The default Creation of forwarding/redirect rule alert policy will be triggered when end-users create rule to forward or redirect mail
ss is another utility to investigate sockets. It can display more TCP and state information than other tools.
Practice until you can't make it wrong.