Tony, Thanks for posting some useful raw data. A clarification -- in some messages, you say you've stripped headers, but is unclear if you did so in your top 10 table. If so, 41 sounds reasonable for noncompressed-header Telnet, with the 44, 52, 48, 56, etc., sizes, as a guess, to a rounded-up transmission buffer. 44 in implementation where memory is allocated/managed in 4 byte quanta, 52 in 8 byte quanta, etc. Silly question, at 5AM...MSS is one of those acronyms I use for its own convenience and beauty, without really stopping to think what it stands for...Mean Segment Size?
Unanswered questions for further research: 1) What in hell is sending so many 40 byte packets? Are we really seeing productive ACKs? Or is it just HTTP bogosity? This really sucks. 2) What OS is using a 512 MSS? 256? 3) What are the minimal revs of various BSD flavors to exceed the 576 MTU by default? 4) 41 bytes is pretty obviously interactive traffic. Is the intuition correct? What's so special about 44, 52, 48 and 56? What do people do with 4, 8, 12 and 16 bytes of data? And why not any of the odd values?
Tony
Tony's Top 10 Packet Size Percentage 40 44.838 "ACKs, SYNs, FINs, RSTs " 552 9.19 512 MSS 1500 6.839 Happy boxes 576 5.779 BSD bogosity 44 4.719 ?? 52 1.175 ?? 48 0.884 ?? 41 0.776 ?? 56 0.73 ?? 296 0.717 256 MSS