It seems to me that the log won't necessarily be very large. It really
depends on how the connection is being used, doesn't it? An hours
worth of log from a dialup connection couldn't be very large, for
example.
Of course, on a broadband connection with lots of websites being
visited or files being downloaded, the log would become quite large
fairly quickly.
It would depend on how much information is logged. Logging the
contents
of packets during a web surfing session would generate
a large file. But, all I'm interested in is a source and destination
IP for what has gone in and out of my system, along with possibly what
port was used, what process ID was using the port, a timestamp, and a
packet count.