Don't assume TLS records start on packet boundaries