Suppose you wanted to fool OS fingerprinting tools such as xprobe, nmap, etc. in order to make the initial information gathering phase harder.
In BSD you can use pf's traffic normalization options....