The desc explicitly states this is the connection rate, per second, passing through the FireWall-1 Module. This is a more sensitive early-warning metric than the raw connection total, because a sudden rate spike, even without exhausting the connection table, is the signature of a SYN flood or a fast port scan. e.g. connection rate jumping from a steady 200 per second to 15,000 per second would indicate an active flood attack rather than normal traffic growth.