In high-concurrency scanning scenarios, some TCP streams generated by scanners are half-open or otherwise incomplete, such as non-contiguous sequence numbers, incomplete handshakes, or an immediate RST after sending the request.
Zeek can still identify these flows as HTTP and record information such as the URI, while Suricata may fail during TCP stream reassembly and therefore cannot pass the data to libhtp for HTTP parsing. As a result, rules using HTTP buffers such as http.uri and http.request_body cannot match, leading to cases where Zeek records the HTTP traffic but Suricata generates no alert.
I would like to know whether Suricata has, or could provide, a more tolerant HTTP/L7 inspection mechanism for such abnormal or incomplete TCP streams in passive IDS mode.
高速并发扫描场景下，扫描器发出的部分 TCP 流存在半开、Sequence Number 不连续、握手不完整或发送请求后立即 RST 等情况。
这类流量在 Zeek 中仍然可以被识别为 HTTP 并记录 URI 等信息，但 Suricata 由于 TCP Stream Reassembly 失败，无法进一步交给 libhtp 进行 HTTP 解析，导致 http.uri、http.request_body 等 HTTP 规则无法匹配，因此出现 Zeek 能记录、Suricata 无告警的情况。
希望确认 Suricata 是否有办法在被动 IDS 场景下，对这类异常/不完整 TCP 流进行更宽容的 HTTP/L7 检测。