This read-only field records what SYN protection mode a port was in during its most recently detected attack event, distinct from the port's current live state. Admins care because it preserves a historical record of whether mitigation actually engaged during the last incident, even after the port has since returned to normal. For example, a port that now shows normal mode may still show it was in Block mode during last week's attack, confirming the protection worked as intended at the time.