Could we have a packet counting device external to the computer and compare with what the OS reports? Steve Gibson from security now mentioned "blue pill" back

Could we have a packet counting device external to the computer and compare with what the OS reports? Steve Gibson from security now mentioned "blue pill" back in 2008 or so saying detection of that type of malware could only be verified using a stop watch and a known compute cycle. Way above my head but fun to think about.