Network Monitoring

Anyone have a recommended interface to monitor individual PC generated traffic on my NITIX server? I have 30 users running XP Pro SP2. My mail is Web Hosted by Bell South (AT&T). Last week CNL blacklisted me as infected with a Storm Worm virus. After way too much effort I figured out one of my users was using Outlook to forward his email while he was out of the office and because spam was part of the forwarded email it popped as a virus. If I could have seen the traffic I believe I could have made short work of ID-ing the perp. Any suggestions?