This gauge reports the memory, in KBytes, occupied by the structures tracking all half-open connections -- those still in the process of being established. An admin watches this specifically because a memory spike concentrated here, rather than in active connection memory, points to a flood of incomplete connection attempts rather than legitimate established traffic. For example, a sudden rise in half-open connection memory usage alongside a rising cufwConnGlobalNumHalfOpen count would confirm a SYN-flood-style event is consuming firewall resources.