Help with Bandwidth Control and Blocking P2P

[Viper0329]

I'm trying to help manage a moderate sized network with ~200-250 PCs. Our network is supported by 1 T1 (I know, it's not alot of bandwidth, but we're working on that), with 4 Subnets. (192.168.0.x - 192.168.3.x) all controlled through a Cisco 2600 series router and a Websense Filter/Server.

The problem is that someone is eating up our bandwidth really badly, but I don't know how to figure out who is doing it. I set Websense to block the common P2P protocols, but that's not working for some reason. For example, I set it to block Bittorrent, but if I fire up bittorrent, it works. It does block out websites and things correctly, but not P2P.

Is there any way I can monitor which IP is eating up bandwidth? Is it possible to block Bittorrent through port filtering alone?

Also, if anyone has experience with Websense, shoot me a PM, I've got some questions to ask.

 

[JRock]

Familiar with access-lists?

Setup access-lists for the following... (list of ports taken from a random site)

# kazaa - fasttrack clones
add deny tcp from any to any 1214
add deny udp from any to any 1214

# edonkey and clones
add deny tcp from any to any 4661-4672
add deny udp from any to any 4661-4672

# winmx and napster
add deny tcp from any to any 6257
add deny udp from any to any 6257
add deny tcp from any to any 6699
add deny udp from any to any 6699

# bittorrent
add deny tcp from any to any 6881-6889
add deny udp from any to any 6881-6889

# gnutella
add deny tcp from any to any 6346
add deny udp from any to any 6346

add whatever other ports you know of...

To try to find out who is doing it check your syslogs...

If you don't have a syslog server look into kiwi syslog server...

 

[Viper0329]

What is needed for kiwi syslog? I can't seem to find it? Does it filter through the router itself?