diff --git a/deps/dablooms/test/gtest_dablooms.cpp b/deps/dablooms/test/gtest_dablooms.cpp
index 69dcbde..4c977f1 100644
--- a/deps/dablooms/test/gtest_dablooms.cpp
+++ b/deps/dablooms/test/gtest_dablooms.cpp
@@ -25,7 +25,7 @@ struct config
     .enable = 1,
     .capacity = 1000000,
     .error_rate = 0.00001,
-    .expiry_time = 10,
+    .expiry_time = 3,
 };
 
 struct packet_idetify idetify = {
@@ -47,7 +47,7 @@ TEST(DABLOOMS, TEST)
     EXPECT_TRUE(expiry_dablooms_search(handle, (const char *)&idetify, sizeof(idetify), time(NULL)) != 1); // no exist
     EXPECT_TRUE(expiry_dablooms_add(handle, (const char *)&idetify, sizeof(idetify), time(NULL)) == 0);    // add
 
-    for (int i = 0; i < 15; i++)
+    for (int i = 0; i < 5; i++)
     {
         if (i < config.expiry_time)
         {
diff --git a/src/dupkt_filter/test/gtest_dupkt_filter.cpp b/src/dupkt_filter/test/gtest_dupkt_filter.cpp
index 26db872..5bf8efc 100644
--- a/src/dupkt_filter/test/gtest_dupkt_filter.cpp
+++ b/src/dupkt_filter/test/gtest_dupkt_filter.cpp
@@ -75,7 +75,7 @@ struct config
     .enable = 1,
     .capacity = 1000000,
     .error_rate = 0.00001,
-    .timeout_s = 10,
+    .timeout_s = 3,
 };
 
 TEST(DUPKT_FILTER, TEST)
@@ -91,7 +91,7 @@ TEST(DUPKT_FILTER, TEST)
     EXPECT_TRUE(dupkt_filter_lookup(filter, &pkt) == 0); // no found
     dupkt_filter_add(filter, &pkt);                      // add
 
-    for (int i = 0; i < 12; i++)
+    for (int i = 0; i < 5; i++)
     {
         timestamp_update();
 
diff --git a/src/eviction_filter/test/gtest_eviction_filter.cpp b/src/eviction_filter/test/gtest_eviction_filter.cpp
index 3c3769b..c46f486 100644
--- a/src/eviction_filter/test/gtest_eviction_filter.cpp
+++ b/src/eviction_filter/test/gtest_eviction_filter.cpp
@@ -124,7 +124,7 @@ struct config
     .enable = 1,
     .capacity = 1000000,
     .error_rate = 0.00001,
-    .timeout_s = 10,
+    .timeout_s = 3,
 };
 
 TEST(EVICTION_FILTER, TEST)
@@ -143,7 +143,7 @@ TEST(EVICTION_FILTER, TEST)
     EXPECT_TRUE(eviction_filter_lookup(filter, &s2c_pkt) == 0); // no found
     eviction_filter_add(filter, &c2s_pkt);                      // add
 
-    for (int i = 0; i < 12; i++)
+    for (int i = 0; i < 5; i++)
     {
         timestamp_update();
 
diff --git a/src/packet/ipv4_helpers.h b/src/packet/ipv4_helpers.h
index 96b60d9..0ef1a09 100644
--- a/src/packet/ipv4_helpers.h
+++ b/src/packet/ipv4_helpers.h
@@ -124,6 +124,11 @@ static inline const uint8_t *ipv4_hdr_get_opt_ptr(const struct ip *hdr)
     return (const uint8_t *)hdr + sizeof(struct ip);
 }
 
+static inline void ipv4_hdr_set_ipid(struct ip *hdr, uint16_t ipid)
+{
+    hdr->ip_id = htons(ipid);
+}
+
 #ifdef __cpluscplus
 }
 #endif
diff --git a/src/packet/packet_helpers.h b/src/packet/packet_helpers.h
index 53b1936..ca024a9 100644
--- a/src/packet/packet_helpers.h
+++ b/src/packet/packet_helpers.h
@@ -16,6 +16,7 @@ extern "C"
 
 struct metadata
 {
+    char data[64];
     // TODO
 };
 
@@ -120,6 +121,7 @@ static inline struct packet *packet_dup(const struct packet *pkt)
             pkt_dup->layers[i].pld_ptr = pkt_dup->data_ptr + pkt->layers[i].hdr_offset + pkt->layers[i].hdr_len;
         }
     }
+    packet_set0_metadata(pkt_dup, metadata_dup(packet_get0_metadata(pkt)));
 
     return pkt_dup;
 }
@@ -128,6 +130,9 @@ static inline void packet_free(struct packet *pkt)
 {
     if (pkt)
     {
+        metadata_free((struct metadata *)packet_get0_metadata(pkt));
+        packet_set0_metadata(pkt, NULL);
+
         if (pkt->data_ptr)
         {
             free((char *)pkt->data_ptr);
diff --git a/src/session/session.cpp b/src/session/session.cpp
index 4117b4c..fc66315 100644
--- a/src/session/session.cpp
+++ b/src/session/session.cpp
@@ -1,6 +1,7 @@
 #include <assert.h>
 
 #include "session_private.h"
+#include "packet_helpers.h"
 
 #define EX_KEY_MAX_LEN 64
 
@@ -18,12 +19,6 @@ struct ex_manager
 };
 
 static struct ex_manager g_ex_manager = {0};
-uint8_t tcp_builtin_ex = 0; // built-in ex_data index
-uint8_t udp_builtin_ex = 0; // built-in ex_data index
-uint8_t c2s_1st_md_ex = 0;  // built-in ex_data index
-uint8_t s2c_1st_md_ex = 0;  // built-in ex_data index
-uint8_t c2s_1st_pkt_ex = 0; // built-in ex_data index
-uint8_t s2c_1st_pkt_ex = 0; // built-in ex_data index
 
 /******************************************************************************
  * session
@@ -46,22 +41,22 @@ uint64_t session_get_id(const struct session *sess)
 }
 
 // session tuple6
-void session_set_tuple6(struct session *sess, const struct tuple6 *tuple)
+void session_set_key(struct session *sess, const struct tuple6 *tuple)
 {
     memcpy(&sess->tuple, tuple, sizeof(struct tuple6));
 }
 
-const struct tuple6 *session_get0_tuple6(const struct session *sess)
+const struct tuple6 *session_get0_key(const struct session *sess)
 {
     return &sess->tuple;
 }
 
-void session_set_tuple6_dir(struct session *sess, enum session_dir dir)
+void session_set_key_dir(struct session *sess, enum session_dir dir)
 {
     sess->tuple_dir = dir;
 }
 
-enum session_dir session_get_tuple6_dir(const struct session *sess)
+enum session_dir session_get_key_dir(const struct session *sess)
 {
     return sess->tuple_dir;
 }
@@ -164,18 +159,50 @@ uint64_t session_get_last_time(const struct session *sess)
     return sess->last_time;
 }
 
+// session tcp state
+void session_set_tcp_state(struct session *sess, enum tcp_state state)
+{
+    sess->tcp_state = state;
+}
+
+enum tcp_state session_get_tcp_state(const struct session *sess)
+{
+    return sess->tcp_state;
+}
+
+// session udp state
+void session_set_udp_state(struct session *sess, enum udp_state state)
+{
+    sess->udp_state = state;
+}
+
+enum udp_state session_get_udp_state(const struct session *sess)
+{
+    return sess->udp_state;
+}
+
 /******************************************************************************
  * session packet
  ******************************************************************************/
 
+void session_set_c2s_1st_pkt(struct session *sess, const struct packet *pkt)
+{
+    sess->c2s_1st_pkt = packet_dup(pkt);
+}
+
+void session_set_s2c_1st_pkt(struct session *sess, const struct packet *pkt)
+{
+    sess->s2c_1st_pkt = packet_dup(pkt);
+}
+
 const struct packet *session_get0_c2s_1st_pkt(const struct session *sess)
 {
-    return (const struct packet *)session_get0_ex_data(sess, c2s_1st_pkt_ex);
+    return sess->c2s_1st_pkt;
 }
 
 const struct packet *session_get0_s2c_1st_pkt(const struct session *sess)
 {
-    return (const struct packet *)session_get0_ex_data(sess, s2c_1st_pkt_ex);
+    return sess->s2c_1st_pkt;
 }
 
 const struct packet *session_get0_1st_pkt(const struct session *sess)
@@ -304,6 +331,29 @@ void session_free_ex_data(struct session *sess, uint8_t idx)
     sess->ex_data[idx] = NULL;
 }
 
+void session_free(struct session *sess)
+{
+    if (sess)
+    {
+        for (uint8_t i = 0; i < g_ex_manager.count; i++)
+        {
+            session_free_ex_data(sess, i);
+        }
+
+        if (sess->c2s_1st_pkt)
+        {
+            packet_free(sess->c2s_1st_pkt);
+            sess->c2s_1st_pkt = NULL;
+        }
+
+        if (sess->s2c_1st_pkt)
+        {
+            packet_free(sess->s2c_1st_pkt);
+            sess->s2c_1st_pkt = NULL;
+        }
+    }
+}
+
 /******************************************************************************
  * session expire
  ******************************************************************************/
@@ -342,69 +392,79 @@ void session_run_expirecb(struct session *sess)
  * session dump
  ******************************************************************************/
 
-static void tcp_ex_data_tostring(uint64_t ex_data, char *buffer, size_t buffer_len)
+static void tcp_state_tostring(enum tcp_state state, char *buffer, size_t buffer_len)
 {
-    if (ex_data == 0)
+    if (state == 0)
     {
         return;
     }
 
     int nused = 0;
-    if (ex_data & TCP_SYN_RECVED)
+    if (state & TCP_SYN_RECVED)
     {
         nused += snprintf(buffer + nused, buffer_len - nused, "TCP_SYN_RECVED ");
     }
 
-    if (ex_data & TCP_SYNACK_RECVED)
+    if (state & TCP_SYNACK_RECVED)
     {
         nused += snprintf(buffer + nused, buffer_len - nused, "TCP_SYNACK_RECVED ");
     }
 
-    if (ex_data & TCP_C2S_DATA_RECVED)
+    if (state & TCP_C2S_ACK_RECVED)
+    {
+        nused += snprintf(buffer + nused, buffer_len - nused, "TCP_C2S_ACK_RECVED ");
+    }
+
+    if (state & TCP_S2C_ACK_RECVED)
+    {
+        nused += snprintf(buffer + nused, buffer_len - nused, "TCP_S2C_ACK_RECVED ");
+    }
+
+    if (state & TCP_C2S_DATA_RECVED)
     {
         nused += snprintf(buffer + nused, buffer_len - nused, "TCP_C2S_DATA_RECVED ");
     }
 
-    if (ex_data & TCP_S2C_DATA_RECVED)
+    if (state & TCP_S2C_DATA_RECVED)
     {
         nused += snprintf(buffer + nused, buffer_len - nused, "TCP_S2C_DATA_RECVED ");
     }
 
-    if (ex_data & TCP_C2S_FIN_RECVED)
+    if (state & TCP_C2S_FIN_RECVED)
     {
         nused += snprintf(buffer + nused, buffer_len - nused, "TCP_C2S_FIN_RECVED ");
     }
 
-    if (ex_data & TCP_S2C_FIN_RECVED)
+    if (state & TCP_S2C_FIN_RECVED)
     {
         nused += snprintf(buffer + nused, buffer_len - nused, "TCP_S2C_FIN_RECVED ");
     }
 
-    if (ex_data & TCP_C2S_RST_RECVED)
+    if (state & TCP_C2S_RST_RECVED)
     {
         nused += snprintf(buffer + nused, buffer_len - nused, "TCP_C2S_RST_RECVED ");
     }
 
-    if (ex_data & TCP_S2C_RST_RECVED)
+    if (state & TCP_S2C_RST_RECVED)
     {
         nused += snprintf(buffer + nused, buffer_len - nused, "TCP_S2C_RST_RECVED ");
     }
 }
 
-static void udp_ex_data_tostring(uint64_t ex_data, char *buffer, size_t buffer_len)
+static void udp_state_tostring(enum udp_state state, char *buffer, size_t buffer_len)
 {
-    if (ex_data == 0)
+    if (state == 0)
     {
         return;
     }
 
     int nused = 0;
-    if (ex_data & UDP_C2S_RECVED)
+    if (state & UDP_C2S_RECVED)
     {
         snprintf(buffer + nused, buffer_len - nused, "UDP_C2S_RECVED ");
     }
 
