I believe you're misinterpreting the numbers. The raw data for those numbers (if they're the same ones I'm thinking of) I doubt it, it's relatively new data. Like last Thursday. ;-) indicate that 9% of the packets had a 512 byte *payload*. I already subtracted off the 40 bytes for the headers. I meant MSS. You're correct, of course, that the percentage of packets at that size does not directly reflect the percentage of hosts with that as an MSS. However, the spikes in the packet percentages are clearly due to hosts using that MSS. You would otherwise expect to see a "smooth" distribution across packet sizes, which is not at ALL what's happening. One of my main findings is that independently-written (i.e., non-BSD-derived) TCP's are much more likely to have serious performance and congestion problems. Wow. Imagine that. ;-) Tony