Perhaps you want to look at netflow records with (for example) pflow and flow-tools. The default flow-report gives you a "Average IP packet size distribution".
Code:
$ flow-cat /var/log/netflow/ | flow-report
[some crap removed]
Average IP packet size distribution:
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.000 .193 .261 .138 .117 .058 .025 .016 .010 .011 .010 .008 .004 .004 .005
512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.004 .006 .005 .068 .055 .000 .000 .000 .000 .000 .000
[more crap removed]