A long time ago at a previous job, I had to report monthly on metrics relating to firewall deny events. I got an angry phone call to my desk phone from an executive, demanding to know why firewall deny events were down 10% in the previous month. Their tone changed when I mentioned the month in question was February, which conveniently is about 10% shorter than January.
In what amounts to tallying up dropped icmp packets.