Do you mean mikrotik BW-Test?
A possible way would be L7…
BW-Test uses UDP starting from port 2000 so you could just look at connection tracking table.
However…
Instead, they compensate for the BW shortage by using BW test (Dirty Trick! >
> ) sometimes at peak hours from multiple strange routers on their network so he can still see the amount of BW agreed on at his up-link interface, but actually he notices very slow internet speed internally similar to what happens if he has consumed the whole BW. His agreement with the ISP states that he should provide the ISP Support with an account in order to trouble shoot once a customer (my friend in this case) reports an issue.
Fellow forum users graciously made available publicly accesible BW-Test servers that you can use to truly test BW, there are also more specifics regarding how to firewall etc BW-Test so it may help you having a look at the whole thread.
I would advice your customer to start looking for an alternate ISP… and also not to sign any fishy agreements like the present one, in fact it should have scared him away of that ISP without even contracting anything.