dave plonka has done some outstanding analysis (as rigorous as you can get under the circumstances) on the effect of mp3 files (napster in particular) on the size of Internet flows, for traffic in/out of his university campus (which is a great snapshot to use) http://net.doit.wisc.edu/data/flow/size/ note heavy-tail phenomenon, similar to packet size distributions (where most packets are small but most traffic (bytes) is in huge packets), most flows are still small but most traffic (bytes) are in huge flows more so this year than last year (ymp3k effect) he plots both in terms of units of flows as well as payload, w and w/o napster, this year and last. and yes, he's doing it all using netflow! whee. :) (and publically available cflowd, flowscan, gnuplot, rrdtool, all detailed on the web page) very nice stuff k