Sets, in minutes, how long a user stays classified as suspect — during which their packets are dropped or TCP-redirected — before SSG re-runs the whole TAL identification procedure for them from scratch on their next traffic. This is the recovery window for a subscriber who got flagged suspect: too short a timeout lets a still-misbehaving device retry too quickly and immediately get re-flagged in a tight loop, while too long a timeout leaves a now-legitimate subscriber blocked or redirected far longer than necessary. A subscriber whose device briefly triggered suspect classification due to a transient DHCP or ARP glitch would, with cssgTalSuspectUserTimeout set to 10 minutes, automatically get a fresh identification attempt roughly ten minutes later rather than staying flagged indefinitely.