Best way to detect a faulty device on the network?

[BlackTower]

I had a problem today in a school where the network was very intermitent so knowing the nature of the call I took a new switch with me and promptly bunged it in. Everything was fine at first then after a few minutes back to it's old tricks.
Now ive come accross something like this before when a faulty print server was causing a broadcast storm (I think thats the correct term ) but I was lucky finding this because I unplugged it and the traffic lights on the switch calmed down.
I went around and unpluged computers individually (although not all as I was installing stuff on some of them) but to no avail. Now this method isnt too bad if there arent too many devices and you can still see the switch and what it's doing so....
What kind of software can I use to try and track this program down? Some kind of network monitor and any suggestions of a good one and any tips would be greatly appreciated.

Thanks in advance

ps I did consider something like blaster trying to move around the network but they are all 98 and AV is upto date.

[scottyman]

netstat on an affected machine
nbtstat -a machine name etc...
you can see where traffic and connections are headed

[Moby-Dick]

couple of tools to try -

get a copy of GFI Languard Security Scanner from www.gfi.com and find out exactly what is on your network (scan the whole IP r subnet and see if there are any odd machines on it. )

use a packet sniffer such as ethereal ( www.ethereal.com ) connected to the uplink port of your switch ( this should receive traffic in a broadcast mode so you can see all the transactions the switch is carrying out )

those should help you identify the source of any broadcast storms.

[BlackTower]

Thanks that sounds like the trick I shall try them out next week when I go back .