Just to say that it's typically when a 'dial on demand' connection is configured, something on the LAN side of the router (Windows update, Internet time synchronisation, malware, etc.) might start generating traffic. To be on the safe side, just unplug when not in use. Best firewall I know of.