This read-write switch enables or disables the "TCP Syn" Denial-of-Service protection feature, which filters TCP SYN packets that also carry a source port in the well-known or reserved range. Admins enable it to catch SYN-flood-style attack packets crafted with implausible or forged low source ports, a signature used to distinguish malicious SYN traffic from normal client connection attempts. For example, a TCP SYN packet arriving with a spoofed source port of 20 (FTP-data) rather than a normal ephemeral port would be flagged and dropped when this feature is enabled.