doiexist- In order to "decode" the contents of a packet you have to know what type of data you are looking at. For instance, if you are looking at a DNS packet, you can read the RFCs around how a DNS client communicates with a DNS server to determine exactly what the transaction is doing. If you are looking at HTTP traffic, the same thing applies. Ethereal does this for you in that filters and rules have already been written to decode the raw data for you.

In order to understand the data in the network capture you have to have knowledge of the protocol/application you are trying to look at. Different applications use different codes to mean different things when communicating between nodes. So there is no way to always "know" what something is doing.

If the network data you are looking at is the transactions between a piece of proprietary code that is not out in the public you may have to spend quit a bit of time determining what all of that hex code means.