It'll never be zero. And the graph will scale to make anything look significant. Your node has to respond to ARP requests, and do DHCP, and it could be pinged or something, or get other traffic which meets with a port-closed response, but still counts as traffic.