The desc explicitly states this is the count of IPsec ESP decrypted bytes, the byte-level counterpart to cpvIpsecEspDecPkts and the inbound mirror of cpvIpsecEspEncBytes. The same average-packet-size and symmetry checks apply here as with the packet-count mirror pair; a byte-rate mismatch between encrypted and decrypted traffic on the same tunnel is a stronger, more precise version of the same one-directional-traffic symptom the packet counters would also show. e.g. cpvIpsecEspDecBytes running noticeably lower than cpvIpsecEspEncBytes would indicate this gateway is sending substantially more data into a tunnel than it's receiving back.