CLIENT_ACCEPTED, SERVER_ACCEPTED and TCP::collect

Firstly, your initial assumptions are correct. In the client-side context (either in CLIENT_ACCEPTED or inside the

clientside

command above) a call to

TCP::collect

triggers collection of segments on the client-side of the connection, firing CLIENT_DATA when some amount of data are collected (although it may fall on segment boundaries, there is no guarantee of that). Similarly, in the server-side context (in SERVER_CONNECTED above), a call to

TCP::collect

triggers collection of segments on the server-side of the connection, firing SERVER_DATA when some amount of data are collected.

The rule above appears to be for SMTPS. Note that the first message in SMTP is sent from server to client, not the other way around. That's probably why

TCP::collect

for the clientside is not invoked until after the first message is received on the serverside. One doesn't expect a clientside message until after the first serverside message is delivered to the client.