Suricata

Suricata's HTTP.log file logs wrongly most of the time /90%/
the ip:port -> ip:port connections as being one way
i.e InternalIP:80 -> ExternalIP:port - as if the system that Suricata is installed on is a webserver and gets all requests on its port http port 80.

Use the following command on any http.log to confirm the issue:

egrep -n ':digit:{1,3}\.:digit:{1,3}\.:digit:{1,3}\.:digit:{1,3}\::digit:{1,5}' http.log | awk '{ print $1$18$19$20$21" " }'