I used to have (well, I still sort of do) have a script that expects:
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
to have been entered in to iptables ahead of my script running. My script gets kicked off at the end of the suse firewall init script every time the computer restarts. And it looks for the above line to insert some stuff under it.
It was consistently there in SLES 11 SP3, but it's only there some time after reboot with SLES 11 SP4. As far as I can tell, suse firewall is always the last thing to start with the machine, so there should be nothing at all running (synchronously at least) between starting iptables and running my commands so I don't have any idea what is happening in the in-between time.
So, maybe I could glom on to some process that is putting that TCPMSS line in iptables and wait till it's done. I just don't know what is putting it in there.