This read-only Counter64 counts queries discarded because they carried a source IP address of 0.0.0.0. A 0.0.0.0 source is normally only valid for a router's very first query before it has an address, so a steady count of these on an established link usually flags a misbehaving or spoofing querier rather than normal startup behavior; because it is drawn from the current, still-open 24-hour bin for today, the number keeps climbing until midnight rollover, so it should be read as "so far today" rather than a finished daily total. On a metro aggregation uplink carrying several video EVCs, a count of 2,173 over today so far is the kind of number an admin would trend against the join/leave rate on the same port to judge whether it's normal channel-surfing or an anomaly worth a closer look.