Project

General

Profile

Transport

Added by Gilles Lehmann over 6 years ago

This thread for IDMEF transport discussion.


Replies (5)

RE: Transport - Added by Anonymous over 6 years ago

My feeling is that a transport protocol for alerts has not to be specific. What is really important is the structure of the alerts. A concrete alert (maybe compressed if needed) can then be carried by any general purpose transport protocol that offers classical services: error detection, re-emission if packets get lost, etc.

RE: Transport - Added by Anonymous over 6 years ago

To go further...

As you know, GSON is a Java library that can be used to convert Java Objects into their JSON representation. JSON is a lightweight data-interchange format, an alternative to XML, but smaller, faster and easier to parse.

Some Java JSON-binding library works faster or slower than others, depends on circumstances. Speed is a criterion to choose the most appropriate lib.
I have recently read a study which concluded as following: if you know that you are going to use only a small amount of data in your application and you wish to store or read it to and from JSON format, you should consider using Flexjson or Gson. If you are going to use large amounts of data and wish to store or read it to and from JSON format, you should consider using Jackson or JSON-lib.

RE: Transport - Added by Anonymous over 6 years ago

But I am too ahead!
The first question should be why or why not GSON. Isn't it?

Who can advise another lib?
Maybe YAML?

RE: Transport - Added by Anonymous over 6 years ago

To encourage debate on the issue above, I am now interesting on ProtoBuf (protocol buffer).

As for you, what are the pros and cons of ProtoBuf over GSON?
Both JSON (via GSON library) and ProtoBuf are portable between platorms. Nevertheless several elements are different:
  • ProtoBuf is smaller (bandwidth) and cheaper (CPU) to read/write;
  • JSON is human readable / editable while ProtoBuf is binary and hard to parse without library support;
  • ProtoBuf is trivial to merge fragments (just concatenate).

Those who are looking for performance would choose ProtoBuf.

RE: Transport - Added by Guillaume Hiet over 6 years ago

I totally agree with Ludovic : we should focus on the schema and the semantic part (dictionaries, enumerations, etc.) of the standard. IDMEF should be compatible with any decent transport protocol.

Concerning the transport, we should make a distinction between the transport protocol by itself (HTTP, XMPP, syslog, AMQP, etc.) and the encoding format (XML, JSON, ASN1, etc.). For example, HTTP can be used to exchange both XML and JSON data.

    (1-5/5)