My question is if getaddr consists of message header and if it has some payload, possibly an addr_recv and addr_from like version message. Wiki is pretty basic on this spot.
It isnt clear what exactly you're asking, but wiki is pretty clear on the structure of the response to a getaddr message.
The response to receiving this message is to transmit one or more addr messages with one or more peers from a database of known active peers.
So the payload of the response will be a bunch of addrs:
Provide information on known nodes of the network. Non-advertised nodes should be forgotten after typically 3 hours Payload: Field Size Description Data type Comments 1+ count var_int Number of address entries (max: 1000) 30x? addr_list (uint32_t + net_addr) Address of other nodes on the network. version < 209 will only read the first one. The uint32_t is a timestamp (see note below). Note: Starting version 31402, addresses are prefixed with a timestamp. If no timestamp is present, the addresses should not be relayed to other peers, unless it is indeed confirmed they are up.
And it even provides sample data:
Payload: 01 - 1 address in this message Address: E2 15 10 4D - Mon Dec 20 21:50:10 EST 2010 (only when version is >= 31402) 01 00 00 00 00 00 00 00 - 1 (NODE_NETWORK service - see version message) 00 00 00 00 00 00 00 00 00 00 FF FF 0A 00 00 01 - IPv4: 10.0.0.1, IPv6: ::ffff:10.0.0.1 (IPv4-mapped IPv6 address) 20 8D - port 8333