In the pcap file "2015-10-23-Angler-EK-sends-TeslaCrypt-2.0-traffic.pcap" in web page, packet 505 is a HTTP request whose Referer header almost match the HTTP request in packet 406, but misses a few bytes from the URL as in packet 406. Wonder why. Thanks. asked 30 Oct '15, 08:37 pktUser1001 |