Посмотрим все соединения

[admin@torg] > /ip firewall connection print
Flags: S - seen reply, A - assured 
 #    PROTOCOL SRC-ADDRESS           DST-ADDRESS           TCP-STATE   TIMEOUT    
 0 SA udp      192.168.12.6:57582    213.24.127.137:52488              2m20s      
 1 SA udp      192.168.12.6:57582    213.242.3.172:62139               2m21s      
 2 SA tcp      192.168.12.4:1675     205.188.10.225:5190   established 3h59m45s   
 3 SA tcp      192.168.12.6:49171    217.20.147.94:443     established 3h59m56s   
 4 SA tcp      192.168.12.94:53396   217.69.138.102:2042   established 3h59m57s   
 5 SA udp      192.168.12.6:57582    176.49.189.228:58209              2m23s      
 6    udp      192.168.12.6:57582    192.168.254.18:52075              9s         
 7 SA udp      192.168.12.6:57582    188.162.229.132:62850             2m56s      
 8 S  udp      192.168.12.6:53688    111.221.77.141:40004              0s         
 9 SA tcp      192.168.12.4:1067     94.100.188.171:2042   established 3h59m44s   
10    udp      192.168.12.6:57582    94.245.121.251:3544               7s         
11 SA udp      192.168.12.6:57582    83.246.231.47:58842               2m47s      
12 SA udp      192.168.12.6:57582    94.141.36.60:58912                2m15s      
13 SA tcp      192.168.12.6:63487    217.20.147.94:80      established 3h59m24s   
. . . . . . . . . . . . .
-- [Q quit|D dump|down]

Посмотрим только активные соединения

[admin@torg] > /ip firewall connection print where tcp-state="established"
Flags: S - seen reply, A - assured 
 #    PROTOCOL SRC-ADDRESS           DST-ADDRESS           TCP-STATE   TIMEOUT    
34 SA tcp      192.168.12.4:1675     205.188.10.225:5190   established 3h59m8s    
35 SA tcp      192.168.12.94:53396   217.69.138.102:2042   established 3h59m3s    
36 SA tcp      192.168.12.4:1067     94.100.188.171:2042   established 3h59m4s    
37 SA tcp      192.168.12.6:63487    217.20.147.94:80      established 3h59m      
38 SA tcp      192.168.12.4:1087     134.170.25.86:443     established 3h58m6s    
39 SA tcp      192.168.12.4:1076     65.54.167.19:12350    established 3h52m6s    
40 SA tcp      192.168.12.6:49252    74.125.143.100:443    established 3h58m49s   
41 SA tcp      192.168.12.94:60547   74.125.143.100:443    established 3h58m57s   
42 SA tcp      192.168.12.6:55022    94.100.188.169:2042   established 3h59m      
43 SA tcp      192.168.12.6:55014    94.100.188.173:2042   established 3h58m49s   
44 SA tcp      192.168.12.94:53786   65.55.223.31:40021    established 3h59m3s    
45 SA tcp      192.168.12.6:49246    217.20.147.94:80      established 3h58m53s   
46 SA tcp      192.168.12.6:49209    64.4.23.174:40026     established 3h58m58s   
47 SA tcp      192.168.12.4:4268     157.55.130.175:40031  established 3h59m6s    
48 SA tcp      77.34.32.32:35677     77.34.11.114:22       established 4m10s      
49 SA tcp      192.168.12.94:53788   157.56.116.204:12350  established 3h54m3s    
50 SA tcp      192.168.12.94:56838   64.4.47.11:443        established 3h59m4s    
51 SA tcp      192.168.12.201:3720   192.168.2.210:445     established 3h59m8s    
52 SA tcp      192.168.12.94:60495   217.69.139.216:443    established 3h59m8s    
53 SA tcp      192.168.12.94:60616   217.20.147.94:443     established 3h58m40s   
54 SA tcp      192.168.12.6:49213    91.190.218.55:12350   established 3h55m51s   
55 SA tcp      192.168.12.6:49250    74.125.143.136:443    established 3h58m47s   
56 SA tcp      192.168.12.6:50417    65.54.184.46:443      established 3h58m51s   
57 SA tcp      192.168.12.94:60621   74.125.143.91:443     established 3h59m58s   
58 SA tcp      192.168.12.94:60622   74.125.143.91:443     established 3h59m58s   
59 SA tcp      192.168.12.94:60623   74.125.143.138:443    established 3h59m59s   
60 SA tcp      192.168.12.94:60624   74.125.143.138:443    established 3h59m59s   

