diff --git a/contrib/netcat/nc.1 b/contrib/netcat/nc.1
index 20885a8b9ea1..b7f57561f6df 100644
--- a/contrib/netcat/nc.1
+++ b/contrib/netcat/nc.1
@@ -27,7 +27,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd May 21, 2006
+.Dd April 2, 2008
 .Dt NC 1
 .Os
 .Sh NAME
@@ -36,7 +36,7 @@
 .Sh SYNOPSIS
 .Nm nc
 .Bk -words
-.Op Fl 46DEdhklnorStUuvz
+.Op Fl 46DEdhklnoOrStUuvz
 .Op Fl e Ar IPsec_policy
 .Op Fl i Ar interval
 .Op Fl P Ar proxy_username
@@ -146,6 +146,7 @@ option are ignored.
 .It Fl n
 Do not do any DNS or service lookups on any specified addresses,
 hostnames or ports.
+.\"
 .It Fl o
 .Dq Once-only mode .
 By default,
@@ -155,6 +156,10 @@ but continues until the network side has been closed down.
 Specifying
 .Fl o
 will make it terminate on EOF as well.
+.It Fl o
+Disables the use of TCP options on the socket, by setting the boolean
+TCP_NOOPT
+socket option.
 .It Fl P Ar proxy_username
 Specifies a username to present to a proxy server that requires authentication.
 If no username is specified then authentication will not be attempted.
@@ -435,7 +440,8 @@ if the proxy requires it:
 .Dl $ nc -x10.2.3.4:8080 -Xconnect -Pruser host.example.com 42
 .Sh SEE ALSO
 .Xr cat 1 ,
-.Xr ssh 1
+.Xr ssh 1 ,
+.Xr tcp 4
 .Sh AUTHORS
 Original implementation by *Hobbit*
 .Aq hobbit@avian.org .
diff --git a/contrib/netcat/netcat.c b/contrib/netcat/netcat.c
index bbf79191caae..9b87110efaa5 100644
--- a/contrib/netcat/netcat.c
+++ b/contrib/netcat/netcat.c
@@ -78,6 +78,7 @@ int	kflag;					/* More than one connect */
 int	lflag;					/* Bind to local port */
 int	nflag;					/* Don't do name look up */
 int	oflag;					/* Once only: stop on EOF */
+int	Oflag;					/* Do not use TCP options */
 char   *Pflag;					/* Proxy username */
 char   *pflag;					/* Localport flag */
 int	rflag;					/* Random ports flag */
@@ -138,7 +139,7 @@ main(int argc, char *argv[])
 	sv = NULL;
 
 	while ((ch = getopt(argc, argv,
-	    "46e:DEdhi:jklnoP:p:rSs:tT:Uuvw:X:x:z")) != -1) {
+	    "46e:DEdhi:jklnoOP:p:rSs:tT:Uuvw:X:x:z")) != -1) {
 		switch (ch) {
 		case '4':
 			family = AF_INET;
@@ -202,6 +203,9 @@ main(int argc, char *argv[])
 		case 'o':
 			oflag = 1;
 			break;
+		case 'O':
+			Oflag = 1;
+			break;
 		case 'P':
 			Pflag = optarg;
 			break;
@@ -600,6 +604,11 @@ local_listen(char *host, char *port, struct addrinfo hints)
 		if (ipsec_policy[1] != NULL)
 			add_ipsec_policy(s, ipsec_policy[1]);
 #endif
+		if (Oflag) {
+			if (setsockopt(s, IPPROTO_TCP, TCP_NOOPT,
+			    &Oflag, sizeof(Oflag)) == -1)
+				err(1, "disable TCP options");
+		}
 
 		if (bind(s, (struct sockaddr *)res0->ai_addr,
 		    res0->ai_addrlen) == 0)
@@ -829,6 +838,11 @@ set_common_sockopts(int s)
 		    &Tflag, sizeof(Tflag)) == -1)
 			err(1, "set IP ToS");
 	}
+	if (Oflag) {
+		if (setsockopt(s, IPPROTO_TCP, TCP_NOOPT,
+		    &Oflag, sizeof(Oflag)) == -1)
+			err(1, "disable TCP options");
+	}
 }
 
 int
@@ -868,6 +882,7 @@ help(void)
 	\t-k		Keep inbound sockets open for multiple connects\n\
 	\t-l		Listen mode, for inbound connects\n\
 	\t-n		Suppress name/port resolutions\n\
+	\t-O		Disable TCP options\n\
 	\t-P proxyuser\tUsername for proxy authentication\n\
 	\t-p port\t	Specify local port for remote connects\n\
 	\t-r		Randomize remote ports\n\
@@ -915,9 +930,9 @@ void
 usage(int ret)
 {
 #ifdef IPSEC
-	fprintf(stderr, "usage: nc [-46DEdhklnrStUuvz] [-e policy] [-i interval] [-P proxy_username] [-p source_port]\n");
+	fprintf(stderr, "usage: nc [-46DEdhklnorStUuvz] [-e policy] [-i interval] [-P proxy_username] [-p source_port]\n");
 #else
-	fprintf(stderr, "usage: nc [-46DdhklnrStUuvz] [-i interval] [-P proxy_username] [-p source_port]\n");
+	fprintf(stderr, "usage: nc [-46DdhklnorStUuvz] [-i interval] [-P proxy_username] [-p source_port]\n");
 #endif
 	fprintf(stderr, "\t  [-s source_ip_address] [-T ToS] [-w timeout] [-X proxy_protocol]\n");
 	fprintf(stderr, "\t  [-x proxy_address[:port]] [hostname] [port[s]]\n");