The traffic in flow monitor for all IPs is shown from the firewall perspective. In other words the "Bytes In" for an IP are the bytes coming in to astaro and "Bytes out" are the bytes going out of astaro. It doesn't matter if you click on incoming or outgoing connection graph in webadmin.
Maybe its by design, but I think it will be more intuitive if the traffic in front of an IP shows what is coming in to that IP and what that IP is sending out. In the screenshot attached, I am downloading windows7 from microsoft. The traffic graphs show 1.3M coming in from wan and 1.3M going to LAN. If you look at the clients using the bandwidth, 192.168.0.10 seems to be sending out more packets/bytes on https connection than its receiving which is not the case obviously.
