Something has been happening on my company's network at 9:30 every day. I'm not the sysadmin but he's not a ServerFault guy so I'm not privy to every aspect of the network but I can ask questions if follow up is needed.

The symptoms are the following :

1. Sluggish network and download speed (I don't notice it, but others do)
2. 3Com phones start ringing without having people on the other end.

We've got the following ports exposed to the public for a web server, a few other ports for communicating with our clients for tech support and a VPN. We've got a Cisco ASA blocking everything else. We've got a smallish network (less than 50 computers/vms on at any time). An Active Directory server and a few VM servers. We host our own mail server too.

I'm thinking the problem is internal, but what's a good way to figure out where it's coming from?