Firewall/NAT

I see on the traffic graph something is sending me data at 2.8 MBps.  I'm trying to figure out what it is..  if it's just an email with an attachment coming in to my mail server or if I've been exploited and some malware or something is being pushed to me.  Is there any way for m0n0 to drill down into the traffic data to tell me ideally what port and at least what internal IP the traffic is going to?

Thanks!

Look in Diagnostics | Firewall States to see what connections are established.

So how does that work?  I see it has the "Start" then "view delta" options.  So I would assume that I hit start, then it starts logging, then I hit view delta and it shows the connection stats for connections that occured in that timeframe, is that right or am I way off?  Thanks.