What I ended up doing was using pftop, filtering on the dst port (which should be the internal port on the internal host), and looking for established connections.

Hey @jimp, For the SG-1100, I know its an Arm box, it one of the reasons I bought it. I said arm64, as that's what bsnmpd reported, instead of Aarch64. I had a chance to install Net-SNMP on the SG-1100 and it returns ifHCInOctets and ifHCOutOctets: $ snmpwalk -v2c -c <redacted> 192.168.1.254 | grep -i -e inoctets IF-MIB::ifInOctets.1 = Counter32: 1066212313 IF-MIB::ifInOctets.6 = Counter32: 0 IF-MIB::ifInOctets.7 = Counter32: 147998 IF-MIB::ifInOctets.8 = Counter32: 0 IF-MIB::ifInOctets.9 = Counter32: 0 IF-MIB::ifInOctets.10 = Counter32: 339689700 IF-MIB::ifInOctets.11 = Counter32: 549481782 IF-MIB::ifInOctets.12 = Counter32: 121263171 IF-MIB::ifHCInOctets.1 = Counter64: 1066384951 IF-MIB::ifHCInOctets.6 = Counter64: 0 IF-MIB::ifHCInOctets.7 = Counter64: 147998 IF-MIB::ifHCInOctets.8 = Counter64: 0 IF-MIB::ifHCInOctets.9 = Counter64: 0 IF-MIB::ifHCInOctets.10 = Counter64: 339693366 IF-MIB::ifHCInOctets.11 = Counter64: 549639578 IF-MIB::ifHCInOctets.12 = Counter64: 121267407 I'll have to keep playing to make sure there is no functionality loss (OIDs returned, etc), but right now I'm happy! Thanks! David

@grimm-spector Exactly, it will work just fine :)