Potential hairpin traffic, and how to find it?

Here is a fairly typical bandwidth use image from our daily reports:



Notice the spikes. What we actually pay for is 5000KBps, but you can clearly see spikes above 80,000 and numerous occasions where it crosses 10,000. I'd really like to know what's going on with this extra traffic.

The best I can guess is that I've got something doing some hairpin routing, where traffic that should be entirely within my network goes out to the untangle box to be routed back elsewhere. However, I have no idea how to track this down, as it's not predictable when the spikes will occur, and the best thing I can say about keeping bandwidth monitor open to try and catch a spike is that opening bandwidth monitor is a good way to sabotage our internet connection for a few minutes until I give up and close it.

My other guess is that this is LAN traffic, and the spikes are from a host on my network trying to send a bunch of data to UT too fast... but again, I'd love to know where this comes from, and I don't know what tools I can use to check it.

Any ideas appreciated.

Attached Images