The desc explicitly states this is the IPsec total Inbound ESP SAs, a cumulative count of inbound ESP SAs established since startup, including ones since torn down or rekeyed. Because IKE regularly rekeys SAs, creating a new one and retiring the old, this cumulative counter climbs steadily even when the number of actual peers (cpvCurrEspSAsIn) stays flat; a sudden acceleration in this counter without a matching rise in the current count usually just reflects a shorter rekey interval, not new connections. e.g. cpvTotalEspSAsIn incrementing by roughly one per tunnel every 8 hours if that's the configured Phase 2 rekey interval.