The following output is generated from a diff of two "show conn" commands in a Cisco Pix (or pix-like) firewall. The time between the "show conn" commands is somewhat approximate due to network lag and such, so the 's" value in such things as "kbps" may be imprecise and should be taken with salt.
For comparison, the raw output of "show conn" is displayed below the chart. Currently only TCP is considered.
Further - a connection that existed in the first scrape, but not the second, contributes zero bits per second to this chart. A connection that exists in the second scrape but not the first is treated as if has existed for the full polling period. A connection that is created and torn down between the polling periods will not show at all. These are the limitations of only having two samples.