diff --git a/hw/virtio-net.c b/hw/virtio-net.c
index e00c404..31ac9ef 100644
--- a/hw/virtio-net.c
+++ b/hw/virtio-net.c
@@ -157,6 +157,11 @@ static uint32_t virtio_net_get_features(VirtIODevice *vdev)
         features |= (1 << VIRTIO_NET_F_GUEST_TSO4);
         features |= (1 << VIRTIO_NET_F_GUEST_TSO6);
         features |= (1 << VIRTIO_NET_F_GUEST_ECN);
+
+        if (tap_has_ufo(n->vc->peer)) {
+            features |= (1 << VIRTIO_NET_F_GUEST_UFO);
+            features |= (1 << VIRTIO_NET_F_HOST_UFO);
+        }
     }
 
     return features;
@@ -188,7 +193,8 @@ static void virtio_net_set_features(VirtIODevice *vdev, uint32_t features)
                         (features >> VIRTIO_NET_F_GUEST_CSUM) & 1,
                         (features >> VIRTIO_NET_F_GUEST_TSO4) & 1,
                         (features >> VIRTIO_NET_F_GUEST_TSO6) & 1,
-                        (features >> VIRTIO_NET_F_GUEST_ECN)  & 1);
+                        (features >> VIRTIO_NET_F_GUEST_ECN)  & 1,
+                        (features >> VIRTIO_NET_F_GUEST_UFO)  & 1);
     }
 }
 
@@ -748,7 +754,8 @@ static int virtio_net_load(QEMUFile *f, void *opaque, int version_id)
                             (n->vdev.features >> VIRTIO_NET_F_GUEST_CSUM) & 1,
                             (n->vdev.features >> VIRTIO_NET_F_GUEST_TSO4) & 1,
                             (n->vdev.features >> VIRTIO_NET_F_GUEST_TSO6) & 1,
-                            (n->vdev.features >> VIRTIO_NET_F_GUEST_ECN)  & 1);
+                            (n->vdev.features >> VIRTIO_NET_F_GUEST_ECN)  & 1,
+                            (n->vdev.features >> VIRTIO_NET_F_GUEST_UFO)  & 1);
         }
     }
 
diff --git a/net.c b/net.c
index 746a3d6..3e54c53 100644
--- a/net.c
+++ b/net.c
@@ -1280,6 +1280,10 @@ void do_info_usernet(Monitor *mon)
 #endif /* CONFIG_SLIRP */
 
 #if defined(_WIN32)
+int tap_has_ufo(VLANClientState *vc)
+{
+    return 0;
+}
 int tap_has_vnet_hdr(VLANClientState *vc)
 {
     return 0;
@@ -1287,7 +1291,8 @@ int tap_has_vnet_hdr(VLANClientState *vc)
 void tap_using_vnet_hdr(VLANClientState *vc, int using_vnet_hdr)
 {
 }
-void tap_set_offload(VLANClientState *vc, int csum, int tso4, int tso6, int ecn)
+void tap_set_offload(VLANClientState *vc, int csum, int tso4,
+                     int tso6, int ecn, int ufo)
 {
 }
 #else /* !defined(_WIN32) */
@@ -1307,6 +1312,7 @@ typedef struct TAPState {
     unsigned int write_poll : 1;
     unsigned int has_vnet_hdr : 1;
     unsigned int using_vnet_hdr : 1;
+    unsigned int has_ufo: 1;
 } TAPState;
 
 static int launch_script(const char *setup_script, const char *ifname, int fd);
@@ -1494,6 +1500,15 @@ static int tap_set_sndbuf(TAPState *s, QemuOpts *opts)
     return 0;
 }
 
+int tap_has_ufo(VLANClientState *vc)
+{
+    TAPState *s = vc->opaque;
+
+    assert(vc->type == NET_CLIENT_TYPE_TAP);
+
+    return s->has_ufo;
+}
+
 int tap_has_vnet_hdr(VLANClientState *vc)
 {
     TAPState *s = vc->opaque;
@@ -1527,7 +1542,8 @@ static int tap_probe_vnet_hdr(int fd)
     return ifr.ifr_flags & IFF_VNET_HDR;
 }
 
-void tap_set_offload(VLANClientState *vc, int csum, int tso4, int tso6, int ecn)
+void tap_set_offload(VLANClientState *vc, int csum, int tso4,
+                     int tso6, int ecn, int ufo)
 {
     TAPState *s = vc->opaque;
     unsigned int offload = 0;
@@ -1540,11 +1556,16 @@ void tap_set_offload(VLANClientState *vc, int csum, int tso4, int tso6, int ecn)
             offload |= TUN_F_TSO6;
         if ((tso4 || tso6) && ecn)
             offload |= TUN_F_TSO_ECN;
+        if (ufo)
+            offload |= TUN_F_UFO;
     }
 
     if (ioctl(s->fd, TUNSETOFFLOAD, offload) != 0) {
-        fprintf(stderr, "TUNSETOFFLOAD ioctl() failed: %s\n",
-                strerror(errno));
+        offload &= ~TUN_F_UFO;
+        if (ioctl(s->fd, TUNSETOFFLOAD, offload) != 0) {
+            fprintf(stderr, "TUNSETOFFLOAD ioctl() failed: %s\n",
+                    strerror(errno));
+        }
     }
 }
 
@@ -1572,6 +1593,7 @@ static TAPState *net_tap_fd_init(VLANState *vlan,
                                  int vnet_hdr)
 {
     TAPState *s;
+    unsigned int offload;
 
     s = qemu_mallocz(sizeof(TAPState));
     s->fd = fd;
@@ -1581,6 +1603,12 @@ static TAPState *net_tap_fd_init(VLANState *vlan,
                                  vlan, NULL, model, name, NULL,
                                  tap_receive, tap_receive_raw,
                                  tap_receive_iov, tap_cleanup, s);
+    s->has_ufo = 0;
+    /* Check if tap supports UFO */
+    offload = TUN_F_CSUM | TUN_F_UFO;
+    if (ioctl(s->fd, TUNSETOFFLOAD, offload) == 0)
+       s->has_ufo = 1;
+    tap_set_offload(s->vc, 0, 0, 0, 0, 0);
     tap_read_poll(s, 1);
     return s;
 }
diff --git a/net.h b/net.h
index a0f0359..7e6cbf4 100644
--- a/net.h
+++ b/net.h
@@ -168,8 +168,9 @@ VLANClientState *qdev_get_vlan_client(DeviceState *dev,
                                       NetCleanup *cleanup,
                                       void *opaque);
 
+int tap_has_ufo(VLANClientState *vc);
 int tap_has_vnet_hdr(VLANClientState *vc);
 void tap_using_vnet_hdr(VLANClientState *vc, int using_vnet_hdr);
-void tap_set_offload(VLANClientState *vc, int csum, int tso4, int tso6, int ecn);
+void tap_set_offload(VLANClientState *vc, int csum, int tso4, int tso6, int ecn, int ufo);
 
 #endif
diff --git a/tap-linux.h b/tap-linux.h
index 241cf83..d81c650 100644
--- a/tap-linux.h
+++ b/tap-linux.h
@@ -36,6 +36,7 @@
 #define TUN_F_TSO4	0x02	/* I can handle TSO for IPv4 packets */
 #define TUN_F_TSO6	0x04	/* I can handle TSO for IPv6 packets */
 #define TUN_F_TSO_ECN	0x08	/* I can handle TSO with ECN bits. */
+#define TUN_F_UFO	0x10	/* I can handle UFO packets */
 
 struct virtio_net_hdr
 {
