I have a three-way TCP handshake, followed by two FIX logons. (FIX is a protocol used in trading.) The first FIX logon (frame 4) is interpreted and parsed just fine by WireShark, but the second logon (frame 6) is interpreted as a TCP segment of a reassembled PDU.

However frame 6 is not a TCP segment of a reassembled PDU. It contains a full TCP PDU that should be interpreted and parsed as a FIX logon. I have checked that the sequence numbers, ACK numbers, IP total lengths, etc. are all good.

Why is frame 6 interpreted as a TCP segment of a reassembled PDU?

This is a Serverfault thread on this topic.