We present measurements of stream lifetimes in California and at Auckland. We suggest that one could ignore streams with less than six packets, since they usually account for 10% or less of the total bytes. However, we often observe large bursts of small 'attack' streams; we remark that a strategy of `focusing on the elephants' can be upset by such 'attack' streams.