This counts VRRP packets received with an IP TTL (for IPv4) or Hop Limit (for IPv6) value other than the mandated 255, which VRRP requires specifically as a security measure to ensure advertisements only came from a directly-connected router on the same link, never having traversed a router hop. A nonzero value here is a meaningful security signal, since a legitimate directly-connected VRRP peer will always send TTL 255, meaning packets with a lower TTL are either from a misconfigured multi-hop source or, more concerningly, a potential off-link spoofing attempt. This counter climbing without a corresponding legitimate explanation is worth escalating as a possible VRRP spoofing attempt rather than dismissing as routine noise.