Here's a tcpdump that seems to work. It should at least help you figure out if the empeg is being overloaded with traffic.

Edit: Sorry. That attachment was way too big. Check the next post for a compressed version.