SYN-ACK which does not get retransmitted, advertises a zero window and does not have options looks like some implementation of SYN cookies. A nice (and useful in some cases) hack but a violation of the TCP spec, which is why it is disabled by default in most places that implement it.
