There are differences in how the server hello message and subsequent messages up to server hello done are sent by the TLS server that the the connection is being set up. Netscape Enterprise servers encapsulate all the messages that it is sending into one large packet with a single TLS record header. This is contrasted to Apache Stronghold, which sends each individual packet in its own TLS record header. I was caught unaware because I was testing my code on an Apache server and was surprised that the sniffer was missing messages when I ran it on other Netscape servers. There is nothing in the specification that requires either format, but I had to perform several hacks because I had initially set it up nicely to handle only the Stronghold format.
Larger messages tend to get fragmented and the socket layer handed it to the sniffer fragmented.
Hence, sniffer had to be able to reassemble them. In particular, this only happens with the application data packets and the certificate packets because the other packets are rather small. Each certificate in the certificate message is roughly about 640 bytes and anything more than 2 certificates would fragment the message. I did not realise that this would occur because I assumed that TCP would handle the fragmentation, but this was a bad assumption, and I had to introduce more ugly code to keep track of the state so that these cases would be handled properly. I am not particularly pleased with the way I handled the certificate message because I assumed that the sniffer would never get a chain of more than about 50 certificates, which is probably a reasonable assumption, but is not a perfect solution.