Maybe there is a better method, but, in many ways, it occurred to me to use RAW SOCKET .
Processing data at the transport level allows you to access the TCP header (and then the 16-bit window column).
Another is that you have to process the TCP stack between you and the partner, which is a little crazy and time consuming.
This is an example of what you need to do to JUST send SYN to the host. Avoid the last cycle, otherwise it will start an in-phase attack against your partner :)
TCP with RAW SOCKETS
source share