Where is the actual content in a TCP segment

The data comes at offset 160 if no option-headers are present, and further down (multiples of 32) if IP option headers are present. The data portion continues to the end of the packet. A packet can be variable size due to differing MTu settings along the path, so the exact number of packets a portion of higher-protocol data gets carved into depends.

The 'datagram' is the size of the IP header + data.

You are incorrect in the maximum data field size being 1500b. That's the size of the entire packet including headers. The data-field size is variable based on header length, as I described above.

The content gets broken up into chunks and put into the "data" portion of the packets. The offsets for that data section were mentioned in another answer.

This is worth a read: http://en.wikipedia.org/wiki/TCP_packet#TCP_segment_structure

TCP/IP is pretty complicated; witness: http://www.tcpipguide.com/free/t_toc.htm

Here's a pretty good representation of the data portion of packets, which I found on http://concept51.co.uk/in_how_networks.html :

Please see RFC 793 (http://www.ietf.org/rfc/rfc793.txt).

The actual "data" (i.e., your document) is contained in the TCP segment (after the TCP header) of the packet. The size of the data in the packet is determined by the TCP Maximum Segment Size (MSS).

I suggest downloading a tool like Wireshark (http://www.wireshark.org) and capturing the network traffic as you send your file. Wireshark will interpret the packets for you (you can even right click on one of the packets which contain data from your file and select 'Follow TCP Stream').

You will also be able to look at each successive packet header which is decoded and explained for you by Wireshark. That should give you a much better idea as to what's happening when you sent data via TCP.

HTHAL