heavy connection Elephant Flows on VSX use tool connstat - sk85780

[RoyA]

hello Checkmates

yesterday my end customer complain on have connection flow 

i use some of tool to try investigation the traffic that make that Elephant flow with some success to rich the problem i have to tell 

my question is when i use 

• connstat - sk85780

i see  a lot of hits on rule 604 and i want to recommend to my customer to move that rule to lower number on the access rules 

to ‏reduce cpu load 

now how can i be sure that rule is been accelerated or not by use these tool  

and how can i know that rule belong to the relevant VS * i use these commend from the VS-DMZ  tcpdump -i  any -w /var/log/capture.cap

thank you all!