fix cipherSuite0 byte in sniffer, so ECC is recognised correctly.

While trying to get cyassl working in our sniffing setup, some sessions were misidentified as using elliptic curve crypto while they were not. This patch fixes that problem.