+ 0 Votes Netflow Enforcer Drive 3 years ago We use Cisco's Netflow Analyser. We can trace usage down to the machine's IP. It shows http,msds,citrix and all other types of traffic. I usually use the freeware lanspy to resolve the IP to the logged on user. Alternatively you can use Group Policy simulator to resolve the user name. It is very good at showing source and destination IP's. This is very good for determining a website that somebosy is downloading from. The only drawback is that you need a cisco switch, although I know it also works on HP Procurve switches.