Please note, the OP asks for the ways that can be accepted as a legal means.
I would set up some host on the internet with public IP, and set the pack of speedtests (for instance using iperf) using different TCP/UDP ports. If the tests will show some significant differences on the ports used by P2P, than for ports 80/443 for example, this could be accepted as a proof, I suppose.
Please note, the OP asks for the ways that can be accepted as a legal means. I would set up some host on the internet with public IP, and set the pack of speedtests (for instance using iperf) using different TCP/UDP ports. If the tests will show some significant differences on the ports used by P2P, than for ports 80/443 for example, this could be accepted as a proof, I suppose.
ssh root@10.0.0.245 "tcpdump -l -n -s 0 -w -not port 22" wireshark-i -