从libnids得到TCP重组的数据，当libnids的状态为NIDS_JUST_EST时，表示TCP建立连接，在此时给TCP流增加一个flow_id用来标识此连接；当libnids的状态为NIDS_DATA时，表示接受数据，当有新的数据到达时，根据flow_id把数据push到相应的流表中，为之后的数据分析做准备。因此，可以在此框架上增加符合http协议的应用解析-Data　TCP libnids restructuring, when libnids status to NIDS_JUST_EST, said the TCP connection is established, at the same time adds a flow_id to TCP flow is used to identify this connection　When libnids status to NIDS_DATA, accepted data, when new data arrives, according to flow_id to push data to the corresponding flow table, prepare the way for after data analysis. Can be increased on this fr a mework, therefore, in accordance with the application of the HTTP protocol parsing