like that suggestion. Allan I would like to propose that we rename the Network Connection object to Network Flow object. Then if needed, created a specialized Network Connection State object to handle some of the use cases John-Mark was talking about, namely devices that may want to emit events in CybOX when a connection is opened or closed. As it stands right now, the current Network Connection object is really describing a Network Flow. Making this name change might really help remove some of the ambiguity associated with it. Bret Jordan CISSP Director of Security Architecture and Standards | Office of the CTO PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050 "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
|