This value sets, from 10 to 1000, the packet rate threshold that triggers blacklisting: if a source's average packet rate during the block-duration window exceeds this threshold, the system blacklists that source and raises an alarm, and removes it and clears the alarm once the rate drops back below the threshold. Admins tune it to define what packet rate counts as an attack versus normal traffic from a legitimate subscriber. Setting it lower would make the anti-attack feature more sensitive, blacklisting sources at a lower traffic rate than a higher threshold would.