Thanks for your response.
Does the command help to identify the connection which had heavy flow a week ago ?
Since the issue occurred only once and usually this is occurring whenever the Microsoft patch upgrade over the systems ( happens once in a month ) . So basically wanted to know and get proof is this because of patch upgrade it happens or does any other traffic constituting to this.
Bandwidth spike occurrences are taking from the SolarWinds monitoring , and from the CP want to identify the historical bandwidth hogging connection for that particular time.