suricata7.0.5
alert http any any -> [192.168.1.27,1.192.137.27] 80 (msg:“HTTP Request Example”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“query.php”; bsize:>9; http.protocol; content:“HTTP/1.1”; bsize:8; http.host; content:“360”; bsize:>3; classtype:bad-unknown; sid:25; rev:1;)
一、加载header
1.1 解析protocol
根据名称，转换为对应的枚举类型值
s->alproto = AppLayerGetProtoByName((char *)protostr);
1.2 解析Address
-
source
any将转换为0.0.0.0/0和::/0
-
destination
1.3 解析Ports
-
source port
any将转换为0:65535
-
dest port
