Hmm I thought we’re supposed to only count traffic for terminated (“completed”) connections:
Maybe it’s buggy?