Wild guess: maybe they look at the increase in IP ids? On a lot of TCP/IP stacks they are not randomized, and can be measured from the outside by simply looking

Wild guess: maybe they look at the increase in IP ids? On a lot of TCP/IP stacks they are not randomized, and can be measured from the outside by simply looking at 2 successive datagrams from the server. So, make up a reasonable estimation of how many IP datagrams are sent in an average visit. Make sure to do the same thing on all frontend servers. Congratulations, you now have a reasonably credible bullshit number to chart.