-    if (ex_data & UDP_S2C_RECVED)
+    if (state & UDP_S2C_RECVED)
     {
         snprintf(buffer + nused, buffer_len - nused, "UDP_S2C_RECVED ");
     }
@@ -453,9 +513,9 @@ const char *session_type_tostring(enum session_type type)
     switch (type)
     {
     case SESSION_TYPE_TCP:
-        return "tcp";
+        return "TCP";
     case SESSION_TYPE_UDP:
-        return "udp";
+        return "UDP";
     default:
         return "unknown";
     }
@@ -466,9 +526,22 @@ const char *session_dir_tostring(enum session_dir dir)
     switch (dir)
     {
     case SESSION_DIR_C2S:
-        return "c2s";
+        return "C2S";
     case SESSION_DIR_S2C:
-        return "s2c";
+        return "S2C";
+    default:
+        return "unknown";
+    }
+}
+
+const char *dup_traffic_flag_tostring(enum dup_traffic_flag flag)
+{
+    switch (flag)
+    {
+    case DUP_TRAFFIC_YES:
+        return "YES";
+    case DUP_TRAFFIC_NO:
+        return "NO";
     default:
         return "unknown";
     }
@@ -477,13 +550,14 @@ const char *session_dir_tostring(enum session_dir dir)
 void session_dump(struct session *sess)
 {
     char buffer[128] = {0};
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
 
     printf("session id                 : %" PRIu64 "\n", session_get_id(sess));
-    printf("session tuple6 key         : %s\n", buffer);
-    printf("session tuple6 dir         : %s\n", session_dir_tostring(session_get_tuple6_dir(sess)));
+    printf("session key                : %s\n", buffer);
+    printf("session key dir            : %s\n", session_dir_tostring(session_get_key_dir(sess)));
     printf("session state              : %s\n", session_state_tostring(session_get_state(sess)));
     printf("session type               : %s\n", session_type_tostring(session_get_type(sess)));
+    printf("session dup traffic flag   : %s\n", dup_traffic_flag_tostring(session_get_dup_traffic_flag(sess)));
     printf("session closing reasion    : %s\n", session_closing_reasion_tostring(session_get_closing_reasion(sess)));
     printf("session c2s packets        : %" PRIu64 "\n", session_get_c2s_packets(sess));
     printf("session c2s bytes          : %" PRIu64 "\n", session_get_c2s_bytes(sess));
@@ -491,26 +565,23 @@ void session_dump(struct session *sess)
     printf("session s2c bytes          : %" PRIu64 "\n", session_get_s2c_bytes(sess));
     printf("session create time        : %" PRIu64 "\n", session_get_create_time(sess));
     printf("session last time          : %" PRIu64 "\n", session_get_last_time(sess));
+    if (session_get_type(sess) == SESSION_TYPE_TCP)
+    {
+        memset(buffer, 0, sizeof(buffer));
+        tcp_state_tostring(session_get_tcp_state(sess), buffer, sizeof(buffer));
+        printf("session tcp state          : %s\n", buffer);
+    }
+    else if (session_get_type(sess) == SESSION_TYPE_UDP)
+    {
+        memset(buffer, 0, sizeof(buffer));
+        udp_state_tostring(session_get_udp_state(sess), buffer, sizeof(buffer));
+        printf("session udp state          : %s\n", buffer);
+    }
     printf("session current packet ptr : %p\n", (void *)session_get0_cur_pkt(sess));
     printf("session current packet dir : %s\n", session_dir_tostring(session_get_cur_dir(sess)));
     printf("session ex data: \n");
     for (uint8_t i = 0; i < g_ex_manager.count; i++)
     {
-        if (i == tcp_builtin_ex)
-        {
-            memset(buffer, 0, sizeof(buffer));
-            tcp_ex_data_tostring((uint64_t)sess->ex_data[i], buffer, sizeof(buffer));
-            printf("    ex_idx: %d, ex_key: %s, ex_val: %s\n", i, g_ex_manager.schemas[i].key, buffer);
-        }
-        else if (i == udp_builtin_ex)
-        {
-            memset(buffer, 0, sizeof(buffer));
-            udp_ex_data_tostring((uint64_t)sess->ex_data[i], buffer, sizeof(buffer));
-            printf("    ex_idx: %d, ex_key: %s, ex_val: %s\n", i, g_ex_manager.schemas[i].key, buffer);
-        }
-        else
-        {
-            printf("    ex_idx: %d, ex_key: %s, ex_val: %p\n", i, g_ex_manager.schemas[i].key, sess->ex_data[i]);
-        }
+        printf("    ex_idx: %d, ex_key: %s, ex_data: %p\n", i, g_ex_manager.schemas[i].key, sess->ex_data[i]);
     }
 }
\ No newline at end of file
diff --git a/src/session/session.h b/src/session/session.h
index 74bbd93..8799692 100644
--- a/src/session/session.h
+++ b/src/session/session.h
@@ -11,6 +11,30 @@ extern "C"
 #include "tuple.h"
 #include "packet.h"
 
+enum tcp_state
+{
+    // HANDSHAKE
+    TCP_SYN_RECVED = 1 << 0,
+    TCP_SYNACK_RECVED = 1 << 1,
+    TCP_C2S_ACK_RECVED = 1 << 2,
+    TCP_S2C_ACK_RECVED = 1 << 3,
+    // ESTABLISHED
+    TCP_C2S_DATA_RECVED = 1 << 4,
+    TCP_S2C_DATA_RECVED = 1 << 5,
+    // FIN
+    TCP_C2S_FIN_RECVED = 1 << 6,
+    TCP_S2C_FIN_RECVED = 1 << 7,
+    // RST
+    TCP_C2S_RST_RECVED = 1 << 8,
+    TCP_S2C_RST_RECVED = 1 << 9,
+};
+
+enum udp_state
+{
+    UDP_C2S_RECVED = 1 << 0,
+    UDP_S2C_RECVED = 1 << 1,
+};
+
 enum session_state
 {
     SESSION_STATE_OPENING = 0x1,
@@ -61,10 +85,10 @@ void session_set_id(struct session *sess, uint64_t id);
 uint64_t session_get_id(const struct session *sess);
 
 // session key
-void session_set_tuple6(struct session *sess, const struct tuple6 *tuple);
-const struct tuple6 *session_get0_tuple6(const struct session *sess);
-void session_set_tuple6_dir(struct session *sess, enum session_dir dir);
-enum session_dir session_get_tuple6_dir(const struct session *sess);
+void session_set_key(struct session *sess, const struct tuple6 *tuple);
+const struct tuple6 *session_get0_key(const struct session *sess);
+void session_set_key_dir(struct session *sess, enum session_dir dir);
+enum session_dir session_get_key_dir(const struct session *sess);
 
 // session state
 void session_set_state(struct session *sess, enum session_state state);
@@ -96,10 +120,20 @@ void session_set_last_time(struct session *sess, uint64_t timestamp);
 uint64_t session_get_create_time(const struct session *sess);
 uint64_t session_get_last_time(const struct session *sess);
 
+// session tcp state
+void session_set_tcp_state(struct session *sess, enum tcp_state state);
+enum tcp_state session_get_tcp_state(const struct session *sess);
+
+// session udp state
+void session_set_udp_state(struct session *sess, enum udp_state state);
+enum udp_state session_get_udp_state(const struct session *sess);
+
 /******************************************************************************
  * session packet
  ******************************************************************************/
 
+void session_set_c2s_1st_pkt(struct session *sess, const struct packet *pkt);
+void session_set_s2c_1st_pkt(struct session *sess, const struct packet *pkt);
 const struct packet *session_get0_c2s_1st_pkt(const struct session *sess);
 const struct packet *session_get0_s2c_1st_pkt(const struct session *sess);
 const struct packet *session_get0_1st_pkt(const struct session *sess);
@@ -141,6 +175,7 @@ void *session_get0_ex_data(const struct session *sess, uint8_t idx);
  * if user want to free ex_data, should use session_free_ex_data.
  */
 void session_free_ex_data(struct session *sess, uint8_t idx);
+void session_free(struct session *sess);
 
 /******************************************************************************
  * session expire
diff --git a/src/session/session_manager.cpp b/src/session/session_manager.cpp
index d1d5234..98e8fb3 100644
--- a/src/session/session_manager.cpp
+++ b/src/session/session_manager.cpp
@@ -46,19 +46,120 @@ struct session_manager
      // packet filter status
      uint64_t npkts_miss_l4_proto; // fast forward
 
-     uint64_t npkts_hit_tcp_evicted; // fast forward (miss session)
-     uint64_t npkts_hit_tcp_dupkt;   // fast forward
-     uint64_t npkts_hit_tcp_discard; // drop
-     uint64_t npkts_hit_tcp_closing; // fast forward
+     uint64_t npkts_hit_tcp_miss_sess; // fast forward
+     uint64_t npkts_hit_tcp_dupkt;     // fast forward
+     uint64_t npkts_hit_tcp_discard;   // drop
 
      uint64_t npkts_hit_udp_evicted; // fast forward
 };
 
+static void tcp_init_timeout_cb(struct session *sess, void *arg);
+static void tcp_handshake_timeout_cb(struct session *sess, void *arg);
+static void tcp_data_timeout_cb(struct session *sess, void *arg);
+static void tcp_half_closed_timeout_cb(struct session *sess, void *arg);
+static void tcp_time_wait_timeout_cb(struct session *sess, void *arg);
+static void udp_data_timeout_cb(struct session *sess, void *arg);
+
+static int session_manager_check_config(struct session_manager_config *config);
+static uint64_t session_manager_alloc_session_id(void);
+static int session_manager_update_tcp_filter(struct session_manager *mgr, struct session *sess, const struct packet *pkt, enum session_dir curr_dir);
+
+static enum session_dir judge_direction_by_tuple6(const struct tuple6 *key);
+static enum session_dir judge_direction_by_session(const struct session *sess, const struct tuple6 *key);
+
+static void session_update_tcp_state(struct session *sess, const struct layer_record *tcp_layer, enum session_dir curr_dir);
+static void session_update_udp_state(struct session *sess, const struct layer_record *udp_layer, enum session_dir curr_dir);
+
+static void session_manager_update_session_state(struct session_manager *mgr, struct session *sess, enum session_state state);
+static void session_manager_update_session_timer(struct session_manager *mgr, struct session *sess, session_expire_cb expire_cb, uint64_t timeout_sec);
+static void session_manager_update_session_base(struct session_manager *mgr, struct session *sess, const struct tuple6 *key, enum session_dir curr_dir);
+static void session_manager_update_session_packet(struct session_manager *mgr, struct session *sess, const struct packet *pkt, enum session_dir curr_dir);
+
+static void session_manager_update_udp_to_active(struct session_manager *mgr, struct session *sess);
+static void session_manager_update_udp_to_closing(struct session_manager *mgr, struct session *sess);
+static void session_manager_update_tcp_to_opening(struct session_manager *mgr, struct session *sess, int opening_by_syn);
+static void session_manager_update_tcp_to_active(struct session_manager *mgr, struct session *sess);
+static void session_manager_update_tcp_to_closing(struct session_manager *mgr, struct session *sess, int enable_time_wait);
+static void session_manager_update_session_to_closed(struct session_manager *mgr, struct session *sess);
+
+static void session_manager_handle_udp_on_active(struct session_manager *mgr, struct session *sess);
+static void session_manager_handle_udp_on_closing(struct session_manager *mgr, struct session *sess);
+static void session_manager_handle_tcp_on_opening(struct session_manager *mgr, struct session *sess, enum tcp_state tcp_old_state, enum tcp_state tcp_curr_state);
+static void session_manager_handle_tcp_on_active(struct session_manager *mgr, struct session *sess, enum tcp_state tcp_old_state, enum tcp_state tcp_curr_state);
+static void session_manager_handle_tcp_on_closing(struct session_manager *mgr, struct session *sess, enum tcp_state tcp_old_state, enum tcp_state tcp_curr_state);
+
+static struct session *session_manager_new_tcp_session(struct session_manager *mgr, const struct packet *pkt, const struct tuple6 *key);
+static struct session *session_manager_new_udp_session(struct session_manager *mgr, const struct packet *pkt, const struct tuple6 *key);
+static struct session *session_manager_update_tcp_session(struct session_manager *mgr, struct session *sess, const struct packet *pkt, const struct tuple6 *key);
+static struct session *session_manager_update_udp_session(struct session_manager *mgr, struct session *sess, const struct packet *pkt, const struct tuple6 *key);
+
+static void session_manager_free_session(struct session_manager *mgr, struct session *sess);
+static void session_manager_recycle_session(struct session_manager *mgr);
+static void session_manager_evicte_session(struct session_manager *mgr, struct session *sess);
+
 /******************************************************************************
- * utils
+ * Private API
  ******************************************************************************/
 
-// OK
+static void tcp_init_timeout_cb(struct session *sess, void *arg)
+{
+     SESSION_LOG_DEBUG("run tcp_init_timeout_cb on session %lu", session_get_id(sess));
+     struct session_manager *mgr = (struct session_manager *)arg;
+     assert(mgr != NULL);
+
+     session_set_closing_reasion(sess, CLOSING_BY_TIMEOUT);
+     session_manager_update_tcp_to_closing(mgr, sess, 1);
+}
+
+static void tcp_handshake_timeout_cb(struct session *sess, void *arg)
+{
+     SESSION_LOG_DEBUG("run tcp_handshake_timeout_cb on session %lu", session_get_id(sess));
+     struct session_manager *mgr = (struct session_manager *)arg;
+     assert(mgr != NULL);
+
+     session_set_closing_reasion(sess, CLOSING_BY_TIMEOUT);
+     session_manager_update_tcp_to_closing(mgr, sess, 1);
+}
+
+static void tcp_data_timeout_cb(struct session *sess, void *arg)
+{
+     SESSION_LOG_DEBUG("run tcp_data_timeout_cb on session %lu", session_get_id(sess));
+     struct session_manager *mgr = (struct session_manager *)arg;
+     assert(mgr != NULL);
+
+     session_set_closing_reasion(sess, CLOSING_BY_TIMEOUT);
+     session_manager_update_tcp_to_closing(mgr, sess, 1);
+}
+
+static void tcp_half_closed_timeout_cb(struct session *sess, void *arg)
+{
+     SESSION_LOG_DEBUG("run tcp_half_closed_timeout_cb on session %lu", session_get_id(sess));
+     struct session_manager *mgr = (struct session_manager *)arg;
+     assert(mgr != NULL);
+
+     session_set_closing_reasion(sess, CLOSING_BY_TIMEOUT);
+     session_manager_update_tcp_to_closing(mgr, sess, 1);
+}
+
+static void tcp_time_wait_timeout_cb(struct session *sess, void *arg)
+{
+     SESSION_LOG_DEBUG("run tcp_time_wait_timeout_cb on session %lu", session_get_id(sess));
+     struct session_manager *mgr = (struct session_manager *)arg;
+     assert(mgr != NULL);
+
+     session_manager_free_session(mgr, sess);
+}
+
+static void udp_data_timeout_cb(struct session *sess, void *arg)
+{
+     SESSION_LOG_DEBUG("run udp_data_timeout_cb on session %lu", session_get_id(sess));
+     struct session_manager *mgr = (struct session_manager *)arg;
+     assert(mgr != NULL);
+
+     session_set_closing_reasion(sess, CLOSING_BY_TIMEOUT);
+     session_manager_update_udp_to_closing(mgr, sess);
+}
+
 // return  0: success
 // return -1: invalid config
 static int session_manager_check_config(struct session_manager_config *config)
@@ -102,6 +203,11 @@ static int session_manager_check_config(struct session_manager_config *config)
           SESSION_LOG_ERROR("invalid tcp timeout half closed, support range: 1-604,800");
           return -1;
      }
+     if (config->tcp_timeout_time_wait < 1 || config->tcp_timeout_time_wait > 600)
+     {
+          SESSION_LOG_ERROR("invalid tcp timeout time wait, support range: 1-600");
+          return -1;
+     }
      if (config->tcp_timeout_discard < 1 || config->tcp_timeout_discard > 15999999)
      {
           SESSION_LOG_ERROR("invalid tcp timeout discard, support range: 1-15,999,999");
@@ -174,10 +280,9 @@ static uint64_t session_manager_alloc_session_id(void)
      return 0;
 }
 
-// OK
 // return 1: duplicate packet
 // return 0: not duplicate packet
-static int session_manager_filter_session_dupkt(struct session_manager *mgr, struct session *sess, const struct packet *pkt, enum session_dir curr_dir)
+static int session_manager_update_tcp_filter(struct session_manager *mgr, struct session *sess, const struct packet *pkt, enum session_dir curr_dir)
 {
      if (curr_dir == SESSION_DIR_C2S)
      {
@@ -215,75 +320,62 @@ dupkt_fitler:
      }
 }
 
