If you have a sniffer, you can use it to gather data. Connect it to a port on your switch and set it to span the switch port that connects to your firewall. That'll show you all the traffic going to the Internet, and you'll see what IP's are sending the most traffic. From there, it's LAN detective work to see who has what IP.
- G