How to track monitor with mikrotik or other programs

Hi i have a wisp and im using mikrotik rb450 g I have made a few rules to many to go into. And i have marked some traffic as other to to slow down torrents i also block the word torrent as i prohibit it on my wisp.
Now the question is i have one person whos traffic marked as other is always in the red for hours.
I have checked his ip. And the traffic maked as other is tcp not udp and its not maked as any p2p, Is there any way to see what it is that he is downloading to find out what he is doing. I would like to know if any thing has got past to make my network more secure agenst my rules.

Hope this makes sence.

Thanks

You can torch to see what connections he is actively using… and then try to figure out what those IP addresses are associated with. Blocking the word “torrent” won’t actually block torrents, by the way. Also, the Mikrotik built-in P2P option doesn’t actually catch any modern P2P connections nowdays.

If you want to block P2P, it is very difficult… it requires many many rules, but there are a few good posts here in the forum that help you to reduce it considerably.