p2p traffic

Hello All! How to count donkey traffic?! To enter with HighID - it’s clear, its ports are specifically indicated in the config... But with LowID everything is much more complicated. Although, the outgoing port is indicated in the dock, but really For some reason, almost half of the outgoing sessions come from other ports. At the same time, not everyone has a remote port of 4662 or 4672... And how to create a rule for this in tmeter? Best regards, Evgeniy.