One potential explanation depending on your kernel version - traditional SYN cookies cannot encode TCP extensions, including window scaling, which will (nearly)

One potential explanation depending on your kernel version - traditional SYN cookies cannot encode TCP extensions, including window scaling, which will (nearly) always result in slower transfers. Newer kernels (The Googles aren't giving me a kernel version, unfortunately) use the TCP timestamp option in addition to the sequence to encode a limited number of TCP options, including WS. More info: http://www.inesc-id.pt/pt/indicadores/Ficheiros/165.pdf http://www.inesc-id.pt/pt/indicadores/Ficheiros/165.pdf