Torch
Torch shows the traffic that passes one interface right now, grouped into flows by address, protocol, port and DSCP, with the rate in each direction. Find the host that uses the bandwidth, watch one protocol or port, check VLAN tags and DSCP marking, see traffic that the firewall drops, and see which CPU handles it.