I figured out another reason why linux boxes couldn't connect to me.
I wasn't running keep state on incoming traffic, only outgoing. That
means the keep state didn't have the initial SYN packet from an
outside host making a connection into me. No initial SYN, no window
My current pickup check is not quite sufficient, either. I have to
check that the SYN was observed in both directions. Seeing just one
of the SYNs may not be enough. I'll have to re-read the window scaling
Max, or anyone... do you happen to remember whether window scaling
is negotiated the same for both directions or whether each direction
in a TCP connection can use a different scaling factor?