Анализ мелких пакетов через suricata

function init (args)
    local needs = {}
    needs["payload"] = tostring(true)
    return needs
end

function match(args)
    	for k,v in pairs(args) do
		if tostring(k) == "payload" then
			a = tostring(v)
			if  a:find("GET") and a:find("Host: ")  then
                            return 0
			end
                        if a:find("POST") and a:find("Host: ")  then
                            return 0
                        end
                        if a:find("HEAD") and  a:find("Host: ")  then
                            return 0
                        end
                        if a:find("PUT") and  a:find("Host: ")  then
                            return 0
                        end
                        if a:find("PATCH") and  a:find("Host: ")  then
                            return 0
                        end
                        if a:find("CONNECT") and  a:find("Host: ")  then
                            return 0
                        end
                        if a:find("TRACE") and  a:find("Host: ")  then
                            return 0
                        end
					print("Find mil HTTP packet\n")
		end		
	end
end 
 
return 0
--eof

function init (args)
    local needs = {}
    needs["http.request_headers"] = tostring(true)
    math.randomseed(os.time())
    return needs
end


function match(args)
    a = tostring(args["http.request_headers"])
    o = args["offset"]
 
    s = a:sub(o)
    d = string.match(s, 'Host: spys.ru')
    print(s)

	if d then
		print("test")
		return 1
	end
 
    return 0
end