ssl continuation data?

Frames are marked as "Continuation Data" when the contents are not fully understood. It happens when TLS records are split over multiple TCP segments and one of these cases happen:

• Capture begins in the middle of an existing SSL/TLS connection, not capturing the begin of a record.
• Out-of-order packets where the begin and end of a record are swapped (Bug 9461).
• TCP reassembly is disabled (so while the begin of a record is partially dissected, the second half will not be recognized).

Finally, it could be truly the case that the protocol under analysis is not really TLS. For example, some users could try to bypass firewalls by running their VPN software over port 443 which is registered for HTTPS.