Two Good Resources

Two good networking resources I've been meaning to point to, both from Robert Graham:

FAQ: Firewall Forensics

Sniffing FAQ

Both are good, detailed explanations about all kinds of network traffic, including good links pointing elsewhere for more information.