Yaya, KissCool is right. I would probably download a free port scanner, and watch the traffic moving across. If you find a particularly active node, you've probably found your culprit (or at least someone who's probably doing something they shouldn't ). That's how I'd do it.