True, they are different scales but I guess the point I didn't focus on was the "data point length". The surge in data is only about 2 minutes long (shown in uplink) and becomes invisible in the client graph. It would be great if we could highlight a section of the client graph and "zoom in" ... which would expose peaks in data usage that are very important. The client graph is actually hiding important data although it's very useful for drilling into specific client usage. This particular business client is on the outskirts of town so fiber is extremely expensive ... but up until recently I wasn't too concerned about bandwidth constraints since the client graph didn't show us bumping up against the 25Mb/s limit. However, monitoring the uplink graph for a full day shows a very different story. Thanks for the input cmr. ... View more

I think you are on the right track. The truth is on the wire. Wireshark from client or pcap from the appliance. If it is that chatty, you should be able to identify the high volume destinations. You could then also netstat -not to find the owning process. Or use the sysinternals tool TCPview to help you see more on the client side. ... View more