There was definitely packet loss and retransmission due to it, so the packets were not the same on both sides of the router. But this doesn&#x27;t explain why TCP connections would be stuck with small windows for their entire lifetime after the burst is over? I was actually also able to reproduce the problem in one of our other DCs by reducing somaxconn to a very low value (e.g. 2 IIRC).<p>Window scaling was definitely on my radar, but IIRC the Linux SYN cookie implementation is supposed to encode if this TCP option is set in the initial SYN as well, so I don&#x27;t see how this would explain thing unless the implementation is broken. I&#x27;m not sure if I understand what you&#x27;re saying about SYN+ACKs not being retransmitted, I think they should be if they get lost, it&#x27;s only the final ACK from the client that doesn&#x27;t get retransmitted if its lost, but that would cause different symptoms.