Standard TCP requires a three-way handshake (SYN, SYN-ACK, ACK) before either side can send application data. That's one full round-trip time (RTT) of latency before your HTTP GET even leaves the wire. For a mobile client to a data center 80ms away, you've paid 80ms before the server sees a byte of the request.

TCP Fast Open (TFO, RFC 7413) lets a client piggyback data in the SYN packet on repeat connections. The trick is a cryptographic cookie that proves the client owns its source address, preventing amplification attacks.

The flow:

• First connection: Client sends SYN with an empty TCP Fast Open Cookie Request option. Server generates a cookie (typically AES-encrypting the client's IP with a server-side key) and returns it in the SYN-ACK. Normal handshake completes.
• Subsequent connections: Client sends SYN with the cached cookie plus up to ~1460 bytes of application data. Server validates the cookie, delivers the data to the accepting socket before the ACK completes, and can even send response data in its SYN-ACK.

Enabling it:

• Kernel: sysctl net.ipv4.tcp_fastopen=3 (bit 0 = client, bit 1 = server).
• Server socket: setsockopt(fd, SOL_TCP, TCP_FASTOPEN, &qlen, sizeof(qlen)) before listen().
• Client: use sendto() with MSG_FASTOPEN instead of connect()+send(), or set TCP_FASTOPEN_CONNECT on the socket and let the kernel defer the SYN until the first write().

Real-world example: Google measured TFO cutting page-load times by 4–41% for Chrome-to-Google-frontend connections, with larger gains on high-latency mobile networks. The savings scale directly with RTT — every connection saves exactly one round trip.

Rule of thumb: TFO saves one RTT per repeat connection. If your service does 10 short-lived HTTPS connections to a 100ms-away server, TFO shaves ~1 second off total latency (though TLS 1.3 0-RTT stacks on top and matters more for encrypted traffic).

Gotchas:

• Middleboxes strip TFO options. Around 5–10% of paths on the public internet drop the option, forcing fallback to a normal handshake. Linux tracks this per-destination in the TFO blackhole cache.
• Idempotency required. The kernel may retransmit the SYN+data if the SYN-ACK is lost, meaning the server can process the data twice. Only use with idempotent requests (GET, not POST-that-charges-a-credit-card).
• Cookies rotate. Server-side key changes (or a reboot) invalidate cached cookies, silently degrading to a normal handshake for one connection.