A client wants a system so that they can monitor connection queues on network equipment for too many half-open connections, as well as look for bandwidth consumption from the same types of…

Smurf attacks use ICMP broadcast amplification to flood a target with reflected traffic, and do not involve TCP connection queues or half-open connection states.

Passive scans involve silently listening to network traffic without sending packets, producing no half-open connections or anomalous connection-queue activity.

CPUHog attacks exploit the accumulation of half-open or incomplete connections to consume CPU cycles and bandwidth on network devices, causing resource exhaustion. Monitoring connection queues for abnormal half-open states alongside bandwidth spikes from the same connection types is the detection mechanism specifically designed to identify this class of attack before it degrades or disables equipment.

SYN floods do generate half-open connections, but within the context of this question the monitoring system described targets the broader CPUHog category of resource exhaustion rather than the SYN-specific transport-layer vector.