 | 1 | initial version |
You have to look at "payload" from a protocol perspective. So for instance an ethernet II frame has a header consisting of 6 bytes of destination mac-address, 6 bytes of source mac-address and 2 bytes of ethertype. Afther the header comes the payload (as seen from the ethernet perspective) and then comes the 4 bytes of FCS.
You can see it as an envelope, the contents of the envelope is the payload. It can be a letter or it can be just another (smaller) envelope.
So in case of a DNS frame, the IP datagram is the payload, seen from the Ethernet layer. It consists of the IP header and the payload from the IP perspective. In this case the payload from the IP perspective consists of the UDP header and the UDP payload. Then the UDP payload consists of the DNS "packet". As the DNS packet does not encapsulate another protocol, you can see this as the final letter inside the UDP envelope inside the IP envelope inside the Ethernet envelope.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
