diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index b212f1e9916..1ae7c013ae1 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -2520,6 +2520,14 @@ static int StreamTcpPacketStateSynRecv(
             StreamTcpPacketSetState(p, ssn, TCP_ESTABLISHED);
             SCLogDebug("ssn %p: =~ ssn state is now TCP_ESTABLISHED", ssn);
 
+            /* special case: normally the packet following the 3whs is
+             * considered flow established, but with data we need it to
+             * be established now. This can happen if the original ACK was
+             * lost. */
+            if (p->payload_len) {
+                p->flowflags |= FLOW_PKT_ESTABLISHED;
+            }
+
             StreamTcpReassembleHandleSegment(tv, stt->ra_ctx, ssn, &ssn->client, p);
 
             /* If asynchronous stream handling is allowed then set the session,