How to locate leaking packets in mange and in qos/queue

I am trying to QOS my traffic. I marked packets in mangle with p1 through p8 packet marks then used the marks to create 8 simple queues, p1 => prio 1/1, … p8 => prio 8/8.

The last rule in mangle is catch all, and I am seeing packets comming to that rule even thought I thought I had taken care of all traffic in previous mangle rules.
How do I determine what packets are hitting that rule ? I dont see “torch” on the mangle rule.

Similar question regarding qos/queues,
How do I ensure that all packets are marked and I dont have unmarked packets entering qos/queues ?
/queue simple
add max-limit=11M/600k name=P1 packet-marks=p1 priority=1/1 target=“”
add max-limit=11M/600k name=P2 packet-marks=p2 priority=2/2 target=“”
add max-limit=11M/600k name=P3 packet-marks=p3 priority=3/3 target=“”
add max-limit=11M/600k name=P4 packet-marks=p4 priority=4/4 target=“”
add max-limit=11M/600k name=P5 packet-marks=p5 priority=5/5 target=“”
add max-limit=11M/600k name=P6 packet-marks=p6 priority=6/6 target=“”
add max-limit=11M/600k name=P7 packet-marks=p7 priority=7/7 target=“”
add max-limit=11M/600k name=P8 packet-marks=p8 target=“”

/ip firewall mangle
add action=mark-packet chain=output comment=“router OUT” new-packet-mark=p1 passthrough=no
add action=mark-packet chain=input comment="router IN " new-packet-mark=p1 passthrough=no
add action=mark-connection chain=prerouting comment=“dns query via UDP - NEW” connection-state=new dst-port=53 new-connection-mark=dns
protocol=udp
add action=mark-packet chain=prerouting comment=“dns query via UDP” connection-mark=dns new-packet-mark=p1 passthrough=no
add action=mark-connection chain=prerouting comment=“icmp - NEW” connection-state=new new-connection-mark=icmp protocol=icmp
add action=mark-packet chain=prerouting comment=icmp connection-mark=icmp new-packet-mark=p1 passthrough=no
add action=mark-connection chain=prerouting comment=“dziennik librus - NEW” connection-state=new dst-address=46.248.183.10
new-connection-mark=librus
add action=mark-packet chain=prerouting comment=“dziennik librus” connection-mark=librus new-packet-mark=p2 passthrough=no
add action=mark-connection chain=prerouting comment=“bank - NEW” connection-state=new dst-address=193.111.166.209 new-connection-mark=
bank
add action=mark-packet chain=prerouting comment=bank connection-mark=bank new-packet-mark=p2 passthrough=no
add action=mark-connection chain=prerouting comment=“admin lan NEW” connection-state=new in-interface=admin new-connection-mark=admin-lan
add action=mark-packet chain=prerouting comment=“admin lan” connection-mark=admin-lan new-packet-mark=p4 passthrough=no
add action=mark-connection chain=prerouting comment=“szkola lan NEW” connection-state=new in-interface=szkola new-connection-mark=
szkola-lan
add action=mark-packet chain=prerouting comment=“internat lan” connection-mark=szkola-lan new-packet-mark=p5 passthrough=no
add action=mark-connection chain=prerouting comment=“internat lan NEW” connection-state=new in-interface=internat new-connection-mark=
internat-lan
add action=mark-packet chain=prerouting comment=“szkola lan” connection-mark=internat-lan new-packet-mark=p7 passthrough=no
add action=mark-packet chain=prerouting new-packet-mark=p8 passthrough=no

If I remember correctly, the marks show up in the firewall logs. So you just have to add a logging rule before your catch-all rule and you will find them in the logs.
Just watch with “/log print follow” and see what comes through.

Zap.