# HTTP protocol error field parsing

**URL:** <https://forum.suricata.io/t/http-protocol-error-field-parsing/4150>\
**Category:** Help\
**Tags:** suricata\
**Created:** [November 7, 2023, 2:47am UTC](https://forum.suricata.io/t/http-protocol-error-field-parsing/4150 "2023-11-07T02:47:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![710425820](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/710425820/32/2929_2.png) [@710425820](https://forum.suricata.io/u/710425820)\
**Post date:** [November 7, 2023, 2:47am UTC](https://forum.suricata.io/t/http-protocol-error-field-parsing/4150/1 "2023-11-07T02:47:43Z")

</div>

The suricata command code is as follows:

 ![suricata命令执行](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/2/2bfeb26b407c47daa33de17a9a0a2c285be4fe9b.png)

http pcap package details：

 ![pcap包详情](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/1/1b1153a324d95e622fea34229cc19d1fbf3cbee3.png)

eve log output: **（An error occurred in the http protocol field）**

 ![eve日志输出](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/e/e904cc675f92db13ee4c0eed28b06188d3d804e5.png)

Eve-log related configuration is as follows（Only alert configuration）:

 ![eve日志配置](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/6/66aa4a19826589dced0b59fcce5e333f4e7312a9.png)

pcap file:  
[echo可疑命令执行#19.pcap](https://forum.suricata.io/uploads/short-url/hIWZYKlMKwDQDVyXp5aUWMc122w.pcap) (1.5 KB)

---

<div class="post-metadata">

**Author:** ![bmurphy](https://avatars.discourse-cdn.com/v4/letter/b/f19dbf/32.png) [@bmurphy](https://forum.suricata.io/u/bmurphy)\
**Post date:** [November 7, 2023, 1:56pm UTC](https://forum.suricata.io/t/http-protocol-error-field-parsing/4150/2 "2023-11-07T13:56:29Z")

</div>

I think this issue is related

> **[Bug #2881: http.protocol parsing inaccuracy : accept spaces in URI - Suricata...](https://redmine.openinfosecfoundation.org/issues/2881)**
>
> Redmine

---

<div class="post-metadata">

**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\
**Post date:** [November 7, 2023, 2:43pm UTC](https://forum.suricata.io/t/http-protocol-error-field-parsing/4150/3 "2023-11-07T14:43:30Z")

</div>

This is indeed a known problem already tracked in the mentioned issue