Counts the number of times TCP connections made a direct transition from LISTEN to SYN-RCVD, meaning connections other hosts initiated toward a listening service on this device. This measures inbound connection attempts to whatever TCP services the gateway itself exposes, such as SSH or the management API, so a rise here without a corresponding legitimate increase in admin activity can indicate scanning or brute-force attempts against the gateway's own management interface. Example: tcpPassiveOpens climbing sharply against the SSH port with no admins reporting new sessions is consistent with an automated login-attempt sweep against the gateway itself.