How can I identify applications or processes using thunder protocol in the network

Question

For the last one week we have been having performance issues with our internet connection. The only thing that i know of that has changed with in this period is that I have upgraded several desktop OS from ubuntu-mate 14.04 to ubuntu-mate 16.04. Having no other reason for the intermittent deterioration of the internet connection, I called my ISP, The explanation given by the ISP is that I am maxing my allocated bandwidth. I have been using the same bandwidth for the same activities with no problem for months now. I therefore asked the ISP for the breakdown of the protocols using the bandwidth and the ISP sent me this graph

I was buffled the protocol using most of my bandwidth is something I've never heard of: I decided to do a google search on what this thunder protocol is and the scanty information i got was that this is a P2P protocol, something like bit-torrent. The first suspect was the windows work-stations within the network. I checked whether there were any installed suspicious programs and I uninstalled them. I then called the ISP to check whether thunder was still accessing the internet from my IP and it was still there. I wiped the harddrives on the windows stations and installed fresh copies and then called the ISP again and thunder was still there. Now I am left with the ubuntu-mate stations as suspect. How can I identify the applications or processes using this protocol and how can I stop them from doing it.

Answer 1

With a firewall. Several do application signatures and could be able to detect it.

Packet capture at the router will identify the IP addresses on your network.

If there is an option to increase the bandwidth of your links, that can mitigate your performance problem. There might still be unwanted applications using your link.