ASDM sees traffic maxed out, but who is causing it!!?

Cacti won't tell you, but Netflow will.

There are a few "free trial" netflow software packages available. I am not in a position to recommend one at present.

Perhaps a simpler idea is to use ip accounting. Trouble with this is that you can only configure

ip accounting output-packets

If you put this on the inside interface you might be able to get an idea of what is going on regarding inbound traffic.

If you are being constrained by outbound traffic then this will not work very well since by the time the packets get there they have been NATted and they may all have the same source address. Worth remembering that TCP sends an ACK every second data packet "by default".

clear ip account ! -- resets the counters sh ip account ! -- displays the info

You didn't wrote which version of ASA software you have. Some older versions earlier then 8.0 AFAIK cannot use netflow, but they can use syslog, so you may use some of the firewall analyzer software which do parsing of syslogs into a nice set of views (charts, tables, etc) about all traffic passing trough the firewall (including special reports about dropped ones). I'm using this one:

you can use it as a trial or maybe even for free if you have only one firewall with 2 interfaces you wish to monitor.

If you have a newer ASA software then you can use a netflow. For that again I'm using ManageEngine NetFlow analyzer or something like that...Here is the link for manageengine:

If it's not free anymore you can try googling for some from other manufacturers that offers free software (open source community maybe). A great think about both applications is that they are using database (I think mysql - for windows) so that you can have traffic data from past days, weeks, months, etc.

Regards, Igor

I'm using ASDM version 5.2