-/******************************************************************************
- * built-in ex data
- ******************************************************************************/
-
-// OK
-static void session_free_packet_exdata(struct session *sess, uint8_t idx, void *ex_ptr, void *arg)
+static enum session_dir judge_direction_by_tuple6(const struct tuple6 *key)
 {
-     if (ex_ptr)
+     uint16_t src_port = ntohs(key->src_port);
+     uint16_t dst_port = ntohs(key->dst_port);
+
+     // big port is client
+     if (src_port > dst_port)
      {
-          packet_free((struct packet *)ex_ptr);
+          return SESSION_DIR_C2S;
+     }
+
+     else if (src_port < dst_port)
+     {
+          return SESSION_DIR_S2C;
+     }
+     else
+     {
+          // if port is equal, first packet is C2S
+          return SESSION_DIR_C2S;
      }
 }
 
-// OK
-static void session_free_pktmeta_exdata(struct session *sess, uint8_t idx, void *ex_ptr, void *arg)
+static enum session_dir judge_direction_by_session(const struct session *sess, const struct tuple6 *key)
 {
-     if (ex_ptr)
+     if (tuple6_cmp(session_get0_key(sess), key) == 0)
      {
-          metadata_free((struct metadata *)ex_ptr);
+          return session_get_key_dir(sess);
+     }
+     else
+     {
+          return (session_get_key_dir(sess) == SESSION_DIR_C2S ? SESSION_DIR_S2C : SESSION_DIR_C2S);
      }
 }
 
-// OK
-static void session_update_packet_exdata(struct session *sess, const struct packet *pkt, enum session_dir curr_dir)
-{
-     if (curr_dir == SESSION_DIR_C2S)
-     {
-          if (session_get0_ex_data(sess, c2s_1st_pkt_ex) == NULL)
-          {
-               session_set_ex_data(sess, c2s_1st_pkt_ex, packet_dup(pkt));
-          }
-     }
-     else if (curr_dir == SESSION_DIR_S2C)
-     {
-          if (session_get0_ex_data(sess, s2c_1st_pkt_ex) == NULL)
-          {
-               session_set_ex_data(sess, s2c_1st_pkt_ex, packet_dup(pkt));
-          }
-     }
-}
-
-// OK
-static void session_update_pktmeta_exdata(struct session *sess, const struct metadata *md, enum session_dir curr_dir)
-{
-     if (curr_dir == SESSION_DIR_C2S)
-     {
-          if (session_get0_ex_data(sess, c2s_1st_md_ex) == NULL)
-          {
-               session_set_ex_data(sess, c2s_1st_md_ex, metadata_dup(md));
-          }
-     }
-     else if (curr_dir == SESSION_DIR_S2C)
-     {
-          if (session_get0_ex_data(sess, s2c_1st_md_ex) == NULL)
-          {
-               session_set_ex_data(sess, s2c_1st_md_ex, metadata_dup(md));
-          }
-     }
-}
-
-// OK
-static void session_update_tcp_exdata(struct session *sess, const struct layer_record *tcp_layer, enum session_dir curr_dir)
+static void session_update_tcp_state(struct session *sess, const struct layer_record *tcp_layer, enum session_dir curr_dir)
 {
      const struct tcphdr *hdr = (const struct tcphdr *)tcp_layer->hdr_ptr;
-     uint64_t state = (uint64_t)session_get0_ex_data(sess, tcp_builtin_ex);
+     uint64_t state = session_get_tcp_state(sess);
      if (tcp_hdr_has_flag_syn(hdr))
      {
           state |= (tcp_hdr_has_flag_ack(hdr) ? TCP_SYNACK_RECVED : TCP_SYN_RECVED);
      }
+     else
+     {
+          if (tcp_hdr_has_flag_ack(hdr))
+          {
+               if (curr_dir == SESSION_DIR_C2S)
+               {
+                    state |= TCP_C2S_ACK_RECVED;
+               }
+               else if (curr_dir == SESSION_DIR_S2C)
+               {
+                    state |= TCP_S2C_ACK_RECVED;
+               }
+          }
+     }
      if (tcp_hdr_has_flag_fin(hdr))
      {
           if (curr_dir == SESSION_DIR_C2S)
@@ -318,14 +410,12 @@ static void session_update_tcp_exdata(struct session *sess, const struct layer_r
           }
      }
 
-     session_set_ex_data(sess, tcp_builtin_ex, (void *)(state));
+     session_set_tcp_state(sess, (enum tcp_state)state);
 }
 
-// OK
-static void session_update_udp_exdata(struct session *sess, const struct layer_record *udp_layer, enum session_dir curr_dir)
+static void session_update_udp_state(struct session *sess, const struct layer_record *udp_layer, enum session_dir curr_dir)
 {
-     const struct udphdr *hdr = (const struct udphdr *)udp_layer->hdr_ptr;
-     uint64_t state = (uint64_t)session_get0_ex_data(sess, udp_builtin_ex);
+     uint64_t state = session_get_udp_state(sess);
      if (curr_dir == SESSION_DIR_C2S)
      {
           state |= UDP_C2S_RECVED;
@@ -334,113 +424,15 @@ static void session_update_udp_exdata(struct session *sess, const struct layer_r
      {
           state |= UDP_S2C_RECVED;
      }
-     session_set_ex_data(sess, udp_builtin_ex, (void *)(state));
+     session_set_udp_state(sess, (enum udp_state)state);
 }
 
-/******************************************************************************
- * judge session direction
- ******************************************************************************/
-
-// OK
-static enum session_dir judge_direction_by_tuple6(const struct tuple6 *key)
-{
-     uint16_t src_port = ntohs(key->src_port);
-     uint16_t dst_port = ntohs(key->dst_port);
-
-     // big port is client
-     if (src_port > dst_port)
-     {
-          return SESSION_DIR_C2S;
-     }
-
-     else if (src_port < dst_port)
-     {
-          return SESSION_DIR_S2C;
-     }
-     else
-     {
-          // if port is equal, first packet is C2S
-          return SESSION_DIR_C2S;
-     }
-}
-
-// OK
-static enum session_dir judge_direction_by_session(const struct session *sess, const struct tuple6 *key)
-{
-     if (tuple6_cmp(session_get0_tuple6(sess), key) == 0)
-     {
-          return session_get_tuple6_dir(sess);
-     }
-     else
-     {
-          return (session_get_tuple6_dir(sess) == SESSION_DIR_C2S ? SESSION_DIR_S2C : SESSION_DIR_C2S);
-     }
-}
-
-/******************************************************************************
- * timeout callback
- ******************************************************************************/
-
-// OK
-static void tcp_init_timeout_cb(struct session *sess, void *arg)
-{
-     SESSION_LOG_DEBUG("run tcp_init_timeout_cb on session %lu", session_get_id(sess));
-     struct session_manager *mgr = (struct session_manager *)arg;
-     assert(mgr != NULL);
-
-     session_manager_update_session_on_closing(mgr, sess, CLOSING_BY_TIMEOUT);
-}
-
-// OK
-static void tcp_handshake_timeout_cb(struct session *sess, void *arg)
-{
-     SESSION_LOG_DEBUG("run tcp_handshake_timeout_cb on session %lu", session_get_id(sess));
-     struct session_manager *mgr = (struct session_manager *)arg;
-     assert(mgr != NULL);
-
-     session_manager_update_session_on_closing(mgr, sess, CLOSING_BY_TIMEOUT);
-}
-
-// OK
-static void tcp_data_timeout_cb(struct session *sess, void *arg)
-{
-     SESSION_LOG_DEBUG("run tcp_data_timeout_cb on session %lu", session_get_id(sess));
-     struct session_manager *mgr = (struct session_manager *)arg;
-     assert(mgr != NULL);
-
-     session_manager_update_session_on_closing(mgr, sess, CLOSING_BY_TIMEOUT);
-}
-
-// OK
-static void tcp_half_closed_timeout_cb(struct session *sess, void *arg)
-{
-     SESSION_LOG_DEBUG("run tcp_half_closed_timeout_cb on session %lu", session_get_id(sess));
-     struct session_manager *mgr = (struct session_manager *)arg;
-     assert(mgr != NULL);
-
-     session_manager_update_session_on_closing(mgr, sess, CLOSING_BY_TIMEOUT);
-}
-
-// OK
-static void udp_data_timeout_cb(struct session *sess, void *arg)
-{
-     SESSION_LOG_DEBUG("run udp_data_timeout_cb on session %lu", session_get_id(sess));
-     struct session_manager *mgr = (struct session_manager *)arg;
-     assert(mgr != NULL);
-
-     session_manager_update_session_on_closing(mgr, sess, CLOSING_BY_TIMEOUT);
-}
-
-/******************************************************************************
- * update session
- ******************************************************************************/
-
 /*
 on opening update session
 [*] session_init
 [*] session_set_id
-[*] session_set_tuple6
-[*] session_set_tuple6_dir
+[*] session_set_key
+[*] session_set_key_dir
 [*] session_set_type
 [*] session_set_create_time
 [*] session_set_state
@@ -463,7 +455,6 @@ on closing update session
 [*] session_set_closing_reasion
 */
 
-// OK
 static void session_manager_update_session_state(struct session_manager *mgr, struct session *sess, enum session_state state)
 {
      // session state not change
@@ -559,13 +550,19 @@ static void session_manager_update_session_state(struct session_manager *mgr, st
      session_set_state(sess, state);
 }
 
-// OK
-static inline void session_manager_update_session_on_opening(struct session_manager *mgr, struct session *sess, const struct tuple6 *key, enum session_dir curr_dir)
+static void session_manager_update_session_timer(struct session_manager *mgr, struct session *sess, session_expire_cb expire_cb, uint64_t timeout_sec)
+{
+     session_timer_del_session(mgr->sess_timer, sess);
+     session_set_expirecb(sess, expire_cb, mgr, timestamp_get_sec() + timeout_sec);
+     session_timer_add_session(mgr->sess_timer, sess);
+}
+
+static void session_manager_update_session_base(struct session_manager *mgr, struct session *sess, const struct tuple6 *key, enum session_dir curr_dir)
 {
      session_init(sess);
      session_set_id(sess, session_manager_alloc_session_id());
-     session_set_tuple6(sess, key);
-     session_set_tuple6_dir(sess, curr_dir);
+     session_set_key(sess, key);
+     session_set_key_dir(sess, curr_dir);
      if (key->ip_proto == IPPROTO_UDP)
      {
           session_set_type(sess, SESSION_TYPE_UDP);
@@ -575,90 +572,205 @@ static inline void session_manager_update_session_on_opening(struct session_mana
           session_set_type(sess, SESSION_TYPE_TCP);
      }
      session_set_create_time(sess, timestamp_get_msec());
-     session_manager_update_session_state(mgr, sess, SESSION_STATE_OPENING);
 }
 
-// OK
-static inline void session_manager_update_session_on_packet(struct session_manager *mgr, struct session *sess, const struct packet *pkt, enum session_dir curr_dir)
+static void session_manager_update_session_packet(struct session_manager *mgr, struct session *sess, const struct packet *pkt, enum session_dir curr_dir)
 {
      uint64_t len = packet_get_raw_len(pkt);
-     const struct metadata *md = packet_get0_metadata(pkt);
      if (curr_dir == SESSION_DIR_C2S)
      {
           session_inc_c2s_metrics(sess, 1, len);
+          if (session_get0_c2s_1st_pkt(sess) == NULL)
+          {
+               session_set_c2s_1st_pkt(sess, pkt);
+          }
      }
      else if (curr_dir == SESSION_DIR_S2C)
      {
           session_inc_s2c_metrics(sess, 1, len);
+          if (session_get0_s2c_1st_pkt(sess) == NULL)
+          {
+               session_set_s2c_1st_pkt(sess, pkt);
+          }
      }
-     session_update_packet_exdata(sess, pkt, curr_dir);
-     session_update_pktmeta_exdata(sess, md, curr_dir);
      session_set0_cur_pkt(sess, pkt);
      session_set_cur_dir(sess, curr_dir);
      session_set_last_time(sess, timestamp_get_msec());
 }
 
-// OK
-static inline void session_manager_update_session_on_closing(struct session_manager *mgr, struct session *sess, enum closing_reasion reasion)
+static void session_manager_update_udp_to_active(struct session_manager *mgr, struct session *sess)
+{
+     session_manager_update_session_state(mgr, sess, SESSION_STATE_ACTIVE);
+     session_manager_update_session_timer(mgr, sess, udp_data_timeout_cb, mgr->config.udp_timeout_data);
+}
+
+static void session_manager_update_udp_to_closing(struct session_manager *mgr, struct session *sess)
 {
      session_manager_update_session_state(mgr, sess, SESSION_STATE_CLOSING);
-     session_set_closing_reasion(sess, reasion);
      session_timer_del_session(mgr->sess_timer, sess);
 }
 
-/******************************************************************************
- * handle session
- ******************************************************************************/
-
-// OK
-static void session_manager_free_session(struct session_manager *mgr, struct session *sess)
+static void session_manager_update_tcp_to_opening(struct session_manager *mgr, struct session *sess, int opening_by_syn)
 {
-     if (sess)
+     session_manager_update_session_state(mgr, sess, SESSION_STATE_OPENING);
+     if (opening_by_syn)
+     {
+          session_manager_update_session_timer(mgr, sess, tcp_init_timeout_cb, mgr->config.tcp_timeout_init);
+     }
+     else
+     {
+          session_manager_update_session_timer(mgr, sess, tcp_handshake_timeout_cb, mgr->config.tcp_timeout_handshake);
+     }
+}
+
+static void session_manager_update_tcp_to_active(struct session_manager *mgr, struct session *sess)
+{
+     session_manager_update_session_state(mgr, sess, SESSION_STATE_ACTIVE);
+     session_manager_update_session_timer(mgr, sess, tcp_data_timeout_cb, mgr->config.tcp_timeout_data);
+}
+
+static void session_manager_update_tcp_to_closing(struct session_manager *mgr, struct session *sess, int enable_time_wait)
+{
+     session_manager_update_session_state(mgr, sess, SESSION_STATE_CLOSING);
+     if (enable_time_wait)
+     {
+          session_manager_update_session_timer(mgr, sess, tcp_time_wait_timeout_cb, mgr->config.tcp_timeout_time_wait);
+     }
+     else
      {
-          session_manager_update_session_state(mgr, sess, SESSION_STATE_CLOSED);
-          for (uint8_t i = 0; i < EX_DATA_MAX_COUNT; i++)
-          {
-               session_free_ex_data(sess, i);
-          }
-          session_table_del_session(mgr->tcp_sess_table, session_get0_tuple6(sess));
           session_timer_del_session(mgr->sess_timer, sess);
-          session_set0_cur_pkt(sess, NULL);
-          session_set_cur_dir(sess, SESSION_DIR_NONE);
-          session_pool_free(mgr->sess_pool, sess);
-          sess = NULL;
      }
 }
 
