I wish I could help more with an application to identify this stuff for you but I'm used to being a plumber. A packet capture let's you see what is really going on. Install it then do a packet capture and leave it on for your hour. Then go to CONVERSATIONS and you'll see what is talking to what and how much.
4MB in an hour doesn't really sound an alarm IMHO, it's high, but not totally unusual.