Looking for a way to determine what traffic is actually allowed

Greetings-

Is there a definitive way via logging to determine what traffic is *actually* allowed *through* the firewall? I see tons of 'Connection opened' log entries, but it's obvious that the vast majority of those don't correspond to -actual- external connections to my internal machines. It seems exceedingly difficult to determine just what my firewall is actually doing.