This read-only counter tallies packets which exceeded this rate limit. Despite the somewhat neutral name, filtered here doesn't necessarily mean dropped: depending on ccarConfigExceedAction it might mean dropped, or it might mean re-marked and still delivered, so this counter climbing is evidence of traffic exceeding the configured rate, but confirming whether that traffic was actually lost requires also checking the exceed action. A business-hours spike in this counter on an entry whose exceed action merely re-marks precedence, rather than dropping, means users experienced demoted priority during that spike, not necessarily any packet loss.