This read-only Counter64 counts received IGMP packets where the Layer 2 destination MAC and the Layer 3 multicast group address don't correspond as expected. This is a classic indicator of spoofed or malformed multicast traffic, so admins correlate a nonzero count with a security review of the source port rather than dismissing it as noise; because it is drawn from the most recently completed 24-hour bin, frozen once the day rolled over, it is frozen and safe to use for day-over-day comparison, since no further traffic will ever be added to it. On a residential VLAN used for multicast video delivery, a count of 2,928 over the last completed collection window is the kind of number an admin would trend against the join/leave rate on the same port to judge whether it's normal channel-surfing or an anomaly worth a closer look.