Which protocol is expected to have a user agent, host, and referrer header in a packet capture?