I was shocked when some of users have bandwidth more than their shape rule and all of them had connections with src port 1194 udp which dst port is empty.
the sum of other connections correctly equals to shape rule but user can go over shape as far as OpenVPN connection transfer !!
and for those friends which will suggest first things i should say that i did not excluded or mangled or filtered or … the openvpn port and everything is normal . i think there is a problem in ROS !