why in a trunk only one interface have almost all traffic in big-ip ltm

This is controlled by a source-destination hash so if the traffic is generally from the same source and destination then it will use a single link.

Here is some more info on how the Hash can work, From: https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos_management_guide_10_1/tmos_trunks.html Specifying the frame distribution hash When frames are transmitted on a trunk, they are distributed across the working member links. The distribution function ensures that the frames belonging to a particular conversation are neither mis-ordered nor duplicated at the receiving end. The BIG-IP system distributes frames by calculating a hash value based on the source and destination addresses (or the destination address only) carried in the frame, and associating the hash value with a link. All frames with a particular hash value are transmitted on the same link, thereby maintaining frame order. Thus, the system uses the resulting hash to determine which interface to use for forwarding traffic. The Frame Distribution Hash setting specifies the basis for the hash that the system uses as the frame distribution algorithm. The default value is Source/Destination IP address. Possible values for this setting are:

Source/Destination MAC address This value specifies that the system bases the hash on the combined MAC addresses of the source and the destination.

Destination MAC address This value specifies that the system bases the hash on the MAC address of the destination.

Source/Destination IP address This value specifies that the system bases the hash on the combined IP addresses of the source and the destination.