You might consider using WireShark, and do a packet capture on the IP address of your SAN for an hour or two, which will determine what IP addresses it's going to, which ports it's using, and how often.
Another thing you could consider is loading your router with an Open-Sourced firmware like DD-WRT, and setting up traffic monitoring. I'm 75% sure DD-WRT can perform traffic monitoring. This way, you could check which device is causing the traffic spikes.
- NOTE: DD-WRT is available for many different makes and models of routers and AP's