How to Configure TCP Fast Open (TFO) in Windows 11 Using PowerShell and Netsh

Network latency during initial connection establishment remains a primary bottleneck for high-performance web applications, API microservices, and database clusters. Standard TCP requires a complete three-way handshake (SYN, SYN-ACK, ACK) before application payload data can be exchanged, introducing at least one full round-trip time (RTT) delay. TCP Fast Open (TFO), defined in RFC 7413, allows data to be transmitted directly inside the initial SYN packet using a secure cryptographic cookie. In Windows 11, network administrators can configure and verify TFO parameters using elevated PowerShell cmdlets and native Netsh commands.

How TCP Fast Open Eliminates Round-Trip Handshake Latency

Under conventional TCP negotiation, client requests cannot accompany the initial handshake packet. TFO modifies this workflow through a two-stage mechanism:

• Initial Cookie Request: During the client’s first connection to a supporting server, it transmits a standard SYN packet containing a Fast Open Cookie Request option. The server performs the regular handshake and returns an encrypted TFO cookie inside the SYN-ACK response.
• Subsequent Fast Open Connections: On subsequent reconnections, the client transmits a SYN packet containing both the cached TFO cookie and initial application data (such as an HTTP GET request or TLS Client Hello). The server validates the cookie and delivers payload data to the listening application immediately, cutting connection latency by an entire round trip.

This acceleration is particularly beneficial for high-latency mobile networks, content delivery networks (CDNs), and interactive web browser navigation in Microsoft Edge and Google Chrome.

Querying Current TCP Fast Open Status via Netsh and PowerShell

To inspect whether TCP Fast Open is enabled on your Windows 11 machine, launch an elevated PowerShell prompt (Right-click Start > Terminal (Admin)) and execute the following Netsh query:

netsh int tcp show global

Locate the line indicating Fast Open or Fast Open Fallback in the configuration summary:

Querying active state...

TCP Global Parameters
----------------------------------------------
Receive-Side Scaling State          : enabled
Receive Window Auto-Tuning Level    : normal
Add-On Congestion Control Provider  : default
ECN Capability                      : disabled
RFC 1323 Timestamps                 : disabled
Initial RTO                         : 1000
Fast Open                           : enabled
Fast Open Fallback                  : enabled

Alternatively, query the active TCP transport profile properties using the Get-NetTCPSetting cmdlet in PowerShell:

Get-NetTCPSetting -SettingName InternetCustom | Select-Object SettingName, FastOpen, FastOpenFallback

Enabling TCP Fast Open in Windows 11

TCP Fast Open supports both client mode (transmitting data in outbound SYNs) and server mode (accepting data in inbound SYNs). To enable TFO globally across all network adapters, execute:

# Enable TCP Fast Open globally
netsh int tcp set global fastopen=enabled

# Enable Fast Open fallback to prevent connection drops on restrictive firewalls
netsh int tcp set global fastopenfallback=enabled

The fastopenfallback=enabled setting is essential for network resilience. If an intermediate legacy firewall or corporate intrusion prevention system (IPS) drops SYN packets containing data payloads, Windows will automatically detect the drop and retry the connection using a standard, data-free SYN packet.

Configuring TFO on Specific TCP Transport Templates

Windows 11 organises network transport behaviours into specialized templates—such as Internet, Datacenter, and Compat. You can target specific operational contexts using PowerShell:

# Enable Fast Open on the Internet template
Set-NetTCPSetting -SettingName Internet -FastOpen Enabled -FastOpenFallback Enabled

# Verify template adjustments
Get-NetTCPSetting -SettingName Internet | Format-List SettingName, FastOpen, FastOpenFallback

Testing and Validating TFO Operations

To confirm that TCP Fast Open is actively functioning on external connections, test endpoint connectivity using tools that support TFO cookie negotiation:

1. Use curl.exe with the --tcp-fastopen flag to contact a TFO-compliant server:

   curl.exe --tcp-fastopen -I https://www.cloudflare.com

2. Capture network packet handshakes using Wireshark or pktmon to inspect TCP option field 34 (TCP Fast Open Cookie).
3. Verify that the second consecutive request includes payload bytes directly within the initial TCP frame bearing the SYN flag.

Disabling TCP Fast Open for Troubleshooting

If you encounter intermittent connection timeouts or proxy failures on legacy enterprise intranets, revert TFO settings to their disabled defaults:

netsh int tcp set global fastopen=disabled
netsh int tcp set global fastopenfallback=disabled