Trafcalc calculates the size of the TCP-payload on a system via packet capturing and connection tracking at the user level instead of the IP level.