This counts TCP packets the gateway's Sequence Verifier rejected because their ACK number fell outside the expected window for an established connection. This is a specific TCP session-hijacking or spoofing indicator, since a legitimate stack does not send ACKs outside the negotiated window, so a spike here on a particular connection suggests someone is attempting to inject or hijack a TCP session rather than a routine network glitch. For example, a burst of invalid-ACK detections against one internal server's active sessions coinciding with a suspected session-hijacking attempt from a compromised host on the same segment.