Suricata

In looking into the size of Packet, I noticed that the TCP options are
stored as an array of MAX_OPTS, which is 40 to IPv4. Each Option
contains a pointer (8 bytes). It seems like it would be more efficient
to copy the options data into the structure rather than store a
pointer to the data.

It seems the array of opts serves 2 purposes:
1. store for easy O(1) retrieval
2. duplicate option checking

I agree it's wasting a lot of space, but it would probably be non-trivial to rewrite the parsers and the code that uses the info.

The stream engine uses some of the opts for example.