Just type this on the gateway console
# tcpdump
you must be using a dual homed machine as your gateway
not quite a efficient method BUT
generally helps in finding which PC has a network virus or a trojan....
you'll see the affected machine ip just filling up your screen.
If its a windows machine, just download sygate personal firewall available on download.com, its a freeware on the affected machine, check the applications that are accessing network resources using SPF, you'll definitely find the trojan....
If its a GNU/Linux machine then
# ps -el
should list all the running daemons......single out the unknown one
use # pkill daemonName
this is a patch fix but immediate solution that I use, the experts in the LUG would definitely give you a long term effective and mature solution.
best of Luck !
bijucyborg
www.getopensource.com
Do you Yahoo!? Yahoo! Finance Tax Center - File online. File on time.