clarification of layer to which bytes refer in source / destination / client / server / network

Folks,

in these packages (source, destination, client, server, network) I find the `bytes` value which is obviously useful to quantify amount of traffic relating to the respective entity.

What I'm unsure about is to which networking layer it is supposed to refer to and if the `bytes` count includes sub-IP, IP, and/or transport-layer headers. I suspect that implementors may have different views resulting in a mismatch.

It would be useful to be explicit on this in the documentation.

(note it may have more implications to implementors than just choosing a number. For example in presence of IP fragmentation and attempt to report bytes above the IP-layer, one would have to make sure the reporting source runs de-fragmentation -- I suspect that's not the case with packetbeat.)