The summarize data: the first column is total calls for code 036 and the seconds column is port number
$ cat *tran.stat |cut -d! -f 7,6 |sort |grep -i 036 |cut -d! -f 1 |sort |uniq -c
13 20
1344 21
1340 22
1333 23
1357 24
1323 25
1325 26
1336 27
1313 28
1330 29
1310 30
28 50
1339 51
1334 52
1350 53
1340 54
1317 55
1335 56
1324 57
1308 58
1333 59
1339 60
We can see the ports on 21-30 and 51-60 is ending excessive number of code 36 (operator intercept).
N:21:414:1::#O:10:1:1-1-20-1-21
N:30:423:1::#O:10:1:1-1-20-1-30
N:51:446:1::#O:10:1:1-1-20-2-21
N:60:455:1::#O:10:1:1-1-20-2-30