This read-write value sets the minimum allowed TCP header size, in bytes, that the switch will accept on the first fragment of a TCP packet. It only takes effect when agentSwitchDenialOfServiceFirstFragMode is enabled, letting admins tune the threshold used to catch suspiciously undersized first-fragment TCP headers associated with fragmentation-based attacks. For example, leaving this at its default of 20 bytes, the minimum valid TCP header length, means any first fragment with a smaller declared header gets flagged as an attack attempt.