This message was deleted.

I’d start with a packet trace to see if you can identify ip addresses that don’t belong

Review logs… 😉

Yep, wireshark - Statistics, conversations will show you which IPs are passing the most packets.