Define the semantics of RX and TX for NETWORK vantage point

[rmarx]

For CLIENT and SERVER, the difference between RECEIVE (RX) and TRANSMIT (TX) is obvious. Not so for an in-network observer (or, e.g., a proxy server), where these terms make less sense...

Some options:

• Type is NETWORK_CLIENT and NETWORK_SERVER (instead of NETWORK)
• add separate "flow" field indicating if we use CLIENT or SERVER semantics (currently in the draft)
• add separate metadata field indicating which 5-tuple is the conceptual "client" and which is the "server" and use RX/TX based on that
• Don't fix this and let the tooling layer figure it out (if packet nr 6 is a client TX and a RX in the NETWORK trace, the network is from the viewpoint of the SERVER)

Broader discussion: does it make sense to log packets as PACKET_TX and _RX here? how about instead a PACKET event (similar to how wireshark does it). However: this doesn't make sense for (stateful) proxies that do act as both client+server when ~transforming the traffic (e.g., Facebook's load balancer).

[rmarx]

Solved in draft-01 by using separate _sent and _received (or equivalent) events for clarity + using vantage_point and their "flow" field.