RE: [xml-dev] An efficient, safe, extensible XML data design ...mimickin

["Costello, Roger L." <costello@mitre.org>]

Thanks Tom and Michael.

Ouch! So XML isn't a good fit for everything. Bummer.

This blog [1] explains why XML is not a good fit for representing network flow data:

	XML has limited usefulness for representing network
	flow data. Network flow data has a simple, repetitive, 
	non-hierarchical structure that does not benefit much 
	from XML. An XML representation of flow data would 
	be an essentially flat list of the attributes and their values 
	for each flow record. The XML approach to data encoding 
	is very heavyweight when compared to binary flow encoding. 
	XML's use of start-and end-tags, and plain-text encoding of 
	the actual values, leads to significant inefficiency in encoding 
	size. Typical network flow datasets can contain millions or billions 
	of flows per hour of traffic represented. Any increase in storage 
	size per record can have dramatic impact on flow data storage 
	and transfer sizes. While data compression algorithms can
	partially remove the redundancy introduced by XML encoding, 
	they introduce additional overhead of their own. A further problem 
	is that XML processing tools require a full XML parser... This leads 
	us to propose the IPFIX Message format as the basis for a new 
	flow data file format.

/Roger

[1] http://realworldxml.blogspot.com/2008/01/ipfix-based-file-format.html