Internet Bandwidth Monitor

I'm running a dual 128 ISDN line. Every now and then, usually around lunch time, the internet connection becomes real slow. I am suspecting that someone or a group of people is/are downloading very large files. I need to be able to identify the culprits. I have internet software for tracking purposes, but I have not been able to find anything that monitors bandwidth (only ones that make generalizations). I guess I want to find software that when the internet connection gets bottled up, shows me what user/workstation is using the most bandwidth. I'm running NT 4.0 with a firewall. Any suggestions or comments would be appreciated. (Besides the fact that we need more bandwidth). Thank You.

LittleBrother from Kansmen Corporation monitors Internet usage on a LAN
and can also block access to user-designated sites. It can create
reports that summarize usage in chart or text format. LittleBrother
keeps track of traffic by user, site, protocol, bytes transferred, and
capacity utilized. With LittleBrother, a network manager can determine
how much bandwidth is used for applications (Web, FTP, Telnet, Mail,
News, etc.) and also see who is using the most resources, as well as
which sites are visited the most. Managers can specify rules to block a
group of users from certain unproductive sites during working hours. The
program contains a report wizard that assists in generating various
reports based on Internet application protocols, users, and sites. A
query tool is also available to generate custom usage reports. There are
two versions, one for Windows 98 and NT and another for Windows 95.

LanTrend from Intellimax Systems, Inc. is a Windows 9x/NT network-
monitoring program. It features network monitoring with Internet traffic
analysis, utilizing a graphical interface. Network traffic statistics
are displayed in graphical formats, and Internet and local network
monitors show who has connected to what Internet site. Network usage
displays can be filtered by timestamp, HTTP, FTP, and more. The program
can also discover local PC hosts in different network segments. Host
names for each system are shown, as well as MAC/IP addr ess. IP
addresses can be resolved to real site names using DNS. A built-in alert
module displays warnings when user-defined thresholds are surpassed
(default settings are included for many error thresholds). It even warns
when users are sending unencrypted passwords in FTP or POP3 packets.
Remote monitoring capabilities are also included.