-// OK
-static void session_manager_recycle_session(struct session_manager *mgr)
+static void session_manager_update_session_to_closed(struct session_manager *mgr, struct session *sess)
 {
-     while (1)
+     session_manager_update_session_state(mgr, sess, SESSION_STATE_CLOSED);
+     session_timer_del_session(mgr->sess_timer, sess);
+}
+
+static void session_manager_handle_udp_on_active(struct session_manager *mgr, struct session *sess)
+{
+     session_manager_update_session_timer(mgr, sess, udp_data_timeout_cb, mgr->config.udp_timeout_data);
+}
+
+static void session_manager_handle_udp_on_closing(struct session_manager *mgr, struct session *sess)
+{
+     assert(0);
+     session_manager_update_session_timer(mgr, sess, udp_data_timeout_cb, mgr->config.udp_timeout_data);
+}
+
+// opening -> opening
+// opening -> active
+// opening -> closing
+static void session_manager_handle_tcp_on_opening(struct session_manager *mgr, struct session *sess, enum tcp_state tcp_old_state, enum tcp_state tcp_curr_state)
+{
+     uint64_t tcp_mod_state = tcp_curr_state & (~tcp_old_state);
+
+     // opening -> closing
+     if ((tcp_curr_state & TCP_C2S_FIN_RECVED) && (tcp_curr_state & TCP_S2C_FIN_RECVED))
      {
-          struct session *sess = session_queue_pop(mgr->sess_toclosed_queue);
-          if (sess == NULL)
+          SESSION_LOG_DEBUG("TCP FIN-FIN received, session %lu opening -> closing", session_get_id(sess));
+          session_manager_update_tcp_to_closing(mgr, sess, 1);
+          return;
+     }
+     if (tcp_mod_state & (TCP_C2S_RST_RECVED | TCP_S2C_RST_RECVED))
+     {
+          SESSION_LOG_DEBUG("TCP %s RST received, session %lu opening -> closing", (tcp_curr_state & TCP_C2S_RST_RECVED ? "C2S" : "S2C"), session_get_id(sess));
+          session_set_closing_reasion(sess, (tcp_mod_state & TCP_C2S_RST_RECVED) ? CLOSING_BY_CLIENT_RST : CLOSING_BY_SERVER_RST);
+          session_manager_update_tcp_to_closing(mgr, sess, 1);
+          return;
+     }
+
+     // opening -> active
+     if (tcp_mod_state & (TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED))
+     {
+          SESSION_LOG_DEBUG("TCP %s DATA received, session %lu opening -> active", (tcp_curr_state & TCP_C2S_DATA_RECVED ? "C2S" : "S2C"), session_get_id(sess));
+          session_manager_update_tcp_to_active(mgr, sess);
+          return;
+     }
+
+     // opening -> opening
+     if (tcp_mod_state & (TCP_C2S_FIN_RECVED | TCP_S2C_FIN_RECVED))
+     {
+          SESSION_LOG_DEBUG("TCP %s FIN received, session %lu opening -> opening", (tcp_curr_state & TCP_C2S_FIN_RECVED ? "C2S" : "S2C"), session_get_id(sess));
+          // still opening, only update timeout
+          session_set_closing_reasion(sess, (tcp_mod_state & TCP_C2S_FIN_RECVED) ? CLOSING_BY_CLIENT_FIN : CLOSING_BY_SERVER_FIN);
+          session_manager_update_session_timer(mgr, sess, tcp_half_closed_timeout_cb, mgr->config.tcp_timeout_half_closed);
+          return;
+     }
+
+     if (tcp_mod_state & (TCP_C2S_ACK_RECVED | TCP_S2C_ACK_RECVED))
+     {
+          SESSION_LOG_DEBUG("TCP %s ACK received, session %lu opening -> opening", (tcp_curr_state & TCP_C2S_ACK_RECVED ? "C2S" : "S2C"), session_get_id(sess));
+          // still opening, only update timeout
+          session_manager_update_session_timer(mgr, sess, tcp_data_timeout_cb, mgr->config.tcp_timeout_data);
+          return;
+     }
+
+     if (tcp_mod_state & TCP_SYNACK_RECVED)
+     {
+          SESSION_LOG_DEBUG("TCP SYNACK received, session %lu opening -> opening", session_get_id(sess));
+          session_manager_update_tcp_to_opening(mgr, sess, 0);
+     }
+
+     if (tcp_mod_state == 0)
+     {
+          if (tcp_curr_state & TCP_SYN_RECVED)
           {
-               break;
+               SESSION_LOG_DEBUG("TCP SYN retransmission received, session %lu opening -> opening", session_get_id(sess));
+               session_manager_update_tcp_to_opening(mgr, sess, 1);
+          }
+
+          if (tcp_curr_state & TCP_SYNACK_RECVED)
+          {
+               SESSION_LOG_DEBUG("TCP SYNACK retransmission received, session %lu opening -> opening", session_get_id(sess));
+               session_manager_update_tcp_to_opening(mgr, sess, 0);
           }
-          session_manager_free_session(mgr, sess);
      }
 }
 
-// OK
-static void session_manager_evicte_session(struct session_manager *mgr, struct session *sess)
+// active -> active
+// active -> closing
+static void session_manager_handle_tcp_on_active(struct session_manager *mgr, struct session *sess, enum tcp_state tcp_old_state, enum tcp_state tcp_curr_state)
 {
-     session_manager_update_session_on_closing(mgr, sess, CLOSING_BY_EVICTED);
-
-     session_table_del_session(mgr->tcp_sess_table, session_get0_tuple6(sess));
-     session_queue_push(mgr->sess_evicted_queue, sess);
-
-     if (session_get_type(sess) == SESSION_TYPE_UDP)
+     // active -> closing
+     if ((tcp_curr_state & TCP_C2S_FIN_RECVED) && (tcp_curr_state | TCP_S2C_FIN_RECVED))
      {
-          eviction_filter_add(mgr->udp_eviction_filter, session_get0_1st_pkt(sess));
+          SESSION_LOG_DEBUG("TCP FIN-FIN received, session %lu active -> closing", session_get_id(sess));
+          session_manager_update_tcp_to_closing(mgr, sess, 1);
+          return;
      }
+     if (tcp_curr_state & (TCP_C2S_RST_RECVED | TCP_S2C_RST_RECVED))
+     {
+          SESSION_LOG_DEBUG("TCP %s RST received, session %lu active -> closing", (tcp_curr_state & TCP_C2S_RST_RECVED) ? "C2S" : "S2C", session_get_id(sess));
+          session_set_closing_reasion(sess, (tcp_curr_state & TCP_C2S_RST_RECVED) ? CLOSING_BY_CLIENT_RST : CLOSING_BY_SERVER_RST);
+          session_manager_update_tcp_to_closing(mgr, sess, 1);
+          return;
+     }
+
+     // active -> active
+     if (tcp_curr_state & (TCP_C2S_FIN_RECVED | TCP_S2C_FIN_RECVED))
+     {
+          SESSION_LOG_DEBUG("TCP %s FIN received, session %lu active -> active", (tcp_curr_state & TCP_C2S_FIN_RECVED) ? "C2S" : "S2C", session_get_id(sess));
+          // still active
+          session_set_closing_reasion(sess, (tcp_curr_state & TCP_C2S_FIN_RECVED) ? CLOSING_BY_CLIENT_FIN : CLOSING_BY_SERVER_FIN);
+          session_manager_update_session_timer(mgr, sess, tcp_half_closed_timeout_cb, mgr->config.tcp_timeout_half_closed);
+          return;
+     }
+
+     // still active
+     session_manager_update_tcp_to_active(mgr, sess);
 }
 
-// OK
-static struct session *session_manager_handle_tcp_new_session(struct session_manager *mgr, const struct packet *pkt, const struct tuple6 *key)
+// closing -> closing
+// closing -> closed
+static void session_manager_handle_tcp_on_closing(struct session_manager *mgr, struct session *sess, enum tcp_state tcp_old_state, enum tcp_state tcp_curr_state)
+{
+     // still closing
+     session_manager_update_tcp_to_closing(mgr, sess, 1);
+}
+
+static struct session *session_manager_new_tcp_session(struct session_manager *mgr, const struct packet *pkt, const struct tuple6 *key)
 {
      const struct layer_record *tcp_layer = packet_get_innermost_layer(pkt, LAYER_TYPE_TCP);
      if (tcp_layer == NULL)
@@ -670,7 +782,7 @@ static struct session *session_manager_handle_tcp_new_session(struct session_man
      const struct tcphdr *hdr = (const struct tcphdr *)tcp_layer->hdr_ptr;
      if (!tcp_hdr_has_flag_syn(hdr))
      {
-          mgr->npkts_hit_tcp_evicted++;
+          mgr->npkts_hit_tcp_miss_sess++;
           return NULL;
      }
 
@@ -685,138 +797,19 @@ static struct session *session_manager_handle_tcp_new_session(struct session_man
      assert(sess);
 
      enum session_dir curr_dir = tcp_hdr_has_flag_ack(hdr) ? SESSION_DIR_S2C : SESSION_DIR_C2S;
-     session_manager_update_session_on_opening(mgr, sess, key, curr_dir);
-     session_manager_update_session_on_packet(mgr, sess, pkt, curr_dir);
-     session_update_tcp_exdata(sess, tcp_layer, curr_dir);
-     if (tcp_hdr_has_flag_ack(hdr))
-     {
-          session_set_expirecb(sess, tcp_handshake_timeout_cb, mgr, timestamp_get_sec() + mgr->config.tcp_timeout_handshake);
-     }
-     else
-     {
-          session_set_expirecb(sess, tcp_init_timeout_cb, mgr, timestamp_get_sec() + mgr->config.tcp_timeout_init);
-     }
-     session_timer_add_session(mgr->sess_timer, sess);
+     session_manager_update_session_base(mgr, sess, key, curr_dir);
+     session_manager_update_session_packet(mgr, sess, pkt, curr_dir);
+     session_update_tcp_state(sess, tcp_layer, curr_dir);
+
+     SESSION_LOG_DEBUG("TCP %s received, session %lu init -> opening", (curr_dir == SESSION_DIR_C2S ? "SYN" : "SYNACK"), session_get_id(sess));
+     session_manager_update_tcp_to_opening(mgr, sess, curr_dir == SESSION_DIR_C2S);
+     session_table_add_session(mgr->tcp_sess_table, key, sess);
      dupkt_filter_add(mgr->tcp_dupkt_filter, pkt);
 
      return sess;
 }
 
-// OK
-static struct session *session_manager_handle_tcp_old_session(struct session_manager *mgr, struct session *sess, const struct packet *pkt, const struct tuple6 *key)
-{
-     if (session_get_state(sess) == SESSION_STATE_CLOSING)
-     {
-          mgr->npkts_hit_tcp_closing++;
-          return NULL;
-     }
-
-     const struct layer_record *tcp_layer = packet_get_innermost_layer(pkt, LAYER_TYPE_TCP);
-     if (tcp_layer == NULL)
-     {
-          mgr->npkts_miss_l4_proto++;
-          return NULL;
-     }
-
-     enum session_dir curr_dir = judge_direction_by_session(sess, key);
-     if (session_manager_filter_session_dupkt(mgr, sess, pkt, curr_dir))
-     {
-          mgr->npkts_hit_tcp_dupkt++;
-          session_set_dup_traffic_flag(sess, DUP_TRAFFIC_YES);
-          return NULL;
-     }
-
-     uint64_t tcp_old_exdata = (uint64_t)session_get0_ex_data(sess, tcp_builtin_ex);
-     session_manager_update_session_on_packet(mgr, sess, pkt, curr_dir);
-     session_update_tcp_exdata(sess, tcp_layer, curr_dir);
-     uint64_t tcp_curr_exdata = (uint64_t)session_get0_ex_data(sess, tcp_builtin_ex);
-
-     // update tcp session state & timeout callback
-
-     // TCP SYN retransmission
-     if (tcp_old_exdata == TCP_SYN_RECVED && tcp_curr_exdata == TCP_SYN_RECVED)
-     {
-          session_manager_update_session_state(mgr, sess, SESSION_STATE_OPENING);
-          session_set_expirecb(sess, tcp_init_timeout_cb, mgr, timestamp_get_sec() + mgr->config.tcp_timeout_init);
-          session_timer_add_session(mgr->sess_timer, sess);
-
-          return sess;
-     }
-
-     // TCP SYNACK retransmission & TCP S2C asymmetric
-     if (tcp_old_exdata == TCP_SYNACK_RECVED && tcp_curr_exdata == TCP_SYNACK_RECVED)
-     {
-          session_manager_update_session_state(mgr, sess, SESSION_STATE_OPENING);
-          session_set_expirecb(sess, tcp_handshake_timeout_cb, mgr, timestamp_get_sec() + mgr->config.tcp_timeout_handshake);
-          session_timer_add_session(mgr->sess_timer, sess);
-
-          return sess;
-     }
-
-     // TCP handshake success
-     if (!(tcp_old_exdata & TCP_SYNACK_RECVED) && (tcp_curr_exdata & TCP_SYNACK_RECVED))
-     {
-          session_manager_update_session_state(mgr, sess, SESSION_STATE_OPENING);
-          session_set_expirecb(sess, tcp_handshake_timeout_cb, mgr, timestamp_get_sec() + mgr->config.tcp_timeout_handshake);
-          session_timer_add_session(mgr->sess_timer, sess);
-
-          return sess;
-     }
-
-     // TCP established
-     if ((tcp_curr_exdata & TCP_C2S_DATA_RECVED) || (tcp_curr_exdata & TCP_S2C_DATA_RECVED))
-     {
-          session_manager_update_session_state(mgr, sess, SESSION_STATE_ACTIVE);
-          session_set_expirecb(sess, tcp_data_timeout_cb, mgr, timestamp_get_sec() + mgr->config.tcp_timeout_data);
-          session_timer_add_session(mgr->sess_timer, sess);
-
-          return sess;
-     }
-
-     // TCP closing
-     if ((tcp_curr_exdata & TCP_C2S_RST_RECVED) || (tcp_curr_exdata & TCP_S2C_RST_RECVED) || ((tcp_curr_exdata & TCP_C2S_FIN_RECVED) && (tcp_curr_exdata & TCP_S2C_FIN_RECVED)))
-     {
-          if (tcp_curr_exdata & TCP_C2S_RST_RECVED)
-          {
-               session_set_closing_reasion(sess, CLOSING_BY_CLIENT_RST);
-          }
-          else if (tcp_curr_exdata & TCP_S2C_RST_RECVED)
-          {
-               session_set_closing_reasion(sess, CLOSING_BY_SERVER_RST);
-          }
-          session_manager_update_session_state(mgr, sess, SESSION_STATE_CLOSING);
-
-          return sess;
-     }
-
-     // TCP half closed
-     if ((tcp_curr_exdata & TCP_C2S_FIN_RECVED) || (tcp_curr_exdata & TCP_S2C_FIN_RECVED))
-     {
-          if (tcp_curr_exdata & TCP_C2S_FIN_RECVED)
-          {
-               session_set_closing_reasion(sess, CLOSING_BY_CLIENT_FIN);
-          }
-          else if (tcp_curr_exdata & TCP_S2C_FIN_RECVED)
-          {
-               session_set_closing_reasion(sess, CLOSING_BY_SERVER_FIN);
-          }
-          // session still is active
-          session_manager_update_session_state(mgr, sess, SESSION_STATE_ACTIVE);
-          session_set_expirecb(sess, tcp_half_closed_timeout_cb, mgr, timestamp_get_sec() + mgr->config.tcp_timeout_half_closed);
-          session_timer_add_session(mgr->sess_timer, sess);
-
-          return sess;
-     }
-
-     assert(0);
-     session_set_expirecb(sess, tcp_data_timeout_cb, mgr, timestamp_get_sec() + mgr->config.tcp_timeout_data);
-     session_timer_add_session(mgr->sess_timer, sess);
-
-     return sess;
-}
-
-// OK
-static struct session *session_manager_handle_udp_new_session(struct session_manager *mgr, const struct packet *pkt, const struct tuple6 *key)
+static struct session *session_manager_new_udp_session(struct session_manager *mgr, const struct packet *pkt, const struct tuple6 *key)
 {
      if (eviction_filter_lookup(mgr->udp_eviction_filter, pkt))
      {
@@ -835,40 +828,129 @@ static struct session *session_manager_handle_udp_new_session(struct session_man
      assert(sess);
 
