diff --git a/tools/tcpaccept.py b/tools/tcpaccept.py
index 5f7b48c..f606b73 100755
--- a/tools/tcpaccept.py
+++ b/tools/tcpaccept.py
@@ -161,6 +161,8 @@
 {
     if (args->protocol != IPPROTO_TCP)
         return 0;
+    if (args->oldstate != TCP_SYN_RECV || args->newstate != TCP_ESTABLISHED)
+        return 0;
     u32 pid = bpf_get_current_pid_tgid();
 
     ##FILTER_PID##