The only way I think you'll be able to get that information is by configuring logging for the inbound traffic on the MX and then use the Syslog information to look at the flows. It's likely to be a huge amount of information that you'll need to analyze though, you'll probably need another tool to assist you in making sense of it.   Here's some information that might be of some to see if it will provide what you are looking for, https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Server_Overview_and_Configuration  ... View more