Originally posted here by don
The only thing that is sent plaintext is the ascii breakout. That is there so we humans can interpret the machine language. That is the only reason. Think tcpdump usage here --->
tcpdump -nXvs 0 ip and host

tcpdump ---> the program of course
n ---> don't resolve to canonical names (keep it in numerica format)
X ---> dump it in ascii format as well
v ---> verbose mode (show ip header info as well)
s ---> snap length (ethernet is default of 1500)
so in other words tcpdump tranlates the hex into text I can use?