How to identify bandwidth top users? One Arm Sniffer mode, more than 9Gb/s

Using one-arm sniffer mode we put 3 to 9Gb/s traffic on a FG1500D and we applied default profiles.

We have all session logs, but what we cannot identify who is using the bandwidth, as there is no individual connection that uses that bandwidth or it is not reported that way.

Maybe also the one-arm sniffer has an issue that it does not process sizes correctly, so it might be that received/sent do not contain correct values?