diff --git a/src/netif/ppp/mppe.c b/src/netif/ppp/mppe.c
index 85e6d451..31a38d86 100644
--- a/src/netif/ppp/mppe.c
+++ b/src/netif/ppp/mppe.c
@@ -308,6 +308,12 @@ mppe_decompress(ppp_pcb *pcb, ppp_mppe_state *state, struct pbuf **pb)
 	 */
 
 	if (!state->stateful) {
+		/* Discard late packet */
+		if ((ccount - state->ccount) % MPPE_CCOUNT_SPACE > MPPE_CCOUNT_SPACE / 2) {
+			state->sanity_errors++;
+			goto sanity_error;
+		}
+
 		/* RFC 3078, sec 8.1.  Rekey for every packet. */
 		while (state->ccount != ccount) {
 			mppe_rekey(state, 0);