The desc explicitly states this is the count of decrypted packets, the cumulative total of inbound packets decrypted from VPN peers. Comparing the growth rates of cpvEncPackets and cpvDecPackets shows whether VPN traffic is roughly symmetric, as you'd expect for regular bidirectional application traffic, or heavily skewed in one direction, which can indicate a one-way routing problem or a specific bulk transfer. e.g. cpvDecPackets running at roughly half the rate of cpvEncPackets would suggest more outbound than inbound VPN traffic, consistent with a branch office mostly sending data to a central site.