From b00dd230c7977f049ee462dffae7701e2df1cd2b Mon Sep 17 00:00:00 2001
From: Laurent Ghigonis <laurent@p1sec.com>
Date: Tue, 11 Dec 2012 21:31:30 +0100
Subject: fix new connections encoding, they should never be responses

---
 gg_sniff/pcap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'gg_sniff/pcap.c')

diff --git a/gg_sniff/pcap.c b/gg_sniff/pcap.c
index 8485eff..e004b99 100644
--- a/gg_sniff/pcap.c
+++ b/gg_sniff/pcap.c
@@ -481,7 +481,7 @@ ip_handle(struct ip *ip, const u_char *pend, u_int wirelen)
 		  pkt.newconn_src = src.s_addr;
 		  pkt.newconn_dst = dst.s_addr;
 		  pkt.newconn_proto = proto;
-		  GG_PKTDATA_SIZE_ENCODE(pkt.newconn_size, ip->ip_len, response);
+		  GG_PKTDATA_SIZE_ENCODE(pkt.newconn_size, ip->ip_len, 0);
       gg_client_send(_cap.ggcli, &pkt);
 		} else {
 			gg_log_warn("user: captured connection close w/o open !");
-- 
cgit v1.2.3-59-g8ed1b