most recent update on this question, with just a couple of data points: http://www.caida.org/research/traffic-analysis/pkt_size_distribution/graphs.... (so, yes the peak has moved up to 1500.) note there are more tiny packets in our recent ipv6 data, but that could just be someone's ping experiment, it's too small a sample (76k pkts) k On Wed, Jul 16, 2008 at 08:24:59AM -0700, fred baker wrote: CAIDA has been doing a lot of that, at least in the past. Last I asked them, which was quite a while back, they said that O(35%) of traffic in their samples was at the path MTU (which included 576 bytes for historical reasons), O(40%) was about the size of a TCP SYN or ACK, for reasons that are apparent if you think about common TCP implementations, and sizes were scattered more or less uniformly in between - last packet in a burst or transaction exchanges. From the numbers that Valdis posted the other day, it sounds like the logic remains about the same but the relevance of "576" has largely gone away. On Jul 16, 2008, at 4:42 AM, Randy Bush wrote:
Our network also shows peaks at the ethernet MTU (our MTU is higher than that) and the DNS packet size.
so who has been tracking packet size distributions for some years and has published or could provide data?
randy