This can also be used to implement connection acceleration with no kernel-side hackery involved, by having userspace maintain a pool of half-open connections by spamming SYNs at a target, recording ACKs, then constructing a regular socket via TCP_REPAIR when a connection is actually required. That allows omitting one roundtrip from a typical TCP connection setup, which may be substantial in a variety of scenarios.

The technique sounds messy but actually it involves not much work when the target is Linux, a single half-open SYN is good for 63 seconds with the default sysctl settings, which seem to be used with almost every Internet service you might want to reach (including e.g. Google)

I was playing with this during an interview last year and intended to write it up, but never got around to it. The technique seems to work as intended, I made a little prototype reverse proxy for it in Python using a temporary listening socket with a drop-all SO_ATTACH_FILTER to allocate a port number and prevent Linux on the initiator side from responding with a RST to ACKs for a half-open connection it knows nothing about