Hi,
You can Enable IP accounting on the ingress interface, you would be able to find the most talkative machine.(in No. of bytes transferred)
You can also try debug ip packet....but be carefull, it generates huge amount of traffic, you can use
"u all" to stop all debugging.