What is a good indicator of a request sent over a socket?

I am writing some codeql for web servers like apache and nginx. I have done some research and found that a good indicator of a request is ntohs or ntohl because the the data that is sent over a socket needs to be converted from network byte order to host byte order. Are there any other indicators which I should use for web servers?