I believe SYN cookies affect the TCP window because the kernel can&#x27;t actually guarantee it has enough RAM to allocate a reasonably sized buffer when it sends the SYN-ACK, as by design it doesn&#x27;t allocate any memory until after the ACK is returned from the other side.