It isnt clear what exactly you're asking, but wiki is pretty clear on the structure of the response to a getaddr message.

https://en.bitcoin.it/wiki/Protocol_specification#getaddr

The response to receiving this message is to transmit one or more addr messages with one
or more peers from a database of known active peers.

So the payload of the response will be a bunch of addrs:

https://en.bitcoin.it/wiki/Protocol_specification#addr

Provide information on known nodes of the network. Non-advertised nodes should be forgotten
after typically 3 hours

Payload:
Field Size  Description     Data type               Comments
1+          count           var_int                 Number of address entries (max: 1000)
30x?        addr_list       (uint32_t + net_addr)[] Address of other nodes on the network.
                                                    version < 209 will only read the first
                                                    one. The uint32_t is a timestamp (see
                                                    note below).
Note: Starting version 31402, addresses are prefixed with a timestamp. If no timestamp is
present, the addresses should not be relayed to other peers, unless it is indeed confirmed
they are up. 

And it even provides sample data:

Payload:
01                                              - 1 address in this message
Address:
E2 15 10 4D                                     - Mon Dec 20 21:50:10 EST 2010 (only when version is >= 31402)
01 00 00 00 00 00 00 00                         - 1 (NODE_NETWORK service - see version message)
00 00 00 00 00 00 00 00 00 00 FF FF 0A 00 00 01 - IPv4: 10.0.0.1, IPv6: ::ffff:10.0.0.1 (IPv4-mapped IPv6 address)
20 8D                                           - port 8333