After a couple of dropped link events, the counters look as follows:
(See the replayfailed and rxL2AuthfailPkts / Notvalid pkts)
#show cts macsec counters interface te1/0/1
CTS Security Statistic Counters:
rxL2UntaggedPkts = 960
rxL2NotagPkts = 0
rxL2SCMissPkts = 0
rxL2CTRLPkts = 0
rxL3CTRLPkts = 0
rxL3UnknownSAPkts = 0
rxL2BadTagPkts = 0
txL2UntaggedPkts = 0
txL2CtrlPkts = 0
txL3CtrlPkts = 0
txL3UnknownSA = 0
SA Index : 1
rxL2ReplayfailPkts = 57460
rxL2AuthfailPkts = 777
rxL2PktsOK = 5618455
rxL3AuthCheckFail = 0
rxL3ReplayCheckFail = 0
rxL2SAMissPkts = 0
rxL3EspGcm_Pkts = 0
rxL3InverseCheckfail = 0
txL3Protected = 0
txL2Protected = 4106
GENERIC Counters:
CRCAlignErrors = 0
UndersizedPkts = 0
OversizedPkts = 0
FragmentPkts = 0
Jabbers = 0
Collisions = 0
InErrors = 0
OutErrors = 0
ifInDiscards = 0
ifInUnknownProtos = 0
ifOutDiscards = 0
dot1dDelayExceededDiscards = 0
txCRC = 0
linkChange = 0
#show macsec interface te1/0/1
MACsec is enabled
Replay protect : enabled
Replay window : 0
Include SCI : yes
Use ES Enable : no
Use SCB Enable : no
Admin Pt2Pt MAC : forceTrue(1)
Pt2Pt MAC Operational : no
Cipher : GCM-AES-128
Confidentiality Offset : 0
Capabilities
Identifier :
Name :
ICV length : 16
Data length change supported: yes
Max. Rx SA : 8
Max. Tx SA : 8
Max. Rx SC : 4
Max. Tx SC : 4
Validate Frames : strict
PN threshold notification support : Yes
Ciphers supported : GCM-AES-128
Transmit Secure Channels
SCI : ****************
SC state : inUse(1)
Elapsed time : 23:56:13
Start time : 7w0d
Current AN: 0
Previous AN: 1
Next PN: 1069
SA State: inUse(1)
Confidentiality : no
SAK Unchanged : no
SA Create time : 5d13h
SA Start time : 7w0d
SC Statistics
Auth-only Pkts : 0
Auth-only Bytes : 0
Encrypt Pkts : 6772436
Encrypt Bytes : 0
SA Statistics
Auth-only Pkts : 0
Encrypt Pkts : 1068
Port Statistics
Receive Secure Channels
SCI : ****************
SC state : inUse(1)
Elapsed time : 23:56:13
Start time : 7w0d
Current AN: 0
Previous AN: 1
Next PN: 1015
RX SA Count: 0
SA State: inUse(1)
SAK Unchanged : no
SA Create time : 5d13h
SA Start time : 7w0d
SC Statistics
Notvalid pkts 92906
Invalid pkts 0
Valid pkts 1878968117
Valid bytes 0
Late pkts 57698
Uncheck pkts 0
Delay pkts 240
UnusedSA pkts 0
NousingSA pkts 0
Decrypt bytes 0
SA Statistics
Notvalid pkts 0
Invalid pkts 0
Valid pkts 5257623
UnusedSA pkts 0
NousingSA pkts 0
#show interfaces te1/0/1
TenGigabitEthernet1/0/1 is up, line protocol is up (connected)
Hardware is Ten Gigabit Ethernet, address is ********
MTU 1550 bytes, BW 10000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive not set
Full-duplex, 10Gb/s, link type is auto, media type is SFP-10GBase-LR
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:04, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 21000 bits/sec, 8 packets/sec
5 minute output rate 8000 bits/sec, 11 packets/sec
342320448 packets input, 382844331049 bytes, 0 no buffer
Received 1003179 broadcasts (986704 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 986704 multicast, 0 pause input
0 input packets with dribble condition detected
225839613 packets output, 166735018695 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
