Trace traffic leaving network
On our ISA Server I have NetMeter running so I can see when the internet usage spikes.
I noticed today that the outgoing traffic has been sitting at 60kb/s constantly since this morning.
It's a very unnatural usage, even when all our labs are in use the outgoing traffic never reaches these sort of levels, and especially doesn't sit at this level for hours.
Is there any quick way of seeing where this traffic is coming from?
I imagine I can look at the ISA logs, but you can only generate the report 24 hours later.
I suspect somebody has limewire/frostwire open somewhere...