This gauge reports the number of connections, across all protocols, that are currently in the process of being set up but have not yet reached the established state in the firewall's connection table. An admin watches this value because an unusually large number of half-open connections is the classic signature of a SYN-flood-style attack or an overwhelmed backend. For example, if this count climbs steadily without leveling off, the admin would suspect a flood of connection attempts that never complete the handshake, exhausting the connection table.