This read-write switch enables or disables the "TCP Offset" Denial-of-Service protection feature, which checks the TCP fragment offset field for invalid or malicious values. Admins enable it to catch attacks that manipulate the fragment offset of TCP segments to cause overlapping or malformed reassembly on a target host, a known DoS vector against poorly hardened TCP/IP stacks. For example, with this enabled, a fragment crafted with an offset of exactly 1, a signature of certain teardrop-style attacks, would be identified and dropped.