When you're doing a packet capture for the purpose of examining the frame payload, you'll want to extend the snaplen (snapshot length) to 1515. That's long enough to accomodate the 1500 MTU and should give you a pretty good look at what you're after.

For example:

# tcpdump -s1515 -X -ieth0 -w sample.cap

Note: This applies to 'ethereal' and 'wireshark' but their defaults are to capture max(INT) by default.

When capturing packets with ethereal or wireshark using a wireless network interface, you have to disable promiscuous mode in the capture settings; otherwise packet capture will not work.

Due to the checksum offloading logic that's built into most current NICs you'll sometimes get several TCP checksum errors in your Wireshark packet captures. To prevent this, you can go into Edit > Preferences and choose TCP in the left frame. In the right frame, un-check 'Validate the checksum if possible'.