High eDir CPU Utilization

[smo989]

Yes, unplugging the network cable makes the utilization drop. So what I'm gathering is that I should look for a misbehaving client? Is there a way to see where the requests are coming from short of running thru the connection list in monitor? dstrace +ldap shows no appreciable traffic. We do have a firewall that uses ldap for lookup of client access to the internet. That firewall points to a specific server (with a RW replica) but all servers that contain a replica of root are showing high utilization on ds.nlm.
There are about 1000 users on this network on very current, late model server hardware. I wouldnt think that it would struggle to make it's way through day to day requests. Any suggestions how I could figure out what protocol, ncp request, service is causing this?
Again thanks in advance for assisting
Sean