Suricata

Would you have an example rule where you would want such a warning ?

Victor Julien wrote in #note-1:
Wonder if it is more something for engine analysis.

I think that's a great idea.

Philippe Antoine wrote in #note-2:
Would you have an example rule where you would want such a warning ?

sure! these two come to mind quickly.

alert http any any -> any any (msg:"http.start only supports HTTP/1"; flow:established,to_server; http.start; content:"GET /foo"; startswith; content:"|0d 0a|Host|3a 20|"; within:15; sid:1;)
alert http any any -> any any (msg:"http.msg only populated with content on HTTP/1"; flow:established,to_server; http.msg; content:"Found"; sid:2;)

There might be others, but i'm not 100% sure they'd be good for the engine. I suppose as engine-analysis they would be ok.

Things like the use of pseudo headers on contents, which would indicate the rule would only work with HTTP/2. In that example, the RFC's defined list of :pseudo headers (https://www.rfc-editor.org/rfc/rfc9113.html#section-8.3.1) would be used to identify the usage.

capital letters in contents when to_lowercase transformation is applied to a buffer
capital letters in contents of http.header_names (would indicate it might be HTTP/1 only)

when header_lowercase is applied to a buffer, and content matches contain something that matches the same logic as header_lowercase [^\x3a]+\x3a[^\r\n]+[\r\n]+ bring that content to the rule writers attention.

Idk, I'm just brainstorming here, some if these we can probably do within ET's own rule analysis.