This read-only Counter64 counts received IGMP packets where the Layer 2 destination MAC and the Layer 3 multicast group address don't correspond as expected. This is a classic indicator of spoofed or malformed multicast traffic, so admins correlate a nonzero count with a security review of the source port rather than dismissing it as noise; because it is drawn from this table's currently-accumulating, short-interval bin, it reflects only the last few minutes of activity, so it's the value to watch for a fast-forming problem rather than a long-term trend. On a metro aggregation uplink carrying several video EVCs, a count of 1,613 over the last 15 minutes is the kind of number an admin would trend against the join/leave rate on the same port to judge whether it's normal channel-surfing or an anomaly worth a closer look.