payload clarification

["Hudak, Tyler" <Tyler.Hudak () roadway com>]

What does Snort consider the payload when its looking at packets?  Its
pretty easy to determine that with TCP, UDP or ICMP rules the payload is
everything after the TCP, UDP or ICMP headers.  

However, in an IP rules, is the encapsulated protocol's headers (TCP, UDP,
ICMP, etc) considered part of the payload?

Tyler