Interesting. I agreed with azstunt's detection method but did not think too hard about it as it felt right. Conversely I find it hard to believe there are no TX packets - what about email checks, weather updates or whatever..
For a bulk download relativey tiny ACKS would be sent, ie tiny sample, but would have lots of rx, ie big sample. My *idle* connection does about 2k per minute - there /must/ be tx in there but I've not checked what that traffic is.