From 2b59554245ae9a6c1ba93dd15882361a813d584f Mon Sep 17 00:00:00 2001
From: Jasper Spaans <spaans@fox-it.com>
Date: Tue, 28 May 2013 10:56:13 +0200
Subject: [PATCH] fix cipherSuite0 byte in sniffer, so ECC is recognised
 correctly.

---
 src/sniffer.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/sniffer.c b/src/sniffer.c
index cef4e87e2..e65919b54 100644
--- a/src/sniffer.c
+++ b/src/sniffer.c
@@ -1198,7 +1198,9 @@ static int ProcessServerHello(const byte* input, int* sslBytes,
     *sslBytes -= b;
    
     /* cipher suite */ 
-    (void)*input++;  /* eat first byte, always 0 */
+    b = *input++;  /* first byte, ECC or not */
+    session->sslServer->options.cipherSuite0 = b;
+    session->sslClient->options.cipherSuite0 = b;
     b = *input++;
     session->sslServer->options.cipherSuite = b;
     session->sslClient->options.cipherSuite = b;