diff --git a/CHANGELOG b/CHANGELOG
index 0344751c..04ffac8d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -435,7 +435,12 @@ HISTORY
 
   ++ Bug fixes:
 
-  2007-10-09 Simon Goldschmidt
+  2007-11-01 Simon Goldschmidt
+  * tcp.h, tcp.c, tcp_in.c: Fixed bug #21491: The MSS option sent (with SYN)
+    is now based on TCP_MSS instead of pcb->mss (on passive open now effectively
+    sending our configured TCP_MSS instead of the one received).
+
+  2007-11-01 Simon Goldschmidt
   * tcp_in.c: Fixed bug #21181: On active open, the initial congestion window was
     calculated based on the configured TCP_MSS, not on the MSS option received
     with SYN+ACK.
diff --git a/src/core/tcp.c b/src/core/tcp.c
index 5779fff4..1e23033f 100644
--- a/src/core/tcp.c
+++ b/src/core/tcp.c
@@ -491,6 +491,7 @@ tcp_connect(struct tcp_pcb *pcb, struct ip_addr *ipaddr, u16_t port,
   pcb->snd_lbb = iss - 1;
   pcb->rcv_wnd = TCP_WND;
   pcb->snd_wnd = TCP_WND;
+  /* The send MSS is updated when an MSS option is received. */
   pcb->mss = TCP_MSS;
   pcb->cwnd = 1;
   pcb->ssthresh = pcb->mss * 10;
@@ -504,10 +505,7 @@ tcp_connect(struct tcp_pcb *pcb, struct ip_addr *ipaddr, u16_t port,
   snmp_inc_tcpactiveopens();
   
   /* Build an MSS option */
-  optdata = htonl(((u32_t)2 << 24) | 
-      ((u32_t)4 << 16) | 
-      (((u32_t)pcb->mss / 256) << 8) |
-      (pcb->mss & 255));
+  optdata = TCP_BUILD_MSS_OPTION();
 
   ret = tcp_enqueue(pcb, NULL, 0, TCP_SYN, 0, (u8_t *)&optdata, 4);
   if (ret == ERR_OK) { 
@@ -933,6 +931,7 @@ tcp_alloc(u8_t prio)
     pcb->rcv_wnd = TCP_WND;
     pcb->tos = 0;
     pcb->ttl = TCP_TTL;
+    /* The send MSS is updated when an MSS option is received. */
     pcb->mss = TCP_MSS;
     pcb->rto = 3000 / TCP_SLOW_INTERVAL;
     pcb->sa = 0;
diff --git a/src/core/tcp_in.c b/src/core/tcp_in.c
index 369f0b7f..74e4f6fc 100644
--- a/src/core/tcp_in.c
+++ b/src/core/tcp_in.c
@@ -415,10 +415,7 @@ tcp_listen_input(struct tcp_pcb_listen *pcb)
     snmp_inc_tcppassiveopens();
 
     /* Build an MSS option. */
-    optdata = htonl(((u32_t)2 << 24) |
-        ((u32_t)4 << 16) |
-        (((u32_t)npcb->mss / 256) << 8) |
-        (npcb->mss & 255));
+    optdata = TCP_BUILD_MSS_OPTION();
     /* Send a SYN|ACK together with the MSS option. */
     tcp_enqueue(npcb, NULL, 0, TCP_SYN | TCP_ACK, 0, (u8_t *)&optdata, 4);
     return tcp_output(npcb);
diff --git a/src/include/lwip/tcp.h b/src/include/lwip/tcp.h
index 8e2fc68a..d07210e0 100644
--- a/src/include/lwip/tcp.h
+++ b/src/include/lwip/tcp.h
@@ -122,7 +122,11 @@ void             tcp_rexmit_rto  (struct tcp_pcb *pcb);
                             (((tpcb)->unsent != NULL) && ((tpcb)->unsent->next != NULL))) ? \
                                 tcp_output(tpcb) : ERR_OK)
 
-
+/** This returns a TCP header option for MSS in an u32_t */
+#define TCP_BUILD_MSS_OPTION()  htonl(((u32_t)2 << 24) | \
+                                ((u32_t)4 << 16) | \
+                                (((u32_t)TCP_MSS / 256) << 8) | \
+                                (TCP_MSS & 255))
 
 #define TCP_SEQ_LT(a,b)     ((s32_t)((a)-(b)) < 0)
 #define TCP_SEQ_LEQ(a,b)    ((s32_t)((a)-(b)) <= 0)