This counts SCTP packets that arrived correctly formed and with a valid checksum but that this device couldn't match to any known association - commonly caused by stray retransmissions after an association already closed, or by port scanning/spoofed traffic. A steady low background rate is generally benign (late retransmits after a normal teardown), but a sudden spike is worth investigating as a possible SCTP-targeted probing or DoS attempt against the device. Seeing this counter jump right after a large batch of associations closed (visible via cSctpShutdowns or cSctpAborteds) is the benign explanation - stragglers arriving after the fact rather than an attack.