We have a Point-2-Point T1 that supplies a 1MB connection between two LANs. The T1 is wide open for both networks so traffic can come across the T1 at any time for any reason. DHCP helps to control access by passing out local gateway, DNS and other domain traffic. However there are times when we have a wild node that gets relocated to the opposite office or maybe a wrong DHCP entry. Either way, we end up with 3000ms response time across the T1 when you normally see 10ms. The challenge is that I currently have no quick way to see what node is sending/receiving traffic across that link. The T1 is terminated into a radio broadcast device that does nothing more than give it a switch port, so there is no monitoring on either end.
With all of that said, I would like to be able to install a computer at one end of the T1, maybe place a 10/100 HUB inline with the T1 before it hits the local switch. The computer could sniff the traffic to see what IP is sending/receiving a large majority of traffic.
Is this the best and cheapeast solution and if so, what software is free that will do this for me?