My WSUS-Server has a Rule under NETWORK PROTECTIO-FIREWALL that is SERVER => ANY => INTERNET (Log Traffic).

In my "Daily Executive Report" I can see, that my WSUS-Server causes ~6GB of Internet-Traffic every day.

I´m only auto-approving Defender-Updates, so I don´t think, that WSUS ist genereating that traffic.

This, in my opinion, means, that either the count is wrong oder some other "Things" on my Server cause that traffic.

1st Question:
How reliable is the count? Sometimes it looks to me that this count also includes LAN-Traffic and not only Internet-Traffic...

2nd Question:
Where can I see, what IP´s have been called by my Server and how much Data was transfered to and from?
So far I only found it under LOGGING AND REPORTING - NETWORK USING - BANDWITH USING where I can click my Server´s IP but then see only a total sum.
And I found it under LOGGING AND REPORTING - VIEW LOG FILE - FIREWALL where I can see all Traffic of this and all other machines.
I can filter to my Server´s IP but then I see "only" Target-IPs but not the amount of Data transferred.