COB encoded packets are off by one byte.

[abdebouhal]

Here is the last five byte of a large ReadRange response:
0x50, 0xee, 0xe3, 0xbf, 0xe4
( 0xee, 0xe3, 0xbf, 0xe4 is the COB encoded -32K CRC)

Here is what the mstpcap sends to Wireshark:

( 0xee, 0xe3, 0x00, 0xbf, 0xe4 }

mstpcap appends an "artificial" zero thinking it is the end of the packet (length is length -2 for cob encoded frame)
and then appends the last two bytes for data CRC (it treat the packet as non cob packet)