How to monitoring activity on a card?

[Francisco Reyes]

My setup 4.9 stable with IPFW. Machine acts as gateway for two machines.

What are my options on monitoring activity on my external card?

This morning I noticed my DSL modem activity light is blinking non-stop.
Looking at /var/log/ don't see anything suspicious.

I feel tempted to add "log" to all my ipfw pass rules, but wonder if there
isn't a better way.

I am mostly concerned there is either some kind of attack going on or
somehow the machine was hacked and it's running something it's not
supposed to.