Doubt about IPs Dest,Source - Inbound,Outbound

Hi,

I have a doubt I thought was clear for me, but a cliente make me again think about it.

If I want to know which server behind de firewall recevied SMTP traffic it would be an DESTINATION IP, and the bytes RECEIVED will be the amount of information.

If I want to know which server user more HTTP (as a webpage) then I need to indetify this server as SOURCE and Bytes as SENT?

If I have a mail server, behind the firewall, and I want to know how much it sent, if would be necesary to search for sent Bytes?

This is beause my customer wants some alerts when a server pass the limit of transactions. Also Im finishing some queries about this to get the info right from the DB.

Thanks

Thanks