https://docs.zeek.org/en/master/search.html?q=icmp&check_keywords=yes&area=default
https://docs.zeek.org/en/master/script-reference/packages.html#script-packages
https://docs.zeek.org/en/master/scripts/base/frameworks/analyzer/main.zeek.html
https://docs.zeek.org/en/master/script-reference/proto-analyzers.html#enum-Analyzer::ANALYZER_ICMP
1、代码 c$http$status_code 通过conn来获取http的相关信息,参考:
https://docs.zeek.org/en/master/examples/httpmonitor/index.html