diff --git a/netstack/src/filter/conntrack.rs b/netstack/src/filter/conntrack.rs
index 16acd67f82..438b93d955 100644
--- a/netstack/src/filter/conntrack.rs
+++ b/netstack/src/filter/conntrack.rs
@@ -184,8 +184,14 @@ fn advance_entry_state(entry: &mut ConnEntry, is_orig: bool, ctx: &PacketContext
     let res_fin = is_fin(flags);
 
     if is_orig {
-        // Original direction: track FIN as connection teardown.
+        // Original direction: handshake completion and FIN teardown.
         match entry.tcp_state {
+            TcpTracking::SynRecv => {
+                entry.tcp_state = TcpTracking::Established;
+                entry.state = ConnState::Established;
+                entry.timeout = now + Duration::from_secs(432000);
+                return true;
+            }
             TcpTracking::Established if res_fin => {
                 entry.tcp_state = TcpTracking::FinWait;
                 entry.timeout = now + Duration::from_secs(120);
@@ -199,7 +205,7 @@ fn advance_entry_state(entry: &mut ConnEntry, is_orig: bool, ctx: &PacketContext
             _ => {}
         }
     } else {
-        // Reply direction: handshake establishment and close.
+        // Reply direction: handshake initiation and close.
         match entry.tcp_state {
             TcpTracking::None if (flags & 0x12) == 0x12 => {
                 entry.tcp_state = TcpTracking::SynRecv;
@@ -211,12 +217,6 @@ fn advance_entry_state(entry: &mut ConnEntry, is_orig: bool, ctx: &PacketContext
                 entry.timeout = now + Duration::from_secs(60);
                 return true;
             }
-            TcpTracking::SynRecv => {
-                entry.tcp_state = TcpTracking::Established;
-                entry.state = ConnState::Established;
-                entry.timeout = now + Duration::from_secs(432000);
-                return true;
-            }
             TcpTracking::Established if res_fin => {
                 entry.tcp_state = TcpTracking::FinWait;
                 entry.timeout = now + Duration::from_secs(120);