Thanks for your tips, but CNTop button shows only connexions sending/receiving enough data, is refreshed every seconds so it’s not possible to monitor active connexions, and, for example, a classical SSH connexion will never appear here.
Regarding the firewall logs, indeed the information can be retrieved… but you will need another tool to analyse the logs… it is clearly impossible to monitor active connexions reading the logs.