Isn't it unsurpsrising that >40% of packets are small? ACKs?

If one made the gross oversimplifying approximation that everything is unidirectional TCP traffic, then you'd expect to see one ACK per two data packets.

This is actually not at all a gross oversimplying approximation. Much TCP traffic unidirectional or request/response. The latter looks a whole lot like two back-to-back unidirectional connections, with only one chance to piggyback acks at the switchover.

Thus, we'd expect to see 33% at 40 bytes. It is the additional 7+% that's surprising.

Throw in frequent SYN/FIN/RST's because of small Web connections, SYN retransmissions because busy Web servers have full listen queues (or are being SYN-flooded :-), TCP's that ack every packet (Linux 1.0, I believe, and maybe later ones), TCP's that wind up acking every packet because their delay timer is less than an MSS prop time across a slow link (Solaris, for links < 10KB/sec), and dup acks due to sequence holes, and you might handwave the 7%. Vern