      enum session_dir curr_dir = judge_direction_by_tuple6(key);
-     session_manager_update_session_on_opening(mgr, sess, key, curr_dir);
-     session_manager_update_session_on_packet(mgr, sess, pkt, curr_dir);
-     session_manager_update_session_state(mgr, sess, SESSION_STATE_ACTIVE); // change session state to active
-     session_update_udp_exdata(sess, NULL, curr_dir);
-     session_set_expirecb(sess, udp_data_timeout_cb, mgr, timestamp_get_sec() + mgr->config.udp_timeout_data);
-     session_timer_add_session(mgr->sess_timer, sess);
+     session_manager_update_session_base(mgr, sess, key, curr_dir);
+     session_manager_update_session_packet(mgr, sess, pkt, curr_dir);
+     session_update_udp_state(sess, NULL, curr_dir);
+     session_manager_update_udp_to_active(mgr, sess); // change session state to active
+     session_table_add_session(mgr->udp_sess_table, key, sess);
 
      return sess;
 }
 
-// OK
-static struct session *session_manager_handle_udp_old_session(struct session_manager *mgr, struct session *sess, const struct packet *pkt, const struct tuple6 *key)
+static struct session *session_manager_update_tcp_session(struct session_manager *mgr, struct session *sess, const struct packet *pkt, const struct tuple6 *key)
 {
-     if (session_get_state(sess) == SESSION_STATE_CLOSING)
+     const struct layer_record *tcp_layer = packet_get_innermost_layer(pkt, LAYER_TYPE_TCP);
+     if (tcp_layer == NULL)
      {
-          mgr->npkts_hit_udp_evicted++;
+          mgr->npkts_miss_l4_proto++;
           return NULL;
      }
 
      enum session_dir curr_dir = judge_direction_by_session(sess, key);
-     session_manager_update_session_on_packet(mgr, sess, pkt, curr_dir);
-     session_manager_update_session_state(mgr, sess, SESSION_STATE_ACTIVE);
-     session_update_udp_exdata(sess, NULL, curr_dir);
-     session_set_expirecb(sess, udp_data_timeout_cb, mgr, timestamp_get_sec() + mgr->config.udp_timeout_data);
-     session_timer_add_session(mgr->sess_timer, sess);
+     if (session_manager_update_tcp_filter(mgr, sess, pkt, curr_dir))
+     {
+          mgr->npkts_hit_tcp_dupkt++;
+          session_set_dup_traffic_flag(sess, DUP_TRAFFIC_YES);
+          return NULL;
+     }
+
+     enum session_state sess_state = session_get_state(sess);
+     enum tcp_state tcp_old_state = session_get_tcp_state(sess);
+     session_manager_update_session_packet(mgr, sess, pkt, curr_dir);
+     session_update_tcp_state(sess, tcp_layer, curr_dir);
+     enum tcp_state tcp_curr_state = session_get_tcp_state(sess);
+
+     switch (sess_state)
+     {
+     case SESSION_STATE_OPENING:
+          session_manager_handle_tcp_on_opening(mgr, sess, tcp_old_state, tcp_curr_state);
+          break;
+     case SESSION_STATE_ACTIVE:
+          session_manager_handle_tcp_on_active(mgr, sess, tcp_old_state, tcp_curr_state);
+          break;
+     case SESSION_STATE_CLOSING:
+          session_manager_handle_tcp_on_closing(mgr, sess, tcp_old_state, tcp_curr_state);
+          break;
+     case SESSION_STATE_CLOSED:
+          assert(0);
+          break;
+     default:
+          break;
+     }
 
      return sess;
 }
 
+static struct session *session_manager_update_udp_session(struct session_manager *mgr, struct session *sess, const struct packet *pkt, const struct tuple6 *key)
+{
+     enum session_dir curr_dir = judge_direction_by_session(sess, key);
+     session_manager_update_session_packet(mgr, sess, pkt, curr_dir);
+     session_update_udp_state(sess, NULL, curr_dir);
+     enum session_state sess_state = session_get_state(sess);
+
+     switch (sess_state)
+     {
+     case SESSION_STATE_OPENING:
+          assert(0);
+          break;
+     case SESSION_STATE_ACTIVE:
+          session_manager_handle_udp_on_active(mgr, sess);
+          return sess;
+     case SESSION_STATE_CLOSING:
+          session_manager_handle_udp_on_closing(mgr, sess);
+          break;
+     case SESSION_STATE_CLOSED:
+          assert(0);
+          break;
+     }
+
+     return sess;
+}
+
+static void session_manager_free_session(struct session_manager *mgr, struct session *sess)
+{
+     if (sess)
+     {
+          SESSION_LOG_DEBUG("%s, session %lu closing -> closed", session_closing_reasion_tostring(session_get_closing_reasion(sess)), session_get_id(sess));
+          session_manager_update_session_to_closed(mgr, sess);
+          session_table_del_session(mgr->tcp_sess_table, session_get0_key(sess));
+          session_set0_cur_pkt(sess, NULL);
+          session_set_cur_dir(sess, SESSION_DIR_NONE);
+          session_free(sess);
+          session_pool_free(mgr->sess_pool, sess);
+          sess = NULL;
+     }
+}
+
+static void session_manager_recycle_session(struct session_manager *mgr)
+{
+     while (1)
+     {
+          struct session *sess = session_queue_pop(mgr->sess_toclosed_queue);
+          if (sess == NULL)
+          {
+               break;
+          }
+          session_manager_free_session(mgr, sess);
+     }
+}
+
+static void session_manager_evicte_session(struct session_manager *mgr, struct session *sess)
+{
+     session_set_closing_reasion(sess, CLOSING_BY_EVICTED);
+     session_manager_update_tcp_to_closing(mgr, sess, 0);
+     session_queue_push(mgr->sess_evicted_queue, sess);
+
+     if (session_get_type(sess) == SESSION_TYPE_UDP)
+     {
+          eviction_filter_add(mgr->udp_eviction_filter, session_get0_1st_pkt(sess));
+     }
+}
+
 /******************************************************************************
- * public API
+ * Public API
  ******************************************************************************/
 
-// OK
 struct session_manager *session_manager_create(struct session_manager_config *config)
 {
      if (session_manager_check_config(config))
@@ -931,14 +1013,6 @@ struct session_manager *session_manager_create(struct session_manager_config *co
           goto error;
      }
 
-     // init builtin session ex data index
-     tcp_builtin_ex = session_get_ex_new_index("tcp_builtin_ex", NULL, NULL);
-     udp_builtin_ex = session_get_ex_new_index("udp_builtin_ex", NULL, NULL);
-     c2s_1st_md_ex = session_get_ex_new_index("c2s_1st_md_ex", session_free_pktmeta_exdata, NULL);
-     s2c_1st_md_ex = session_get_ex_new_index("s2c_1st_md_ex", session_free_pktmeta_exdata, NULL);
-     c2s_1st_pkt_ex = session_get_ex_new_index("c2s_1st_pkt_ex", session_free_packet_exdata, NULL);
-     s2c_1st_pkt_ex = session_get_ex_new_index("s2c_1st_pkt_ex", session_free_packet_exdata, NULL);
-
      return mgr;
 
 error:
@@ -946,7 +1020,6 @@ error:
      return NULL;
 }
 
-// OK
 void session_manager_destroy(struct session_manager *mgr)
 {
      if (mgr)
@@ -964,8 +1037,7 @@ void session_manager_destroy(struct session_manager *mgr)
      }
 }
 
-// OK
-// Only use the packet six-tuple to find the session, not update it
+// only use the packet six-tuple to find the session, not update it
 struct session *session_manager_lookup_sesssion(struct session_manager *mgr, const struct packet *pkt)
 {
      struct tuple6 key;
@@ -989,7 +1061,6 @@ struct session *session_manager_lookup_sesssion(struct session_manager *mgr, con
      }
 }
 
-// OK
 /*
  * Return NULL in the following cases:
  *      1.not a TCP or UDP packet
@@ -1019,11 +1090,11 @@ struct session *session_manager_update_session(struct session_manager *mgr, cons
           sess = session_table_find_session(mgr->udp_sess_table, &key);
           if (sess)
           {
-               return session_manager_handle_udp_old_session(mgr, sess, pkt, &key);
+               return session_manager_update_udp_session(mgr, sess, pkt, &key);
           }
           else
           {
-               return session_manager_handle_udp_new_session(mgr, pkt, &key);
+               return session_manager_new_udp_session(mgr, pkt, &key);
           }
      }
      else if (key.ip_proto == IPPROTO_TCP)
@@ -1031,11 +1102,11 @@ struct session *session_manager_update_session(struct session_manager *mgr, cons
           sess = session_table_find_session(mgr->tcp_sess_table, &key);
           if (sess)
           {
-               return session_manager_handle_tcp_old_session(mgr, sess, pkt, &key);
+               return session_manager_update_tcp_session(mgr, sess, pkt, &key);
           }
           else
           {
-               return session_manager_handle_tcp_new_session(mgr, pkt, &key);
+               return session_manager_new_tcp_session(mgr, pkt, &key);
           }
      }
      else
@@ -1044,23 +1115,29 @@ struct session *session_manager_update_session(struct session_manager *mgr, cons
      }
 }
 
-// OK
 struct session *session_manager_get_expired_session(struct session_manager *mgr)
 {
      session_manager_recycle_session(mgr);
 
-     SESSION_LOG_DEBUG("current timestamp: %lu s", timestamp_get_sec());
      struct session *sess = session_timer_expire_session(mgr->sess_timer, timestamp_get_msec());
-     if (sess == NULL)
+     if (sess)
      {
           session_run_expirecb(sess);
-          session_queue_push(mgr->sess_toclosed_queue, sess);
+
+          if (session_get_state(sess) == SESSION_STATE_CLOSED)
+          {
+               return NULL;
+          }
+
+          if (session_get_type(sess) == SESSION_TYPE_UDP)
+          {
+               session_queue_push(mgr->sess_toclosed_queue, sess);
+          }
      }
 
      return sess;
 }
 
-// OK
 struct session *session_manager_get_evicted_session(struct session_manager *mgr)
 {
      session_manager_recycle_session(mgr);
@@ -1074,14 +1151,12 @@ struct session *session_manager_get_evicted_session(struct session_manager *mgr)
      return sess;
 }
 
-// OK
 // return interval (seconds) to next required update, return 0 if no session
 uint64_t session_manager_get_expire_interval(struct session_manager *mgr)
 {
      return session_timer_next_expire_interval(mgr->sess_timer);
 }
 
-// OK
 uint64_t session_manager_get_session_number(struct session_manager *mgr, enum session_type type, enum session_state state)
 {
      if (type == SESSION_TYPE_TCP)
@@ -1115,3 +1190,26 @@ uint64_t session_manager_get_session_number(struct session_manager *mgr, enum se
 
      return 0;
 }
+
+void session_manager_print_status(struct session_manager *mgr)
+{
+     printf("session status:\n");
+
+     printf("tcp session number    : %lu\n", mgr->tcp_sess_num);
+     printf("    opening number    : %lu\n", mgr->tcp_opening_sess_num);
+     printf("    active number     : %lu\n", mgr->tcp_active_sess_num);
+     printf("    closing number    : %lu\n", mgr->tcp_closing_sess_num);
+     printf("udp session number    : %lu\n", mgr->udp_sess_num);
+     printf("    opening number    : %lu\n", mgr->udp_opening_sess_num);
+     printf("    active number     : %lu\n", mgr->udp_active_sess_num);
+     printf("    closing number    : %lu\n", mgr->udp_closing_sess_num);
+
+     printf("packet status:\n");
+     printf("    miss l4 proto     : %lu  (bypass)\n", mgr->npkts_miss_l4_proto);
+
+     printf("    hit tcp miss sess : %lu  (bypass)\n", mgr->npkts_hit_tcp_miss_sess);
+     printf("    hit tcp dupkt     : %lu  (bypass)\n", mgr->npkts_hit_tcp_dupkt);
+     printf("    hit tcp discard   : %lu  (drop)\n", mgr->npkts_hit_tcp_discard);
+
+     printf("    hit udp evicted   : %lu  (bypass)\n", mgr->npkts_hit_udp_evicted);
+}
\ No newline at end of file
diff --git a/src/session/session_manager.h b/src/session/session_manager.h
index 8e762ae..bf3bbb5 100644
--- a/src/session/session_manager.h
+++ b/src/session/session_manager.h
@@ -28,6 +28,7 @@ struct session_manager_config
     uint64_t tcp_timeout_handshake;   // seconds, Range: 1-60
     uint64_t tcp_timeout_data;        // seconds, Range: 1-15,999,999
     uint64_t tcp_timeout_half_closed; // seconds, Range: 1-604,800
+    uint64_t tcp_timeout_time_wait;   // seconds, Range: 1-600
     uint64_t tcp_timeout_discard;     // seconds, Range: 1-15,999,999
 
