Packet list and raw frame bytes

The other tabs answer specific questions. This one is for the traffic they do not cover: ICMP with something in the echo payload, a UDP protocol nobody has heard of, a malformed frame that broke a parser, or a challenge whose whole point is a field you have to read by hand.

The channels that hide here

• ICMP echo payloads. A ping carries 48 bytes of filler that nothing checks. Replacing it with data is the oldest tunnel there is, and it is invisible to every summary view.
• IP and TCP header fields. The identification field, the TTL, the initial sequence number, the urgent pointer - each carries a few bits nobody looks at, and a challenge can spell a flag out across a thousand packets one byte at a time.
• Padding. An Ethernet frame under 60 bytes is padded, and the padding is whatever was in the buffer. Sometimes that is the previous packet; occasionally it is the point.
• Ports with no dissector. A custom protocol on a high port shows up as raw payload, and raw payload is exactly what the hex view is for.

The right instinct here is the one from File mode: look at the bytes, not at the label above them. A dissector shows you the fields it knows about, and a challenge that hides something has, by definition, put it somewhere the dissector is not looking. The hex view is the ground truth and everything else is an interpretation of it.