Seems you have found a bug in suricata!
rule detecting ".." does not fire on ".." in http_uri:
alert http any any -> any any (msg:"ping"; content:"|2e 2e|"; http_uri; sid:100;)
T 192.168.4.6:34160 -> 220.127.116.11:80 [AP] #1735
GET /.. HTTP/1.1..Accept-Encoding: identity..Host: scanme.nmap.org..User-Agent: Python-urllib/3.6..Connec
Your approach to this is...a bit misguided.
You shouldn't need to be crafting packets to replay events from an Apache log. The log is a list of HTTP requests, so use a library that can make proper HTTP requests, like the requests library itself. You don't even have all the information you need to craft these packets anyway-- in the case of POSTs, you don't ...
As a IDS/IPS Suricata is not used for white-listing anything which is allowed but for detecting signatures of known attacks, i.e. black-listing known malicious things. Insofar a rule to match everything and drop would not make any sense since this would essentially drop most of the innocent traffic. The expected behavior is instead to pass everything which ...