anchor.diff:  
   At the high level, the protocols plugins receive raw packet data via the
   `Parse()` or `ParseUdp()` methods and produce objects that will be indexed into
  -Elasticsearch via the `results` channel.
  +Elasticsearch.
   
   The `Parse()` and `ParseUdp()` methods are called for every packet that is
   sniffed and is using one of the ports of the protocol as defined by the
  
positive.code: <3> The application layer payload (that is, without the IP and TCP/UDP headers) as a
  byte slice.
  
  The objects sent through the `results` channel have the type `common.MapStr`,
  which is essentially a `map[string]interface{}` with a few more convenience
  https://github.com/elastic/libbeat/blob/fae9cf861b58f09cf578245e45415899f4151d32/common/mapstr.go[methods]
  added.
  
  Besides the `Parse()` function, the TCP layer also calls the `ReceivedFin()` function
  when a TCP stream is closed, and it calls the `GapInStream()` function when packet
  
negative.code: 		"\r\n" +
  		"xxxxxxxxxxxxxxxxxxxx")
  
  	tcptuple := testCreateTCPTuple()
  	req := protos.Packet{Payload: data1}
  	resp := protos.Packet{Payload: data2}
  
  	private := protos.ProtocolData(new(httpConnectionData))
  
  	private = http.Parse(&req, tcptuple, 0, private) <3>
  	private = http.ReceivedFin(tcptuple, 0, private)
  