     // UDP timeout
@@ -68,6 +69,8 @@ struct session *session_manager_get_evicted_session(struct session_manager *mgr)
 uint64_t session_manager_get_expire_interval(struct session_manager *mgr);
 uint64_t session_manager_get_session_number(struct session_manager *mgr, enum session_type type, enum session_state state);
 
+void session_manager_print_status(struct session_manager *mgr);
+
 #ifdef __cpluscplus
 }
 #endif
diff --git a/src/session/session_private.h b/src/session/session_private.h
index 4e3dbd6..e9682d1 100644
--- a/src/session/session_private.h
+++ b/src/session/session_private.h
@@ -16,28 +16,6 @@ extern "C"
 
 #define EX_DATA_MAX_COUNT 128
 
-enum tcp_ex_data
-{
-    // HANDSHAKE
-    TCP_SYN_RECVED = 1 << 0,
-    TCP_SYNACK_RECVED = 1 << 1,
-    // ESTABLISHED
-    TCP_C2S_DATA_RECVED = 1 << 2,
-    TCP_S2C_DATA_RECVED = 1 << 3,
-    // FIN
-    TCP_C2S_FIN_RECVED = 1 << 4,
-    TCP_S2C_FIN_RECVED = 1 << 5,
-    // RST
-    TCP_C2S_RST_RECVED = 1 << 6,
-    TCP_S2C_RST_RECVED = 1 << 7,
-};
-
-enum udp_ex_data
-{
-    UDP_C2S_RECVED = 1 << 0,
-    UDP_S2C_RECVED = 1 << 1,
-};
-
 struct session
 {
     // session id
@@ -65,6 +43,14 @@ struct session
     uint64_t create_time;
     uint64_t last_time;
 
+    // session l4 state
+    enum tcp_state tcp_state;
+    enum udp_state udp_state;
+
+    // session packet
+    struct packet *c2s_1st_pkt;
+    struct packet *s2c_1st_pkt;
+
     /******************************
      * Session Current Packet
      ******************************/
@@ -117,13 +103,6 @@ struct session
     struct session *next_ready_ptr;
 };
 
-extern uint8_t tcp_builtin_ex;
-extern uint8_t udp_builtin_ex;
-extern uint8_t c2s_1st_md_ex;
-extern uint8_t s2c_1st_md_ex;
-extern uint8_t c2s_1st_pkt_ex;
-extern uint8_t s2c_1st_pkt_ex;
-
 #ifdef __cpluscplus
 }
 #endif
diff --git a/src/session/session_table.cpp b/src/session/session_table.cpp
index 2c47e33..f64f59b 100644
--- a/src/session/session_table.cpp
+++ b/src/session/session_table.cpp
@@ -203,6 +203,13 @@ struct session *session_table_find_session(struct session_table *table, const st
 
     struct session *sess = NULL;
     HASH_FIND(hh, table->root, tuple, sizeof(struct tuple6), sess);
+    if (sess == NULL)
+    {
+        struct tuple6 out;
+        memset(&out, 0, sizeof(struct tuple6));
+        tuple6_reverse(tuple, &out);
+        HASH_FIND(hh, table->root, &out, sizeof(struct tuple6), sess);
+    }
 
     if (sess)
     {
diff --git a/src/session/test/CMakeLists.txt b/src/session/test/CMakeLists.txt
index 1438b24..fcd1cfa 100644
--- a/src/session/test/CMakeLists.txt
+++ b/src/session/test/CMakeLists.txt
@@ -17,8 +17,8 @@ target_link_libraries(gtest_session_timer session_manager gtest)
 add_executable(gtest_session_queue gtest_session_queue.cpp)
 target_link_libraries(gtest_session_queue session_manager gtest)
 
-add_executable(gtest_session_manager gtest_session_manager.cpp)
-target_link_libraries(gtest_session_manager session_manager gtest)
+add_executable(gtest_tcp_init_to_opening gtest_tcp_init_to_opening.cpp)
+target_link_libraries(gtest_tcp_init_to_opening session_manager gtest)
 
 include(GoogleTest)
 gtest_discover_tests(gtest_session)
@@ -26,4 +26,4 @@ gtest_discover_tests(gtest_session_pool)
 gtest_discover_tests(gtest_session_table)
 gtest_discover_tests(gtest_session_timer)
 gtest_discover_tests(gtest_session_queue)
-gtest_discover_tests(gtest_session_manager)
\ No newline at end of file
+gtest_discover_tests(gtest_tcp_init_to_opening)
\ No newline at end of file
diff --git a/src/session/test/gtest_session_manager.cpp b/src/session/test/gtest_session_manager.cpp
index 24d7ae6..5177474 100644
--- a/src/session/test/gtest_session_manager.cpp
+++ b/src/session/test/gtest_session_manager.cpp
@@ -5,6 +5,34 @@
 #include "timestamp.h"
 #include "test_packets.h"
 
+struct session_manager_config config = {
+    // max session number
+    .max_tcp_session_num = 10,
+    .max_udp_session_num = 10,
+
+    // tcp timeout
+    .tcp_timeout_init = 10,
+    .tcp_timeout_handshake = 10,
+    .tcp_timeout_data = 10,
+    .tcp_timeout_half_closed = 10,
+    .tcp_timeout_discard = 10,
+
+    // udp timeout
+    .udp_timeout_data = 10,
+
+    // tcp duplicate packet filter
+    .tcp_dupkt_filter_enable = 1,
+    .tcp_dupkt_filter_capacity = 1000,
+    .tcp_dupkt_filter_timeout = 10,
+    .tcp_dupkt_filter_error_rate = 0.0001,
+
+    // udp eviction filter
+    .udp_eviction_filter_enable = 1,
+    .udp_eviction_filter_capacity = 1000,
+    .udp_eviction_filter_timeout = 10,
+    .udp_eviction_filter_error_rate = 0.0001,
+};
+
 /******************************************************************************
  * plugin
  ******************************************************************************/
@@ -49,162 +77,6 @@ static void __session_dispatch(struct session *sess)
     session_set_cur_dir(sess, SESSION_DIR_NONE);
 }
 
-/******************************************************************************
- * test case: INIT -> OPENING
- ******************************************************************************/
-
-#if 1
-/*
- * packet: tcp syn packet
- *
- * note: the syn packet can trigger a change in session status from INIT to OPENING
- *       only trigger OPENING event
- */
-TEST(SESSION_MANAGER, INIT_TO_OPENING_BY_SYN)
-{
-    char buffer[1024];
-    uint64_t max_session_num = 16;
-    struct packet pkt;
-    struct session *sess = NULL;
-    struct session_manager *mgr = NULL;
-
-    timestamp_update();
-    plugin_init();
-
-    mgr = session_manager_create(max_session_num);
-    EXPECT_TRUE(mgr != NULL);
-    session_manager_set_timeout_toclosing(mgr, 1000);
-    session_manager_set_timeout_toclosed(mgr, 2000);
-
-    packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
-    sess = session_manager_update(mgr, &pkt);
-    EXPECT_TRUE(sess);
-
-    // check session info
-    EXPECT_TRUE(session_get_id(sess) == 0);
-    memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
-    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
-    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
-    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
-    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
-    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
-    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
-    EXPECT_TRUE(session_get_create_time(sess) != 0);
-    EXPECT_TRUE(session_get_last_time(sess) != 0);
-    EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
-    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
-    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == TCP_SYN_RECVED);
-
-    // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
-
-    __session_dispatch(sess);
-    for (int i = 0; i < 4; i++)
-    {
-        timestamp_update();
-        __session_dispatch(session_manager_expire(mgr));
-        __session_dispatch(session_manager_evicte(mgr));
-        sleep(1);
-    }
-
-    // check sess mgr
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
-
-    // destory
-    session_manager_destroy(mgr);
-}
-#endif
-
-#if 1
-/*
- * packet: tcp synack packet
- *
- * note: the synack packet can trigger a change in session status from INIT to OPENING
- *       only trigger OPENING event
- */
-TEST(SESSION_MANAGER, INIT_TO_OPENING_BY_SYNACK)
-{
-    char buffer[1024];
-    uint64_t max_session_num = 16;
-    struct packet pkt;
-    struct session *sess = NULL;
-    struct session_manager *mgr = NULL;
-
-    timestamp_update();
-    plugin_init();
-
-    mgr = session_manager_create(max_session_num);
-    EXPECT_TRUE(mgr != NULL);
-    session_manager_set_timeout_toclosing(mgr, 1000);
-    session_manager_set_timeout_toclosed(mgr, 2000);
-
-    packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
-    sess = session_manager_update(mgr, &pkt);
-    EXPECT_TRUE(sess);
-
-    // check session info
-    EXPECT_TRUE(session_get_id(sess) == 0);
-    memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
-    EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
-    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
-    EXPECT_TRUE(session_get_c2s_bytes(sess) == 0);
-    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
-    EXPECT_TRUE(session_get_c2s_packets(sess) == 0);
-    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get_create_time(sess) != 0);
-    EXPECT_TRUE(session_get_last_time(sess) != 0);
-    EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
-    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
-    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == TCP_SYNACK_RECVED);
-
-    // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
-
-    __session_dispatch(sess);
-    for (int i = 0; i < 4; i++)
-    {
-        timestamp_update();
-        __session_dispatch(session_manager_expire(mgr));
-        __session_dispatch(session_manager_evicte(mgr));
-        sleep(1);
-    }
-
-    // check sess mgr
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
-
-    // destory
-    session_manager_destroy(mgr);
-}
-#endif
-
 /******************************************************************************
  * test case: INIT -> ACTIVE
  ******************************************************************************/
@@ -219,7 +91,7 @@ TEST(SESSION_MANAGER, INIT_TO_OPENING_BY_SYNACK)
 TEST(SESSION_MANAGER, INIT_TO_ACTIVE_BY_UDP_C2S)
 {
     char buffer[1024];
-    uint64_t max_session_num = 16;
+
     struct packet pkt;
     struct session *sess = NULL;
     struct session_manager *mgr = NULL;
@@ -227,21 +99,19 @@ TEST(SESSION_MANAGER, INIT_TO_ACTIVE_BY_UDP_C2S)
     timestamp_update();
     plugin_init();
 
-    mgr = session_manager_create(max_session_num);
+    mgr = session_manager_create(&config);
     EXPECT_TRUE(mgr != NULL);
-    session_manager_set_timeout_toclosing(mgr, 1000);
-    session_manager_set_timeout_toclosed(mgr, 2000);
 
     packet_parse(&pkt, (const char *)udp_pkt1_dns_req, sizeof(udp_pkt1_dns_req));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:61099 -> 121.14.154.93:53, proto: 17, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 74);
@@ -253,32 +123,32 @@ TEST(SESSION_MANAGER, INIT_TO_ACTIVE_BY_UDP_C2S)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, udp_builtin_ex) == UDP_C2S_RECVED);
+    EXPECT_TRUE(session_get_udp_state(sess) == UDP_C2S_RECVED);
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 1);
 
     __session_dispatch(sess);
     for (int i = 0; i < 4; i++)
     {
         timestamp_update();
-        __session_dispatch(session_manager_expire(mgr));
-        __session_dispatch(session_manager_evicte(mgr));
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
         sleep(1);
     }
 
     // check sess mgr
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     // destory
     session_manager_destroy(mgr);
@@ -295,7 +165,7 @@ TEST(SESSION_MANAGER, INIT_TO_ACTIVE_BY_UDP_C2S)
 TEST(SESSION_MANAGER, INIT_TO_ACTIVE_BY_UDP_S2C)
 {
     char buffer[1024];
-    uint64_t max_session_num = 16;
+
     struct packet pkt;
     struct session *sess = NULL;
     struct session_manager *mgr = NULL;
@@ -303,21 +173,19 @@ TEST(SESSION_MANAGER, INIT_TO_ACTIVE_BY_UDP_S2C)
     timestamp_update();
     plugin_init();
 
-    mgr = session_manager_create(max_session_num);
+    mgr = session_manager_create(&config);
     EXPECT_TRUE(mgr != NULL);
-    session_manager_set_timeout_toclosing(mgr, 1000);
-    session_manager_set_timeout_toclosed(mgr, 2000);
 
     packet_parse(&pkt, (const char *)udp_pkt2_dns_resp, sizeof(udp_pkt2_dns_resp));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "121.14.154.93:53 -> 192.168.38.105:61099, proto: 17, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_S2C);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 0);
@@ -329,32 +197,32 @@ TEST(SESSION_MANAGER, INIT_TO_ACTIVE_BY_UDP_S2C)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, udp_builtin_ex) == UDP_S2C_RECVED);
+    EXPECT_TRUE(session_get_udp_state(sess) == UDP_S2C_RECVED);
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 1);
 
     __session_dispatch(sess);
     for (int i = 0; i < 4; i++)
     {
         timestamp_update();
-        __session_dispatch(session_manager_expire(mgr));
-        __session_dispatch(session_manager_evicte(mgr));
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
         sleep(1);
     }
 
     // check sess mgr
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     // destory
     session_manager_destroy(mgr);
@@ -378,7 +246,7 @@ TEST(SESSION_MANAGER, INIT_TO_ACTIVE_BY_UDP_S2C)
 TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_C2S_PAYLOAD)
 {
     char buffer[1024];
-    uint64_t max_session_num = 16;
+
     struct packet pkt;
     struct session *sess = NULL;
     struct session_manager *mgr = NULL;
@@ -386,25 +254,23 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_C2S_PAYLOAD)
     timestamp_update();
     plugin_init();
 
-    mgr = session_manager_create(max_session_num);
+    mgr = session_manager_create(&config);
     EXPECT_TRUE(mgr != NULL);
-    session_manager_set_timeout_toclosing(mgr, 1000);
-    session_manager_set_timeout_toclosed(mgr, 2000);
 
