This Counter64, in Protocol Data Units, counts application PDUs that attempted to advertise illegal port ranges for secondary connections, such as a passive FTP server advertising a disallowed data-connection port range, and requires deep packet inspection to be implemented. An admin uses this to catch applications trying to open secondary connections outside the ports policy permits, a classic evasion pattern for protocols like FTP that negotiate ports dynamically. A rising count here tied to FTP traffic would suggest an FTP server or client is misbehaving or attempting to bypass port restrictions.