diff --git a/etc/sysctl.d/tcp_sack.conf b/etc/sysctl.d/tcp_sack.conf
new file mode 100644
index 0000000..6245fff
--- /dev/null
+++ b/etc/sysctl.d/tcp_sack.conf
@@ -0,0 +1,2 @@
+# Disables SACK as it is commonly exploited and likely not needed.
+net.ipv4.tcp_sack=0