Why doesn Ethereal show Yahoo Messenger packets in captures that contain Yahoo Messenger traffic?
Ethereal only recognizes as Yahoo Messenger traffic packets to or from TCP port 3050 that begin with “YPNS”, “YHOO”, or “YMSG”. TCP segments that start with the middle of a Yahoo Messenger packet that takes more than one TCP segment will not be recognized as Yahoo Messenger packets (even if the TCP segment also contains the beginning of another Yahoo Messenger packet).