     /**************************************************************************
      * syn packet
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
@@ -416,15 +282,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_C2S_PAYLOAD)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == TCP_SYN_RECVED);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYN_RECVED);
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer SYN Packet <=== \n\n");
     __session_dispatch(sess);
@@ -434,15 +300,18 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_C2S_PAYLOAD)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt4_c2s_http_req, sizeof(tcp_pkt4_c2s_http_req));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
+
+    session_manager_print_status(mgr);
+
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 145);
@@ -454,15 +323,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_C2S_PAYLOAD)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_C2S_DATA_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_C2S_DATA_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer C2S Payload Packet <=== \n\n");
     __session_dispatch(sess);
@@ -475,18 +344,18 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_C2S_PAYLOAD)
     for (int i = 0; i < 4; i++)
     {
         timestamp_update();
-        __session_dispatch(session_manager_expire(mgr));
-        __session_dispatch(session_manager_evicte(mgr));
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
         sleep(1);
     }
 
     // check sess mgr
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     // destory
     session_manager_destroy(mgr);
@@ -506,7 +375,7 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_C2S_PAYLOAD)
 TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_S2C_PAYLOAD)
 {
     char buffer[1024];
-    uint64_t max_session_num = 16;
+
     struct packet pkt;
     struct session *sess = NULL;
     struct session_manager *mgr = NULL;
@@ -514,25 +383,23 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_S2C_PAYLOAD)
     timestamp_update();
     plugin_init();
 
-    mgr = session_manager_create(max_session_num);
+    mgr = session_manager_create(&config);
     EXPECT_TRUE(mgr != NULL);
-    session_manager_set_timeout_toclosing(mgr, 1000);
-    session_manager_set_timeout_toclosed(mgr, 2000);
 
     /**************************************************************************
      * syn packet
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
@@ -544,15 +411,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_S2C_PAYLOAD)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == TCP_SYN_RECVED);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYN_RECVED);
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer SYN Packet <=== \n\n");
     __session_dispatch(sess);
@@ -562,15 +429,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_S2C_PAYLOAD)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt6_s2c_http_resq_1, sizeof(tcp_pkt6_s2c_http_resq_1));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
@@ -582,15 +449,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_S2C_PAYLOAD)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_S2C_DATA_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_S2C_DATA_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer C2S Payload Packet <=== \n\n");
     __session_dispatch(sess);
@@ -603,17 +470,17 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_S2C_PAYLOAD)
     for (int i = 0; i < 4; i++)
     {
         timestamp_update();
-        __session_dispatch(session_manager_expire(mgr));
-        __session_dispatch(session_manager_evicte(mgr));
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
         sleep(1);
     }
     // check sess mgr
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     // destory
     session_manager_destroy(mgr);
@@ -632,7 +499,7 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_S2C_PAYLOAD)
 TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_C2S_PAYLOAD)
 {
     char buffer[1024];
-    uint64_t max_session_num = 16;
+
     struct packet pkt;
     struct session *sess = NULL;
     struct session_manager *mgr = NULL;
@@ -640,25 +507,23 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_C2S_PAYLOAD)
     timestamp_update();
     plugin_init();
 
-    mgr = session_manager_create(max_session_num);
+    mgr = session_manager_create(&config);
     EXPECT_TRUE(mgr != NULL);
-    session_manager_set_timeout_toclosing(mgr, 1000);
-    session_manager_set_timeout_toclosed(mgr, 2000);
 
     /**************************************************************************
      * synack packet
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_S2C);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 0);
@@ -670,15 +535,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_C2S_PAYLOAD)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == TCP_SYNACK_RECVED);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYNACK_RECVED);
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer SYNACK Packet <=== \n\n");
     __session_dispatch(sess);
@@ -688,15 +553,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_C2S_PAYLOAD)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt4_c2s_http_req, sizeof(tcp_pkt4_c2s_http_req));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_S2C);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 145);
@@ -708,15 +573,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_C2S_PAYLOAD)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer C2S Payload Packet <=== \n\n");
     __session_dispatch(sess);
@@ -729,18 +594,18 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_C2S_PAYLOAD)
     for (int i = 0; i < 4; i++)
     {
         timestamp_update();
-        __session_dispatch(session_manager_expire(mgr));
-        __session_dispatch(session_manager_evicte(mgr));
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
         sleep(1);
     }
 
     // check sess mgr
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     // destory
     session_manager_destroy(mgr);
@@ -759,7 +624,7 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_C2S_PAYLOAD)
 TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_S2C_PAYLOAD)
 {
     char buffer[1024];
-    uint64_t max_session_num = 16;
+
     struct packet pkt;
     struct session *sess = NULL;
     struct session_manager *mgr = NULL;
@@ -767,25 +632,23 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_S2C_PAYLOAD)
     timestamp_update();
     plugin_init();
 
-    mgr = session_manager_create(max_session_num);
+    mgr = session_manager_create(&config);
     EXPECT_TRUE(mgr != NULL);
-    session_manager_set_timeout_toclosing(mgr, 1000);
-    session_manager_set_timeout_toclosed(mgr, 2000);
 
     /**************************************************************************
      * synack packet
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_S2C);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 0);
@@ -797,15 +660,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_S2C_PAYLOAD)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == TCP_SYNACK_RECVED);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYNACK_RECVED);
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer SYNACK Packet <=== \n\n");
     __session_dispatch(sess);
@@ -815,15 +678,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_S2C_PAYLOAD)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt6_s2c_http_resq_1, sizeof(tcp_pkt6_s2c_http_resq_1));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_S2C);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 0);
@@ -835,15 +698,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_S2C_PAYLOAD)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYNACK_RECVED | TCP_S2C_DATA_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYNACK_RECVED | TCP_S2C_DATA_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer S2C Payload Packet <=== \n\n");
     __session_dispatch(sess);
@@ -856,18 +719,18 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_S2C_PAYLOAD)
     for (int i = 0; i < 4; i++)
     {
         timestamp_update();
-        __session_dispatch(session_manager_expire(mgr));
-        __session_dispatch(session_manager_evicte(mgr));
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
         sleep(1);
     }
 
     // check sess mgr
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     // destory
     session_manager_destroy(mgr);
@@ -891,7 +754,7 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_S2C_PAYLOAD)
 TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOAD)
 {
     char buffer[1024];
-    uint64_t max_session_num = 16;
+
     struct packet pkt;
     struct session *sess = NULL;
     struct session_manager *mgr = NULL;
@@ -899,25 +762,23 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
     timestamp_update();
     plugin_init();
 
-    mgr = session_manager_create(max_session_num);
+    mgr = session_manager_create(&config);
     EXPECT_TRUE(mgr != NULL);
-    session_manager_set_timeout_toclosing(mgr, 1000);
-    session_manager_set_timeout_toclosed(mgr, 2000);
 
     /**************************************************************************
      * syn packet
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
@@ -929,15 +790,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == TCP_SYN_RECVED);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYN_RECVED);
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer SYN Packet <=== \n\n");
     __session_dispatch(sess);
@@ -947,15 +808,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
@@ -967,15 +828,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer SYNACK Packet <=== \n\n");
     __session_dispatch(sess);
@@ -985,15 +846,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt3_c2s_ack, sizeof(tcp_pkt3_c2s_ack));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66);
@@ -1005,15 +866,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer ACK Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1023,15 +884,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt4_c2s_http_req, sizeof(tcp_pkt4_c2s_http_req));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66 + 145);
@@ -1043,15 +904,15 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer C2S TCP Payload Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1064,17 +925,17 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
     for (int i = 0; i < 4; i++)
     {
         timestamp_update();
-        __session_dispatch(session_manager_expire(mgr));
-        __session_dispatch(session_manager_evicte(mgr));
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
         sleep(1);
     }
     // check sess mgr
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     // destory
     session_manager_destroy(mgr);
@@ -1194,7 +1055,7 @@ TEST(SESSION_MANAGER, TABLE_FULL_DISCARD)
 TEST(SESSION_MANAGER, TCP_FULL_STREAM)
 {
     char buffer[1024];
-    uint64_t max_session_num = 16;
+
     struct packet pkt;
     struct session *sess = NULL;
     struct session_manager *mgr = NULL;
@@ -1202,25 +1063,23 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     timestamp_update();
     plugin_init();
 
-    mgr = session_manager_create(max_session_num);
+    mgr = session_manager_create(&config);
     EXPECT_TRUE(mgr != NULL);
-    session_manager_set_timeout_toclosing(mgr, 1000);
-    session_manager_set_timeout_toclosed(mgr, 2000);
 
     /**************************************************************************
      * syn packet
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
@@ -1232,15 +1091,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == TCP_SYN_RECVED);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYN_RECVED);
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer SYN Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1250,15 +1109,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
@@ -1270,15 +1129,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer SYNACK Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1288,15 +1147,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt3_c2s_ack, sizeof(tcp_pkt3_c2s_ack));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66);
@@ -1308,15 +1167,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer ACK Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1326,15 +1185,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt4_c2s_http_req, sizeof(tcp_pkt4_c2s_http_req));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66 + 145);
@@ -1346,15 +1205,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer C2S HTTP Req Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1364,15 +1223,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt5_s2c_ack, sizeof(tcp_pkt5_s2c_ack));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66 + 145);
@@ -1384,15 +1243,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer S2C Ack Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1402,15 +1261,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt6_s2c_http_resq_1, sizeof(tcp_pkt6_s2c_http_resq_1));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66 + 145);
@@ -1422,15 +1281,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer S2C HTTP Resp Packet1 <=== \n\n");
     __session_dispatch(sess);
@@ -1440,15 +1299,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt7_s2c_http_resp_2, sizeof(tcp_pkt7_s2c_http_resp_2));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66 + 145);
@@ -1460,15 +1319,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer S2C HTTP Resp Packet2 <=== \n\n");
     __session_dispatch(sess);
@@ -1478,15 +1337,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt8_c2s_ack, sizeof(tcp_pkt8_c2s_ack));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66 + 145 + 66);
@@ -1498,15 +1357,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer C2S Ack Packet2 <=== \n\n");
     __session_dispatch(sess);
@@ -1516,15 +1375,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt9_c2s_fin, sizeof(tcp_pkt9_c2s_fin));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66 + 145 + 66 + 66);
@@ -1536,15 +1395,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED | TCP_C2S_FIN_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED | TCP_C2S_FIN_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer C2S FIN Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1554,15 +1413,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt10_s2c_fin, sizeof(tcp_pkt10_s2c_fin));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66 + 145 + 66 + 66);
@@ -1574,15 +1433,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED | TCP_C2S_FIN_RECVED | TCP_S2C_FIN_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED | TCP_C2S_FIN_RECVED | TCP_S2C_FIN_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer C2S FIN Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1592,15 +1451,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)tcp_pkt11_c2s_ack, sizeof(tcp_pkt11_c2s_ack));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66 + 145 + 66 + 66);
@@ -1612,15 +1471,15 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == NULL);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_NONE);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, tcp_builtin_ex) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED | TCP_C2S_FIN_RECVED | TCP_S2C_FIN_RECVED));
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_DATA_RECVED | TCP_S2C_DATA_RECVED | TCP_C2S_FIN_RECVED | TCP_S2C_FIN_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 1);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     printf("\n===> Atfer C2S ACK Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1633,18 +1492,18 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     for (int i = 0; i < 4; i++)
     {
         timestamp_update();
-        __session_dispatch(session_manager_expire(mgr));
-        __session_dispatch(session_manager_evicte(mgr));
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
         sleep(1);
     }
 
     // check sess mgr
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     // destory
     session_manager_destroy(mgr);
@@ -1663,7 +1522,7 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
 TEST(SESSION_MANAGER, UDP_FULL_STREAM)
 {
     char buffer[1024];
-    uint64_t max_session_num = 16;
+
     struct packet pkt;
     struct session *sess = NULL;
     struct session_manager *mgr = NULL;
@@ -1671,25 +1530,23 @@ TEST(SESSION_MANAGER, UDP_FULL_STREAM)
     timestamp_update();
     plugin_init();
 
-    mgr = session_manager_create(max_session_num);
+    mgr = session_manager_create(&config);
     EXPECT_TRUE(mgr != NULL);
-    session_manager_set_timeout_toclosing(mgr, 1000);
-    session_manager_set_timeout_toclosed(mgr, 2000);
 
     /**************************************************************************
      * UDP c2s packet
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)udp_pkt1_dns_req, sizeof(udp_pkt1_dns_req));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:61099 -> 121.14.154.93:53, proto: 17, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 74);
@@ -1701,15 +1558,15 @@ TEST(SESSION_MANAGER, UDP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, udp_builtin_ex) == UDP_C2S_RECVED);
+    EXPECT_TRUE(session_get_udp_state(sess) == UDP_C2S_RECVED);
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 1);
 
     printf("\n===> Atfer UDP c2s Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1719,15 +1576,15 @@ TEST(SESSION_MANAGER, UDP_FULL_STREAM)
      **************************************************************************/
 
     packet_parse(&pkt, (const char *)udp_pkt2_dns_resp, sizeof(udp_pkt2_dns_resp));
-    sess = session_manager_update(mgr, &pkt);
+    sess = session_manager_update_session(mgr, &pkt);
     EXPECT_TRUE(sess);
 
     // check session info
     EXPECT_TRUE(session_get_id(sess) == 0);
     memset(buffer, 0, sizeof(buffer));
-    tuple6_tostring(session_get0_tuple6(sess), buffer, sizeof(buffer));
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:61099 -> 121.14.154.93:53, proto: 17, domain: 0");
-    EXPECT_TRUE(session_get_tuple6_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_get_c2s_bytes(sess) == 74);
@@ -1739,15 +1596,15 @@ TEST(SESSION_MANAGER, UDP_FULL_STREAM)
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
     EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
     EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
-    EXPECT_TRUE((uint64_t)session_get0_ex_data(sess, udp_builtin_ex) == (UDP_C2S_RECVED | UDP_S2C_RECVED));
+    EXPECT_TRUE(session_get_udp_state(sess) == (UDP_C2S_RECVED | UDP_S2C_RECVED));
 
     // check session manager info
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 1);
 
     printf("\n===> Atfer UDP c2s Packet <=== \n\n");
     __session_dispatch(sess);
@@ -1759,18 +1616,18 @@ TEST(SESSION_MANAGER, UDP_FULL_STREAM)
     for (int i = 0; i < 4; i++)
     {
         timestamp_update();
-        __session_dispatch(session_manager_expire(mgr));
-        __session_dispatch(session_manager_evicte(mgr));
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
         sleep(1);
     }
 
