After looking up akamai, it seems nearly everyone on earth is using them to stream / deploy data.
This makes it hard for me tracing where traffic is coming from, all I get is
a92-122-49-176.deploy.akamaitechnologies.com
or an equivalent ip .
Short of standing behind a user, what's the best way to actually determine if this is windows update or bbc iplayer or mcafee, or dropbox, or ...........?
this is picked up by the netflow monitors i have on each site....