How to find the guy that download big file and others can't surface the internet

# eth1 is a nic that receive mirror port from h3c, just outgoing flow
tcpdump -i eth1 -n | awk '{print $3}' | awk -F. '{print $1"."$2"."$3"."$4}' > 1.txt
cat 1.txt | sort   | uniq -c | sort -n

# Do a acl on the H3C to deny the ip
acl number 3333
rule 1 deny ip source 192.168.50.90 0
rule 2 permit ip

interface e0/1
firewall packet-filter 3333 inbound