So, why is my T-1 so slow lately?

Time to start policing things, I think. Any tips on what exactly to
look for?

I've got ethereal, and some basic knowledge, but it seems to me that
the best it can do is tell me what WAS happening....not what IS
happening, in real-time. an updated lanalyzer would be great.
(whatever happened to "lanalyzer", anyway?).

I've looked at RTmonitor, too. tells what WAS happening,
even if very recently.

I can create a mirrored switch port so I can use ethereal to see what's
coming and going off Bordermanager's private interface; any other
strategies anyone might offer?

I know I can just go off and blindly start blocking certain url's or
patterns in the proxy rules, like "*.mp3", etc....I can also use
zenworks tools to disable certain apps, but I would like to know what's
actually going on, rather than just guess.

A recent thread mentioned streaming media through port 80; can
SurfControl block this type of content? (should we?) how about
linkwall? (currently not running with any content blocker, but its
time to re-implement one).