[bhiggins]

yup. another handy tool is ngrep: http://ngrep.sourceforge.net/

for app-level protocol stats and/or high-end situations i'd attach an extrahop product: http://www.extrahop.com/products/