The “show info” isn’t really helpful if you’re looking for something or someone abusing bandwidth. The best practice would be to create a firewall rule/chain using the “connections limit” parameter to log bandwidth abusers.
Then simply send alerts/logs to a syslog server for real time and history tracking.