diff --git a/scapy/sessions.py b/scapy/sessions.py
index 01e005505e5..a02a7fbf55d 100644
--- a/scapy/sessions.py
+++ b/scapy/sessions.py
@@ -367,11 +367,20 @@ def process(self,
             metadata.clear()
             # Check for padding
             padding = self._strip_padding(packet)
-            if padding:
+            while padding:
                 # There is remaining data for the next payload.
                 full_length = data.content_len - len(padding)
                 metadata["relative_seq"] = relative_seq + full_length
                 data.shiftleft(full_length)
+                # There might be a sub-payload hidden in the padding
+                sub_packet = tcp_reassemble(
+                    bytes(data),
+                    metadata,
+                    tcp_session
+                )
+                if sub_packet:
+                    packet /= sub_packet
+                    padding = self._strip_padding(sub_packet)
             else:
                 # No padding (data) left. Clear
                 data.clear()
@@ -397,10 +406,15 @@ def recv(self, sock: 'SuperSocket') -> Iterator[Packet]:
         """
         pkt = sock.recv(stop_dissection_after=self.stop_dissection_after)
         # Now handle TCP reassembly
-        while pkt is not None:
+        if self.app:
+            while pkt is not None:
+                pkt = self.process(pkt)
+                if pkt:
+                    yield pkt
+                    # keep calling process as there might be more
+                    pkt = b""  # type: ignore
+        else:
             pkt = self.process(pkt)
             if pkt:
                 yield pkt
-                # keep calling process as there might be more
-                pkt = b""  # type: ignore
         return None