I have been wondering about if TCP intercetp should be disabled or not, according to the "Secure IOS template" at http://www.cymru.com/Documents/secure-ios-template.html he says it is best to leave it disabled in general and especially with blackhole...