You may prefer looking at "netstat -tdp". It will show the protocols, domain names and the program (such as firefox) that the traffic is for.
If you use "netstat -tdpc", the output will be continuous. Did you look at the netstat output? It lists the destination address, local address and the ports. As suggested you could run
Since you are interested in how networking works, learning these tools is probably where you want to start. There is an excellent book "Network Administrators Guide" on the www.tldp.org
Also, this site http://www.grc.com/nat/nat.htm
explains how NAT routers work including having two NAT routers in series.
NAT doesn't fudge ports. It records the source IP, destination IP and port, then then changes the outgoing packets source IP to that of your ISPs assigned address. While the source IP address is mangled, the destination IP address isn't changed. That is how you can have two NAT routers in series.
The IP address for both local computers is the same
Be sure to study what a TCP header looks like. It has source and destination IP addresses and ports.