What I ended up doing was using pftop, filtering on the dst port (which should be the internal port on the internal host), and looking for established connections.

Hey @jimp,
For the SG-1100, I know its an Arm box, it one of the reasons I bought it. I said arm64, as that's what bsnmpd reported, instead of Aarch64.

I had a chance to install Net-SNMP on the SG-1100 and it returns ifHCInOctets and ifHCOutOctets:
$ snmpwalk -v2c -c <redacted> 192.168.1.254 | grep -i -e inoctets
IF-MIB::ifInOctets.1 = Counter32: 1066212313
IF-MIB::ifInOctets.6 = Counter32: 0
IF-MIB::ifInOctets.7 = Counter32: 147998
IF-MIB::ifInOctets.8 = Counter32: 0
IF-MIB::ifInOctets.9 = Counter32: 0
IF-MIB::ifInOctets.10 = Counter32: 339689700
IF-MIB::ifInOctets.11 = Counter32: 549481782
IF-MIB::ifInOctets.12 = Counter32: 121263171
IF-MIB::ifHCInOctets.1 = Counter64: 1066384951
IF-MIB::ifHCInOctets.6 = Counter64: 0
IF-MIB::ifHCInOctets.7 = Counter64: 147998
IF-MIB::ifHCInOctets.8 = Counter64: 0
IF-MIB::ifHCInOctets.9 = Counter64: 0
IF-MIB::ifHCInOctets.10 = Counter64: 339693366
IF-MIB::ifHCInOctets.11 = Counter64: 549639578
IF-MIB::ifHCInOctets.12 = Counter64: 121267407

I'll have to keep playing to make sure there is no functionality loss (OIDs returned, etc), but right now I'm happy!

Thanks!
David

@grimm-spector Exactly, it will work just fine :)