+ 0 Votes Clarification sanks4545 3 years ago Righto, Wireshark isn't helping me to much because it is a switched LAN. I'll try and clarify a little bit here.... There are times, while at work, when the internet speed slows down considerably and my suspicion is that someone is using our bandwidth to stream/download movies and/or other large files. I'm looking for a way to find out who it is. Thanks! + 0 Votes Trace Route morris.levy 3 years ago I would recommend using the Trace Route command: tracert http://support.microsoft.com/kb/314868 + 1 Votes Firewall logs? tmcclure Updated - 3 years ago Do you have a central firewall? Depending on your firewall's features, you may try your firewall logs as well. + 1 Votes Classic Problem henrysteinhauer 3 years ago Are you part of the Networking Team? Or a general user wanting to help out? You need to find the Router where the traffic is coming into your office and then that should lead to the Uplink Switch connection. You will need a Port Mirror off that Uplink connection so that you can see all the traffic happening between your Router and the rest of the internal network. Rmon type studies are good for this as you are not really interested in the detail packets, but in the summary of what is being done. ie User and Ports involved. This should give you the Server :: Port and User::Port. From that you should be able to get the information you need about the amount of traffic happening at an interval of time. Later you can use WireShark to filter on just that one User and gather the details about what is happening. But the Rmon should narrow this down to a given user. Then perhaps just walking by that user would give you the details on what they are doing. + 0 Votes Monitor physical link to Default Gateway kpb_uk01 3 years ago You can monitor the link that connects your local network to the Default gateway with Wireshark. Most Managed switch have the ability to "mirror/span" a port, so that you can see all the traffic passing to and from the Internet. If you are not able to configure the switch, then install a small Hub or make up a Passive Tap that does the same thing. A quick web search gives plenty of information on how to make the a Tap and install it. Under the Wireshark Statistics tab there are a number of functions to help identify the source all the traffic on the monitored link. + 0 Votes Missing information NickHurley 3 years ago I know this a friendly, helpful community and all but your request seems a bit odd. What is the size of the network that you are dealing with? are you running DHCP? you know someone is streaming how? if your objective is to monitor this person with out the above information or access to critical network hardware (assuming you mean a physical switch), finding a switch to plug into is the least of your concerns. + 0 Votes I'm confused???? whatzup January 31, 2013 at 8:21am PST To me the easiest way to find your switch would be find your default gateway, but that would seem easy to me. You kind of have me confused, you seem to want to monitor a person, but don't seem to know much about anything else? Please explain?