indicate that 9% of the packets had a 512 byte *payload*.
I already subtracted off the 40 bytes for the headers. I meant MSS.
(By payload, I meant data, i.e., not including headers, same as you ...)
However, the spikes in the packet percentages are clearly due to hosts using that MSS. You would otherwise expect to see a "smooth" distribution across packet sizes, which is not at ALL what's happening.
Right, spikes correspond to MSS's (and other effects like acks & SYN/FIN's). Are you saying the data shows significant spikes at other, non-standard MSS values? If it does, then (modulo some thinking about the particular numbers) I agree that they're likely MSS candidates and support the notion that weird MSS's are being used. But if the data has a few spikes at things like 512 but no strong spikes at non-standard values, then that doesn't help distinguish between (1) lots of weird TCP's using weird MSS's, vs (2) lots of packets that are less than full-size because the mainstream TCP didn't have enough bytes to fill them. If your data is available, I'd love to take a gander at it. Vern