Could you tell me please, best practise to monitor bandwitch consumed by users (per internal user's IP address)?
I am searching for way of finding the most active ones.

simple queue

or

statistic gathering ip filter rules