The client had an application where latency was critical. Occasionally the latency was enormous. They wanted me to track down why and fix it. I said, oh, of course I can't run tcpdump on the latency-critical production system, I'll have to figure out a different way. They said, that's no problem. It turned out that the org was proud of having few rules and any of several people could log in to production and run anything they wanted at any time. It was politically impossible to stop this.
Schrank