We have several remote sites connecting back to a central site over AT&T's ASE product (metro switched ethernet). One particular site is not currently in use at the moment. Nothing is active on the network there, except for a few security cameras.
There seems to be an unusual amount of inbound traffic to the site, a lot more than would be expected for it being unused. Almost all of it appears to be multicast, with a fair bit of broadcast. Multicast routing isn't in use at this site, and I don't think the security cameras are using any multicast. Is there any easy way to figure out what this traffic is?
I know I'm probably going to have to make a special trip out to the site to do a packet capture, but I was trying to avoid that. The only two switches there are both Cisco 3550s, and I don't think embedded packet capture is available.
