Just as an update and for future reference, I solved this writing a custom script (my first script);
/ip firewall filter add action=passthrough chain=monitor dst-address=192.168.10.2
/ip firewall filter add action=passthrough chain=monitor dst-address=192.168.10.3
/ip firewall filter add action=passthrough chain=monitor dst-address=192.168.10.4
(...)
/ip firewall filter add action=passthrough chain=monitor dst-address=192.168.10.249
Wrote the monitoring script (schedule every 00:30)
:global subnet "192.168.10."
:global maxbytes 305044184
:for i from=2 to 249 do={
:delay 2
:local bytes [/ip firewall filter get [find chain=monitor dst-address="$subnet$i"] bytes];
:if ( $bytes > $maxbytes ) do={
:local count 0
foreach X in=[ /ip firewall mangle find where src-address="$subnet$i" ] do={:set count 1 }
:if ( count = 0 ) do={
/ip firewall mangle add action=mark-routing chain=high-usage-users comment="Regra Automatica" new-routing-mark=adsl passthrough=no src-address="$subnet$i" }
}
}
And the cleanup script schedule to run once a day:
/ip firewall filter reset-counters [find chain=monitor]
/ip firewall mangle remove [find chain=high-usage-users ]