I've seen a couple of days since last Thursday where internet usage at one building has hit 35MB at exactly 8AM (this is before most of are employees are here, some supervisors come in this early, and some people leave their computer on). I haven't been able to pin point the cause, as I'm not here before it happens usually whats the best way to see what's going on. I set all of our computers to do a full system scan today in case a computer is infected with a virus.
I have seen this in the log on the switch
"Informational %SECURITYSUITE-I-SECSYNATTACKED: A TCP SYN Attack was identified on port gi48."
That is a DHCP/DNS server on that port.