How to identify a PC using all the available bandwidth?

[appelq]

I have a multi-site private network using MPLS.
We have a Private IP scheme using 192.168/24 addresses where the 3rd octet identifies my sites.
Users ate one site, have 2 bonded T1's for a 3MB port to the MPLS cloud.
They tell me that during the middle part of the day, their access to the application hosted at my other site, slows to a crawl.

Using Ping and Traceroute, I notice that the trace hops are definitely slow on their end, and that the slowness tends to start abruptly and End Abruptly at around the same time each day.

I suspect that 1 (or more) PC's may either be launching something that is using a lot of bandwidth, or a PC may be infected with something.

I would love to be able to run a packet analyzer or something that might tell me for example that IP 192.168.5.65 is sent/received 100mb data from/to {some public IP address like Youtube or something} in the last X minutes.

I would need to scan all IP addresses at that location (192.168.5.x)

So my question is what would be the best approach for someone like me who has never used a Packet Analyzer?

Thanks in advance,
Chuck

 

[VinceWhirlwind]

I would use a tool such as Solarwinds to query SNMP stats off the local switch. Leave that running for 24 hours and you will have a complete picture of switchport utilisation which is usually enough to pinpoint this kind of problem and nail it.

Failing that, just log into the switch and display switchport utilisaiton stats while the problem is occurring.

By figuring out which Tx & Rx stats are anomalously high, you should be able to its source.

I always sketch up a logical network diagram indentifying all infrastructure and devices prior to trying to interpret the traffic stats.

I recently did a job like this where the mob responsible for the network had spent two months scratching their heads and making excuses - 1 hour of traffic stats allowed me to indentify their problem without any problem.

 

[vipergg]

Do you have a router on that end, if so just enable netflow and you should be able to determine who is cranking the data out by just looking at the netflow data.