How to View Source of Interconnect Attachment Egress Bytes

[kcchris]

Hello all.

First, please excuse the newb-ish question. I am ACTUALLY quite new to learning GCP. So if this is not the right location for this question, or it's been answered somewhere else (I couldn't find) please let me know and direct me there.

I've read all the google documentation there is on logging/monitoring for interconnect attachments. I am trying to develop useful documentation for our SRE team to use in troubleshooting anomalous spikes in interconnect attachment traffic. The easy part is in the monitoring section, where I can see WHAT attachment has had the highest spikes. The difficult part has been in determining who or what is causing those spikes. I feel like I'm going in circles and am unable to find the source itself. 

Any tips?