[CentOS] OT: mysterious traffic

Hi all,

I have few sites which interconnected using a dedicated link.
During these few weeks I've found that there are some mysterious traffic 
pass over my router with constant amount of bandwidth all over the time. 
I can know this because after working hours, only few applications are 
running and it did not generate this kind of traffic.

Anyone can advice how to detect what kind of traffic that consumes those 
bandwith?
I suspecting its a virus or something else because half of our clients 
are still using windows.

TIA.


-- 

--beast