First, please review the wiki article found here.
Untangle counts the number of unique IP addresses coming through the device during a 24 hour period (midnight to midnight).
Unique IP addresses are discovered by reviewing the Hosts table and by checking the Last Session Time field.
Bypassed hosts will have a Last Session Time set as "none".
Non-bypassed hosts will show a date/time stamp for Last Session Time.
So to be counted against the license for an Untangle NG Firewall, a device has to show up in the host table and have a date/time stamp in the Last Session Time field.