I have done a very rough sampling of traffic on the backbone IP traffic this morning (9:30 am Fri 2 Aug 1996) using our sniffer. Here are the results based on 9036 ethernet frames: Protocol # of frames Percent tcp 6432 71 dns (udp) 2025 22 telnet 813 9 dns (tcp) 431 5 snmp 372 4 smtp 180 2 ftp 21 ospf 31 nfs 6 The DNS zone transfers are performed using tcp. Most other queries are udp. (Please note that I assumed that all of the udp traffic was dns based. This seemed to be a reasonable assumption based on the frames that I looked at.) Doug Carson from network operations has the tools (RMON probes) to do a much better job than this. He has indicated that he can do something with regard to IP protocol analysis by the end of next week.