Very interesting point. From my point of view I would monitor actual traffic (i.e. using Flow monitoring) and at the same time would keep some record, similar to what planglois mentioned, not necessarily in Excel, and then on regular basis comparing the two.
On another note SolarWinds offers now Firewall Security Manager (FSM) which has ability to evaluate and pin point some of such issues.