Report on all outbound IP traffic by source

Hi,

hopefully i'm missing something obvious (although not holding my breath on that)

Background:

I am looking into identifying the source and type of some unexplained outbound traffic on a network connection, essentially there are a number of devices outside of the main firewall. the ISP informs that there is a very high outbound usage, no correlation to inbound traffic seems to exist.

I have put in XG in bridge mode in order to track down what this traffic is.

all i seem to be able to get from the reports is web or email related info, however, there are around 65533 other TCP ports out there, and an infinite number of applications, therefore, i'd like to get data over time of what the high TCP users (source IP) are, what protocols they are using, where this traffic is going etc.

pretty much basic IP traffic reports.

where is this hiding in XG? i'm running v16.

or should i just get a TMG install disk out?