If you don't trust the host, you could always put a hub (if you have one lying around) between the server's NIC and the server's network port and then plug a laptop in with Wireshark and sniff traffic. Either that or if the server's plugged into a managed switch besides all but the lowest end model, you should be able to turn on port mirroring and sniff traffic that way.
But it's probably easier to leave the NIC on the server unplugged for a period of time that you feel would be long enough to tell whether or not it's being used at all.
Sounds like a really non-standard (and potentially insecure) way of permitting (I'm assuming) external users to tunnel into your LAN. Would think that given the age of the server and the seeing as there are much better methods to achieve the same thing, this is probably something long retired.
Again, lots of assumptions, but without having proper documentation or an accurate picture of the server's role, there's not much else you can do.