If you're using SmartEvent, you can definitely figure out what user is using the most bandwidth from some of the reports.
Even SmartView will give you some basic details with the right search query.
All my users are on one subnet, so it's easy to narrow down which one 🙂
![Screen Shot 2019-03-22 at 3.22.28 PM.png Screen Shot 2019-03-22 at 3.22.28 PM.png](https://community.checkpoint.com/t5/image/serverpage/image-id/371i65CE70DC87D4D119/image-size/large?v=v2&px=999)
Granted, these are IPs and connections, so it's not "bandwidth" but can be helpful if you don't have SmartEvent or don't want to use SmartView Monitor.
More details on SmartView Monitor here: https://community.checkpoint.com/t5/General-Management-Topics/Total-bandwith-of-interfaces-and-each-...