Посмотрим все соединения для 192.168.12.94

[admin@torg] > /ip firewall connection print where src-address~"192.168.12.94"
Flags: S - seen reply, A - assured 
 #    PROTOCOL SRC-ADDRESS           DST-ADDRESS           TCP-STATE   TIMEOUT    
157 SA tcp      192.168.12.94:53396   217.69.138.102:2042   established 3h59m50s   
158 SA udp      192.168.12.94:43127   177.99.236.85:24112               1m22s      
159 SA tcp      192.168.12.94:53786   65.55.223.31:40021    established 3h59m18s   
160 SA tcp      192.168.12.94:60650   74.125.143.102:443    established 3h59m58s   
161 SA udp      192.168.12.94:43127   180.191.42.250:9134               1m22s      
162 SA tcp      192.168.12.94:60651   217.20.147.94:443     established 3h59m56s   
163 SA tcp      192.168.12.94:53788   157.56.116.204:12350  established 3h57m19s   
164 SA tcp      192.168.12.94:56838   64.4.47.11:443        established 3h59m19s   
165 SA tcp      192.168.12.94:60635   217.69.139.216:443    established 3h59m39s   

Посмотрим все соединения на 443-й порт

[admin@torg] > /ip firewall connection print where dst-address~":443"         
Flags: S - seen reply, A - assured 
 #    PROTOCOL SRC-ADDRESS           DST-ADDRESS           TCP-STATE   TIMEOUT    
166 SA tcp      192.168.12.4:1087     134.170.25.86:443     established 3h59m54s   
167 SA tcp      192.168.12.94:60650   74.125.143.102:443    established 3h59m55s   
168 SA tcp      192.168.12.94:60651   217.20.147.94:443     established 3h59m53s   
169 SA tcp      192.168.12.94:56838   64.4.47.11:443        established 3h59m46s   
170 SA tcp      192.168.12.94:60635   217.69.139.216:443    established 3h59m51s   
171 SA tcp      192.168.12.6:50417    65.54.184.46:443      established 3h59m34s   

то же самое что и выше - только с интервалом 2 секунды:

[admin@torg] > /ip firewall connection print interval=2 where dst-address~":443"                     
Flags: S - seen reply, A - assured 
 #    PROTOCOL SRC-ADDRESS           DST-ADDRESS           TCP-STATE   TIMEOUT    
173 SA tcp      192.168.12.94:60666   74.125.143.100:443    established 3h58m23s   
181 SA tcp      192.168.12.6:49963    74.125.143.93:443     time-wait   6s         
182 SA tcp      192.168.12.4:1087     134.170.25.86:443     established 3h58m16s   
174 SA tcp      192.168.12.94:60656   217.20.147.94:443     close-wait  7s         
175 SA tcp      192.168.12.94:60664   74.125.143.91:443     established 3h58m21s   
177 SA tcp      192.168.12.94:60650   74.125.143.102:443    established 3h58m52s   
179 SA tcp      192.168.12.94:56838   64.4.47.11:443        established 3h57m14s   
180 SA tcp      192.168.12.94:60635   217.69.139.216:443    established 3h58m48s   
183 SA tcp      192.168.12.6:49986    217.20.147.94:443     established 3h58m41s   
184 SA tcp      192.168.12.6:49965    74.125.143.100:443    time-wait   7s         
185 SA tcp      192.168.12.6:50417    65.54.184.46:443      established 3h57m1s    
188 SA tcp      192.168.12.6:49994    94.100.180.199:443    close-wait  1s         

Посмотрим все активные соединения для 192.168.12.6 Период вывода - каждые 2 секунды:

[admin@torg] > /ip firewall connection print interval=2 where src-address~"168.12.6" and tcp-state~"estab"
Flags: S - seen reply, A - assured 
 #    PROTOCOL SRC-ADDRESS           DST-ADDRESS           TCP-STATE   TIMEOUT    
285 SA tcp      192.168.12.6:50517    217.20.147.94:443     established 3h59m13s   
286 SA tcp      192.168.12.6:50011    217.20.147.94:80      established 3h59m14s   
287 SA tcp      192.168.12.6:55022    94.100.188.169:2042   established 3h59m28s   
288 SA tcp      192.168.12.6:50471    217.20.147.94:80      established 3h59m54s   
289 SA tcp      192.168.12.6:55014    94.100.188.173:2042   established 3h59m47s   
290 SA tcp      192.168.12.6:49209    64.4.23.174:40026     established 3h59m48s   
291 SA tcp      192.168.12.6:49213    91.190.218.55:12350   established 3h52m49s   
292 SA tcp      192.168.12.6:50417    65.54.184.46:443      established 3h59m51s   

Посмотрим только правила с drop

[admin@torg] > /ip firewall filter print where action="drop"
Flags: X - disabled, I - invalid, D - dynamic 
 2   chain=input action=drop protocol=tcp src-address-list=!ssl_allow dst-port=22 
 
 3   chain=input action=drop protocol=tcp src-address-list=ssh_blacklist dst-port=22 
 
12   ;;; default configuration
     chain=input action=drop in-interface=wan 
 
15   ;;; default configuration
     chain=forward action=drop connection-state=invalid 

Посмотрим как часто срабатывают эти правила

[admin@torg] > /ip firewall filter print stats where action="drop"
Flags: X - disabled, I - invalid, D - dynamic 
 #   CHAIN                                            ACTION                            BYTES         PACKETS
 2   input                                            drop                              2 644              59
 3   input                                            drop                            102 672           1 716
12   ;;; default configuration
     input                                            drop                         37 695 146         510 809
15   ;;; default configuration
     forward                                          drop                          2 990 235          74 120