This Counter64, in Event, counts start-of-flow events that the Lina process sends to Snort whenever it fast-paths a flow without actually sending that flow's packets to Snort, so Snort can still keep track of the connection and report connection events. An admin uses it to understand how many flows Snort is being told about indirectly rather than inspecting directly. A high count here relative to cufwAaicPassedSnortCount would show most flow visibility is coming through these lightweight notification events rather than full packet inspection.