> Simply stripping options won't work, because (for instance) the window
> scale option *changes the meaning* of some of the other fields in the
> header..

ultimately it amounts to NAT with full TCP reconstitution.

> It also would require in-flight modifications to the tcp checksum,
> causing it to no longer be an end-to-end checksum..

according to www.packeteer.com we would not be the first ones to do this.