CAIDA has been doing a lot of that, at least in the past. Last I asked them, which was quite a while back, they said that O(35%) of traffic in their samples was at the path MTU (which included 576 bytes for historical reasons), O(40%) was about the size of a TCP SYN or ACK, for reasons that are apparent if you think about common TCP implementations, and sizes were scattered more or less uniformly in between - last packet in a burst or transaction exchanges. From the numbers that Valdis posted the other day, it sounds like the logic remains about the same but the relevance of "576" has largely gone away. On Jul 16, 2008, at 4:42 AM, Randy Bush wrote:
Our network also shows peaks at the ethernet MTU (our MTU is higher than that) and the DNS packet size.
so who has been tracking packet size distributions for some years and has published or could provide data?
randy