How to determine a bad desktop

I have a customer with a very basic LAN, with no pc server, just a collection of
20 or more pc's all running XP. They are all using Access to get the Iseries.

They also have 3 bonded T-1 lines and a Sonic Wall firewall installed by
Verizon for internet service.

This has all worked very well for the last 18 months. We have had NO virus
activity to my knowledge.

On Monday of this week, the internet started acting up and running VERY slow.
we assumed it was just the ISP(Verizon) and got through the day.

It continued on Tuesday and I called the T-1 guys and told them we had a
problem. They said the lines were fine and it was probably a firewall problem.

I called the firewall guys(Tek-Secure Labs) and they said, the firewall was fine
but we had something on the lan that was filling up the buffer and making the
firewall act up.

They said it "could" be a desktop with a WORM virus that was
causing excessive broadcast traffic, which was our problem.

The firewall is supposed to do content scanning but apparently
something may have been sent by a customer in some email traffic
that got through.

I know nothing about firewalls, which is why we hired Verizon to handle this
but now we are in a finger pointing contest over what is wrong.

What sort of hardware/software is available to determine which laptop is causing the
problem ???

They gave me a few "suspect" ip addresses of pc's that "might" be
causing the problem.