Wireshark · Ethereal-users: Re: [Ethereal-users] Payload Data and TCP Stream Content

[Guy Harris <gharris@xxxxxxxxx>]

Rick Watson wrote:

> Being new to ethereal, I wonder whether the packet
> bytes window pane is displaying only the payload
> contents or the whole packet's (header + payload)
> content?

"Header" is not singular.  It's plural; in an Ethernet packet with 
Ethernet type 0x0800, the Ethernet payload begins with an IP header.

The packet bytes pane displays all the relevant sets, plural, of packet 
data.  If no reassembly is being done, it shows the entire contents of 
the link-layer packet, including the link-layer header and link-layer 
payload - as noted, the link-layer payload includes headers for 
protocols running atop the link-layer.

> Is TCP Stream contents reflect this?

"Reflect" in what sense?  The only data that's part of the TCP stream is 
the part that's "payload" at the TCP layer, so the TCP stream doesn't 
include the TCP header (that's not part of the data stream, it's control 
information for the data stream), the IP header, or headers for any 
lower-level protocols, including the link-layer header.

> And can someone give some good advice or suggestion on
> how can I translate those codes into plain English?

To what codes are you referring?