Cisco Switching/Routing :: 3750 / How To Identify Broadcast Traffic Source

We have 2 switches split across 2 datacentres connected via an interconnect.  Over the past couple of days the interconnect provider's Cisco kit has shut down our port (err-disabled) due to a broadcast storm.  They had the level set at 1 which I thought was a bit low.  They say they tried to set to 2, then 5 but still kept tripping the storm-control feature so they set at 10.  They say they've always had it set at 1% (on a 100Mb switch) and so we must be generating more broadcast traffic.
 
I'm trying to identify where the broadcast traffic is coming from.  On our Cisco 3750 I've clear interface counters and when I do a sh run | i broadcasts there are a few ports which have what seems like a high broadcast count.  The one port that is especially high and the only one tripping the storm-control feature (I've enabled on all our ports to try to identify where the traffic is coming from) is the port connected to the 100Mb interconnect.  I've mirrored that port to another port and connected a server with wireshark so I can capture all the traffic across that port. 
 
What I'm struggling to find is the source of the broadcast traffic.I have a few questions are these broadcasts layer 3 or layer 2 broadcasts.  Also in the output below when it says broadcasts received is this inbound to the port i.e. from the connected device or is this a total of inbound and outbound broadcasts.
 
When I use wireshark and filter the capture on broadcasts (ff:ff:ff:ff:ff:ff) I see only 200-300 compared to the thousands the switch is reporting.If I filter on the broadcast IP address I also don't see the numbers corresponding to what I see in the show interface output.
 
GigabitEthernet1/0/1 is up, line protocol is up (connected)
  Hardware is Gigabit Ethernet, address is 0014.a93f.7401 (bia 0014.a93f.7401)
  Description: Interconnect
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 4/255, rxload 44/255
  Encapsulation ARPA, loopback not set

[code].....
 
also I'm currently doing : monitor session 1 source int g1/0/1 both, and also tried just rx incase I just need to be looking at receive traffic but still nothing is standing out.