This is the configured MTU-size threshold below which the gateway treats an advertised path MTU as suspicious and flags it as a possible evasion attempt. An admin tunes this value based on the network's realistic minimum MTU, accounting for VPN or tunnel overhead, so the small-PMTU protection catches real evasion attempts without false-positiving on legitimate low-MTU tunneled traffic. For example, setting this to 100 bytes so it doesn't falsely flag a legitimate GRE-tunneled path with a reduced but still reasonable MTU of 1400.