1) First Network topology
Internet<--G0/0--> TR<-->CoreSW<--Firewall<--> Server and LAN network
<--Gateway<--> Customers
2) Problem is at the G0/0 port on TR specially the Egress " Surges to 2...
So after doing a packet capture we found out that out bandwidth was being used through port 17 from an ip that's not in out network. We applied an ACL for both egress and ingress blocking port 17 on our port and problem is solved.
