Monitor network line traffic

[LostGen]

I have had a little problem at work that pops up every few months and annoys me for a few days and then goes away. I will give some details about the network and then maybe one of you guys/gals will have a good idea!

I have a central office with 3 t1 lines, one goes to the internet, and the other 2 are divided up to the remote offices. I have 7 locations, 3 of them connect on the first T1 and the other 4 of the other T1. All locations are running data and voice over frame. All of the ofices have a cisco 3810 router and the main office also has a 3640 router.

My problem is this! Someone at one of the remote locations is pulling some sort of data and it is spiking the bandwidth for what we alotted that location. This only affects the one office. The best I have been able to do so far is narrow the traffice down to the one location. I am not sure what to do next, I was thinking maybe linux had some sort of software I could put next to my cisco router that could diagnose and monitor the line. Then when this traffic started to spike I could catch the culprit and find out what they are doing!

Any ideas?

LG

[neuron]

you could use iptraf and monitor the ip's from the offices maybe?

you should be able to use iptraf to monitor it aswell, if you classify the ip's into different categories you can use "tc" to monitor it.