I've had strange SSL traffic for a month. But wireshark filter "ssl.heartbeat_message" is empty, so guess it's not heartbleed?