It sounds like Solar Winds Netflow Traffic Analyzer (NTA) is the module for you. Not only does it show you the traffic between any two addresses, it shows you when it happened and what kinds of traffic were passed.
I use it most for troubleshooting congestion across small WAN links. A site with a small number of only Citrix users worked fine across a T1 for a long time, and then they all began complaining their sessions were disconnecting or very slow. NPM showed the T1 was fully utilized, but NTA enabled me to discover a full PC had been installed, and its user was streaming A/V over the WAN for personal entertainment. I helped educate the site about their limited WAN resources and recommended they use a transistor radio, MP3 player, CD's, etc., rather than shutting down everyone's computer just so one person could enjoy music in their office.
NTA helped me quickly identify the problem and find the offending source and solve the issue.
You can download a free 30-day trial if it sounds like this is the right tool for your job: Network Traffic Analyzer – Bandwidth Monitor | SolarWinds.
Swift packets to you & your customers!
I am actually using a demo version of NTA right now. You mention a way to find out WHEN traffic happens? Is there a better way than manually going in and checking on a daily basis? For example, if someone transfers files to one specific destination 3 times over the course of a day, can I see that the 3 separate transfers happened, or will I just see it as one conversation for the day?
I think you're looking for a sweet query and output, but all I have to offer is the option of changing the time frame to include the dates you're interested in. By default you'll probably only see the activity for the last 15 minutes, but you can set custom times or dates in NTA and go back as long as you keep records. Just check the Absolute Time Option in NTA to set the "From" and "To" times.
It's in the Netflow tab, the Conversations link in the upper left, and then on the far upper right it's the small blue square box with the white down-arrow in it, next to "Last 15 Minutes":
If you DO happen to find that sweet query place, please respond with it in the comments, or mention me in it. I like the sound of it!
If you are running a ftp software that writes to the logs, all the data will be there but how do you find it. The answer is LEM.
With Log and Event Manager you can find the log files for the transfer and see who sent what to whom and when.
Its as easy as a Google search with built in nDepth search tool in LEM.
There is even a FTP traffic filter in Monitor.