Use darkstat to record external links on port 22

-L the switch defines a local network in the form of a "Network/mask" syntax, and all the communication (inbound or outbound) of this network is displayed in a graphical form. -F option allows the user to filter data packets:

The following is a reference clip:
Darkstat-I eth0-l 192.168.0.0/255.255.255.0-F "port 22"

In this example, We Are filtering network packets running the SSH protocol on port 22, so you can define which machines are using this protocol. Its filter syntax is based on tcpdump. You can refer to its documentation for more information.