I have a client with 100 workstations on a Windows 2003 domain. All Internet traffic goes through a PIX Firewall. Between 10-11:30am their T-1 is maxed, after 11:30am the goes back down to normal usage of about 1/4 the T-1. Is there a simple/easy way to monitor internet traffic and find out what internal IP address is using all the bandwidth? I have put monitors on the switches in the building, but that shows total bandwidth including inside file transfers from file servers etc.