TCP::collect can specify both the number of bytes to collect, and a number of bytes to skip before collecting
TCP::collect
Collect the specified amount of TCP payload data, after skipping the specified amount. The parameter specifies the minimum number of bytes to collect, and the parameter specifies the number of bytes to skip. The CLIENT_DATA event will be triggered when the data collection is complete, and also when the specified number of bytes have been skipped. In the latter case, there may not be any bytes yet collected ( TCP::payload is empty).
Please note the additional caveats when using skip_bytes. You may be safer using
TCP::collect