high network usage

Hi,

one of our Terminal servers behind the utm shows a high netwerk traffic, I did find out which customer and which user generating the data, but I can not see what application generating this high traffic

I did contact that user and login to his session and he was not doing anything out of ordinary.

any idea how can we findout what genrating the data traffic.

Thanks