A large image upload is more probable to generate that level of traffic. 15 SSH session would mean an average of 200pps per session, and they simply mention that the session remain connected, if there are no inputs in them they have 0pps and even a full config push would probably not require 200 packets total. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6- x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX- OS_Security_Configuration_Guide/b_Cisco_Nexus_9000_Series_NX- OS_Security_Configuration_Guide_chapter_010001.html class copp-system-p-class-management set cos 2 police cir 3000 pps bc 32 packets conform transmit violate drop