Our study presents a bootstrap-based framework for evaluating the clustering suitability of TCP payload-derived datasets constructed under different configurations. Specifically, we investigate whet- her combining the first payload with packet header information offers a more effective proxy for client behavior than header-centric or all-payload-centric approaches. Utilizing the UNSW-NB15 dataset, we extract payload features using BIGBIRD and apply UMAP for dimensionality reduction. Using these features, we construct three types of datasets: HeaderOnly (HO), HeaderWithFirstPayload (HFP) and HeaderWithAllPayload (HAP). Clustering is performed using HDBSCAN and clustering suitability is evaluated by observing the stability of clustering results across bootstrap replicas using the Adjusted Rand Index. Our results show that HFP consistently achieves the highest clustering stability across a broad range of configurations. Interestingly, while HAP contains more information, it performs worse than HFP due to noise and overly complex features. HO, though lightweight, lacks representational capacity unless paired with specialized analysis techniques. These findings suggest that first-payload features strike the balance between information richness and resource friendliness. In addition, our work emphasizes the value of bootstrap-based approach in statistical analysis under scarce-data operating conditions. Future work will investigate the generalizability of our pipeline to real-world traffic and explore its use in designing lightweight intrusion detection systems.