How to determine a bad desktop

[Pat Barber <mboceanside@xxxxxxxxxxxxxxxx>]

I have a customer with a very basic LAN, with no pc server, just a 
collection of
20 or more pc's all running XP. They are all using Access to get the 
Iseries.

They also have 3 bonded T-1 lines and a Sonic Wall firewall installed by
Verizon for internet service.

This has all worked very well for the last 18 months. We have had NO virus
activity to my knowledge.

On Monday of this week, the internet started acting up and running VERY 
slow.
we assumed it was just the ISP(Verizon) and got through the day.

It continued on Tuesday and I called the T-1 guys and told them we had a
problem. They said the lines were fine and it was probably a firewall 
problem.

I called the firewall guys(Tek-Secure Labs) and they said, the firewall 
was fine
but we had something on the lan that was filling up the buffer and 
making the
firewall act up.

They said it "could" be a desktop with a WORM virus that was
causing excessive broadcast traffic, which was our problem.

The firewall is supposed to do content scanning but apparently
something may have been sent by a customer in some email traffic
that got through.

I know nothing about firewalls, which is why we hired Verizon to handle this
but now we are in a finger pointing contest over what is wrong.

What sort of hardware/software is available to determine which laptop is 
causing the
problem ???

They gave me a few "suspect" ip addresses of pc's that "might" be
causing the problem.