     // check sess mgr
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
-    EXPECT_TRUE(session_manager_get_sessions(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
 
     // destory
     session_manager_destroy(mgr);
diff --git a/src/session/test/gtest_session_table.cpp b/src/session/test/gtest_session_table.cpp
index bd6c709..012cf57 100644
--- a/src/session/test/gtest_session_table.cpp
+++ b/src/session/test/gtest_session_table.cpp
@@ -77,17 +77,17 @@ TEST(SESSION_TABLE, OP_SESSION)
     sess1 = session_pool_alloc(sess_pool);
     EXPECT_TRUE(sess1 != NULL);
     session_set_id(sess1, 1);
-    session_set_tuple6(sess1, &tuple_1);
+    session_set_key(sess1, &tuple_1);
 
     sess2 = session_pool_alloc(sess_pool);
     EXPECT_TRUE(sess2 != NULL);
     session_set_id(sess2, 2);
-    session_set_tuple6(sess2, &tuple_2);
+    session_set_key(sess2, &tuple_2);
 
     sess3 = session_pool_alloc(sess_pool);
     EXPECT_TRUE(sess3 != NULL);
     session_set_id(sess3, 3);
-    session_set_tuple6(sess3, &tuple_3);
+    session_set_key(sess3, &tuple_3);
 
     EXPECT_TRUE(session_table_add_session(sess_table, &tuple_1, sess1) == 0);
     EXPECT_TRUE(session_table_get_count(sess_table) == 1);
@@ -153,7 +153,7 @@ TEST(SESSION_TABLE, FIND_OLDEST_NEWEST)
     sess1 = session_pool_alloc(sess_pool);
     EXPECT_TRUE(sess1 != NULL);
     session_set_id(sess1, 1);
-    session_set_tuple6(sess1, &tuple_1);
+    session_set_key(sess1, &tuple_1);
     EXPECT_TRUE(session_table_add_session(sess_table, &tuple_1, sess1) == 0);
     EXPECT_TRUE(session_table_find_least_recently_unused_session(sess_table) == sess1);
     EXPECT_TRUE(session_table_find_least_recently_used_session(sess_table) == sess1);
@@ -161,7 +161,7 @@ TEST(SESSION_TABLE, FIND_OLDEST_NEWEST)
     sess2 = session_pool_alloc(sess_pool);
     EXPECT_TRUE(sess2 != NULL);
     session_set_id(sess2, 2);
-    session_set_tuple6(sess2, &tuple_2);
+    session_set_key(sess2, &tuple_2);
     EXPECT_TRUE(session_table_add_session(sess_table, &tuple_2, sess2) == 0);
     EXPECT_TRUE(session_table_find_least_recently_unused_session(sess_table) == sess1);
     EXPECT_TRUE(session_table_find_least_recently_used_session(sess_table) == sess2);
@@ -169,7 +169,7 @@ TEST(SESSION_TABLE, FIND_OLDEST_NEWEST)
     sess3 = session_pool_alloc(sess_pool);
     EXPECT_TRUE(sess3 != NULL);
     session_set_id(sess3, 3);
-    session_set_tuple6(sess3, &tuple_3);
+    session_set_key(sess3, &tuple_3);
     EXPECT_TRUE(session_table_add_session(sess_table, &tuple_3, sess3) == 0);
     EXPECT_TRUE(session_table_find_least_recently_unused_session(sess_table) == sess1);
     EXPECT_TRUE(session_table_find_least_recently_used_session(sess_table) == sess3);
diff --git a/src/session/test/gtest_tcp_init_to_opening.cpp b/src/session/test/gtest_tcp_init_to_opening.cpp
new file mode 100644
index 0000000..afe9024
--- /dev/null
+++ b/src/session/test/gtest_tcp_init_to_opening.cpp
@@ -0,0 +1,933 @@
+// TCP state machine test: init -> opening
+// TODO
+
+#include <gtest/gtest.h>
+
+#include "session_private.h"
+#include "timestamp.h"
+#include "session_manager.h"
+#include "ipv4_helpers.h"
+#include "test_packets.h"
+
+struct session_manager_config config = {
+    // max session number
+    .max_tcp_session_num = 3,
+    .max_udp_session_num = 3,
+
+    // tcp timeout
+    .tcp_timeout_init = 2,
+    .tcp_timeout_handshake = 2,
+    .tcp_timeout_data = 2,
+    .tcp_timeout_half_closed = 2,
+    .tcp_timeout_time_wait = 2,
+    .tcp_timeout_discard = 2,
+
+    // udp timeout
+    .udp_timeout_data = 1,
+
+    // tcp duplicate packet filter
+    .tcp_dupkt_filter_enable = 1,
+    .tcp_dupkt_filter_capacity = 1000,
+    .tcp_dupkt_filter_timeout = 10,
+    .tcp_dupkt_filter_error_rate = 0.0001,
+
+    // udp eviction filter
+    .udp_eviction_filter_enable = 1,
+    .udp_eviction_filter_capacity = 1000,
+    .udp_eviction_filter_timeout = 10,
+    .udp_eviction_filter_error_rate = 0.0001,
+};
+
+static void __session_dispatch(struct session *sess)
+{
+    if (sess == NULL)
+    {
+        return;
+    }
+
+    printf("\n");
+    printf("=> session dispatch: %p\n", sess);
+    session_dump(sess);
+    printf("<= session dispatch\n");
+    printf("\n");
+
+    session_set0_cur_pkt(sess, NULL);
+    session_set_cur_dir(sess, SESSION_DIR_NONE);
+}
+
+/******************************************************************************
+ * case: TCP init -> opening (by SYN)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_INIT_TO_OPENING, BY_SYN)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    printf("=> packet parse: TCP C2S SYN packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
+    EXPECT_TRUE(session_get_create_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYN_RECVED);
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    for (int i = 0; i < 3; i++)
+    {
+        timestamp_update();
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
+        sleep(1);
+    }
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP init -> opening (by SYNACK)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_INIT_TO_OPENING, BY_SYNACK)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYNACK Packet
+    printf("=> packet parse: TCP S2C SYNACK packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 0);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYNACK_RECVED);
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_s2c_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    for (int i = 0; i < 3; i++)
+    {
+        timestamp_update();
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
+        sleep(1);
+    }
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP init -> opening (by SYN + SYNACK)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_INIT_TO_OPENING, BY_SYN_SYNACK)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    printf("=> packet parse: TCP C2S SYN packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
+    EXPECT_TRUE(session_get_create_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYN_RECVED);
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    sleep(1);
+    timestamp_update();
+
+    // SYNACK Packet
+    printf("=> packet parse: TCP S2C SYNACK packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    for (int i = 0; i < 3; i++)
+    {
+        timestamp_update();
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
+        sleep(1);
+    }
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP init -> opening (by SYN + SYNACK + ACK)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_INIT_TO_OPENING, BY_SYN_SYNACK_ACK)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    printf("=> packet parse: TCP C2S SYN packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
+    EXPECT_TRUE(session_get_create_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYN_RECVED);
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    sleep(1);
+    timestamp_update();
+
+    // SYNACK Packet
+    printf("=> packet parse: TCP S2C SYNACK packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    sleep(1);
+    timestamp_update();
+
+    // ACK Packet
+    printf("=> packet parse: TCP C2S ACK packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt3_c2s_ack, sizeof(tcp_pkt3_c2s_ack));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_ACK_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    for (int i = 0; i < 3; i++)
+    {
+        timestamp_update();
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
+        sleep(1);
+    }
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP init -> opening (by SYN retransmission)
+ ******************************************************************************/
+
+// overwrited ipid to build SYN retransmission
+
+#if 1
+TEST(TCP_INIT_TO_OPENING, BY_SYN_RETRANSMISSION)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    printf("=> packet parse: TCP C2S SYN packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
+    EXPECT_TRUE(session_get_create_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYN_RECVED);
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    sleep(1);
+    timestamp_update();
+
+    // SYN Packet retransmission
+    printf("=> packet parse: TCP C2S SYN retransmission packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
+    const struct layer_record *ipv4_layer = packet_get_innermost_layer(&pkt, LAYER_TYPE_IPV4);
+    EXPECT_TRUE(ipv4_layer);
+    const struct ip *hdr = (const struct ip *)ipv4_layer->hdr_ptr;
+    ipv4_hdr_set_ipid((struct ip *)hdr, 0x1234);
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYN_RECVED);
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    for (int i = 0; i < 3; i++)
+    {
+        timestamp_update();
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
+        sleep(1);
+    }
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP init -> opening (by SYNACK retransmission)
+ ******************************************************************************/
+
+// overwrited ipid to build SYNACK retransmission
+
+#if 1
+TEST(TCP_INIT_TO_OPENING, BY_SYNACK_RETRANSMISSION)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYNACK Packet
+    printf("=> packet parse: TCP S2C SYNACK packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 0);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYNACK_RECVED);
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_s2c_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    sleep(1);
+    timestamp_update();
+
+    // SYNACK Packet retransmission
+    printf("=> packet parse: TCP S2C SYNACK retransmission packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
+    const struct layer_record *ipv4_layer = packet_get_innermost_layer(&pkt, LAYER_TYPE_IPV4);
+    EXPECT_TRUE(ipv4_layer);
+    const struct ip *hdr = (const struct ip *)ipv4_layer->hdr_ptr;
+    ipv4_hdr_set_ipid((struct ip *)hdr, 0x1234);
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74 + 74);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 0);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1 + 1);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYNACK_RECVED);
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_s2c_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    for (int i = 0; i < 3; i++)
+    {
+        timestamp_update();
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
+        sleep(1);
+    }
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP init -> opening (by C2S asymmetric)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_INIT_TO_OPENING, BY_C2S_ASMMETRIC)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    printf("=> packet parse: TCP C2S SYN packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
+    EXPECT_TRUE(session_get_create_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYN_RECVED);
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    sleep(1);
+    timestamp_update();
+
+    // ACK Packet
+    printf("=> packet parse: TCP C2S ACK packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt3_c2s_ack, sizeof(tcp_pkt3_c2s_ack));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_C2S_ACK_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    for (int i = 0; i < 3; i++)
+    {
+        timestamp_update();
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
+        sleep(1);
+    }
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP init -> opening (by S2C asymmetric)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_INIT_TO_OPENING, BY_S2C_ASMMETRIC)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYNACK Packet
+    printf("=> packet parse: TCP S2C SYNACK packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 0);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYNACK_RECVED);
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_s2c_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    sleep(1);
+    timestamp_update();
+
+    // ACK Packet
+    printf("=> packet parse: TCP S2C ACK packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt5_s2c_ack, sizeof(tcp_pkt5_s2c_ack));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74 + 66);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 0);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1 + 1);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYNACK_RECVED | TCP_S2C_ACK_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_s2c_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 1);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    for (int i = 0; i < 3; i++)
+    {
+        timestamp_update();
+        __session_dispatch(session_manager_get_expired_session(mgr));
+        __session_dispatch(session_manager_get_evicted_session(mgr));
+        sleep(1);
+    }
+
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_TCP, SESSION_STATE_ACTIVE) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_OPENING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_CLOSING) == 0);
+    EXPECT_TRUE(session_manager_get_session_number(mgr, SESSION_TYPE_UDP, SESSION_STATE_ACTIVE) == 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+int main(int argc, char **argv)
+{
+    ::testing::InitGoogleTest(&argc, argv);
+    return RUN_ALL_TESTS();
+}
diff --git a/src/stellar/stellar.cpp b/src/stellar/stellar.cpp
index 86d209c..fec5b08 100644
--- a/src/stellar/stellar.cpp
+++ b/src/stellar/stellar.cpp
@@ -43,9 +43,34 @@ struct stellar_ctx
 } g_stellar_ctx = {
     .need_exit = 0,
     .max_worker_num = 1,
+    .sess_mgr_cfg = {
+        // max session number
+        .max_tcp_session_num = 3,
+        .max_udp_session_num = 3,
 
-    // TODO session manager config
-};
+        // tcp timeout
+        .tcp_timeout_init = 2,
+        .tcp_timeout_handshake = 2,
+        .tcp_timeout_data = 2,
+        .tcp_timeout_half_closed = 2,
+        .tcp_timeout_time_wait = 2,
+        .tcp_timeout_discard = 2,
+
+        // udp timeout
+        .udp_timeout_data = 1,
+
+        // tcp duplicate packet filter
+        .tcp_dupkt_filter_enable = 1,
+        .tcp_dupkt_filter_capacity = 1000,
+        .tcp_dupkt_filter_timeout = 10,
+        .tcp_dupkt_filter_error_rate = 0.0001,
+
+        // udp eviction filter
+        .udp_eviction_filter_enable = 1,
+        .udp_eviction_filter_capacity = 1000,
+        .udp_eviction_filter_timeout = 10,
+        .udp_eviction_filter_error_rate = 0.0001,
+    }};
 
 static int recv_packet(const char **data)
 {
@@ -90,13 +115,13 @@ static void __session_dispatch(struct session *sess)
     printf("\n");
     printf("=> session dispatch: %p\n", sess);
     session_dump(sess);
-    printf("<= session dispatch\n");
+    printf("<= session dispatch\n\n");
 
     session_set0_cur_pkt(sess, NULL);
     session_set_cur_dir(sess, SESSION_DIR_NONE);
 }
 
-static void thread_ctx_init(struct stellar_ctx *ctx)
+static int thread_ctx_init(struct stellar_ctx *ctx)
 {
     for (uint16_t i = 0; i < ctx->max_worker_num; i++)
     {
@@ -106,8 +131,14 @@ static void thread_ctx_init(struct stellar_ctx *ctx)
         thd_ctx->is_runing = 0;
 
         thd_ctx->sess_mgr = session_manager_create(&ctx->sess_mgr_cfg);
-        assert(thd_ctx->sess_mgr != NULL);
+        if (thd_ctx->sess_mgr == NULL)
+        {
+            STELLAR_LOG_ERROR("unable to create session manager");
+            return -1;
+        }
     }
+
+    return 0;
 }
 
 static void thread_ctx_free(struct stellar_ctx *ctx)
@@ -193,7 +224,11 @@ int main(int argc, char **argv)
 
     timestamp_update();
 
-    thread_ctx_init(&g_stellar_ctx);
+    if (thread_ctx_init(&g_stellar_ctx) != 0)
+    {
+        STELLAR_LOG_ERROR("unable to init thread context");
+        goto error_out;
+    }
 
     for (uint16_t i = 0; i < g_stellar_ctx.max_worker_num; i++)
     {