Firepower - Finding internal or external hosts that might be saturating an interface or resources on a specific host.

trying to rule out why a certain host is being bombarded with requests and talks of "network is slow".

been reading up on network analysis policy and the use cases with enabling certain ids signatures to generate and generate and drop for port scanning and either rate limiting or dynamic state rules..any feedback on best way to find offending network traffic or to prove its not the firewall would be appreciated.