Let me point folk at the Internet Measurement Workshop:
http://www.icir.org/vern/imw-2002/ including especially the
link to the online proceedings. A fair number of the papers
have a lot of operational relevance.
--Steve Bellovin, http://www.research.att.com/~smb (me)
http://www.wilyhacker.com ("Firewalls" book)