diff --git a/src/decode-tcp.c b/src/decode-tcp.c
index 0d464bbe7b..e3824d3351 100644
--- a/src/decode-tcp.c
+++ b/src/decode-tcp.c
@@ -154,9 +154,10 @@ static void DecodeTCPOptions(Packet *p, const uint8_t *pkt, uint16_t pktlen)
                     break;
                 case TCP_OPT_TFO:
                     SCLogDebug("TFO option, len %u", olen);
-                    if (olen < TCP_OPT_TFO_MIN_LEN ||
+                    if ((olen != 2) &&
+                           (olen < TCP_OPT_TFO_MIN_LEN ||
                             olen > TCP_OPT_TFO_MAX_LEN ||
-                            !((olen - 2) % 8 == 0))
+                            !((olen - 2) % 8 == 0)))
                     {
                         ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN);
                     } else {