diff --git a/src/packet/gtest_packet_helpers.cpp b/src/packet/gtest_packet_helpers.cpp
index feb25c9..5007991 100644
--- a/src/packet/gtest_packet_helpers.cpp
+++ b/src/packet/gtest_packet_helpers.cpp
@@ -487,6 +487,66 @@ TEST(PACKET_UTILS, UDP_AND_TCP)
 }
 #endif
 
+#if 1
+TEST(PACKET_UTILS, PACKET_DUP)
+{
+    struct packet handler;
+    packet_parse(&handler, (const char *)data5, sizeof(data5));
+
+    // IP
+    EXPECT_TRUE(paket_is_fragment(&handler) == false);
+
+    // TCP
+    EXPECT_TRUE(packet_has_tcp(&handler) == true);
+    EXPECT_TRUE(packet_get_tcp_sport(&handler) == 443);
+    EXPECT_TRUE(packet_get_tcp_dport(&handler) == 46582);
+    EXPECT_TRUE(packet_get_tcp_seq(&handler) == 2198097831);
+    EXPECT_TRUE(packet_get_tcp_ack(&handler) == 2264498872);
+    EXPECT_TRUE(packet_get_tcp_flags(&handler) == 0x10);
+    EXPECT_TRUE(packet_has_tcp_flag_urg(&handler) == false);
+    EXPECT_TRUE(packet_has_tcp_flag_ack(&handler) == true);
+    EXPECT_TRUE(packet_has_tcp_flag_psh(&handler) == false);
+    EXPECT_TRUE(packet_has_tcp_flag_rst(&handler) == false);
+    EXPECT_TRUE(packet_has_tcp_flag_syn(&handler) == false);
+    EXPECT_TRUE(packet_has_tcp_flag_fin(&handler) == false);
+
+    // UDP
+    EXPECT_TRUE(packet_has_udp(&handler) == true);
+    EXPECT_TRUE(packet_get_inner_udp_sport(&handler) == 2152);
+    EXPECT_TRUE(packet_get_inner_udp_dport(&handler) == 2152);
+    EXPECT_TRUE(packet_get_outer_udp_sport(&handler) == 2152);
+    EXPECT_TRUE(packet_get_outer_udp_dport(&handler) == 2152);
+
+    struct packet *dup = packet_dup(&handler);
+
+    // IP
+    EXPECT_TRUE(paket_is_fragment(&handler) == false);
+
+    // TCP
+    EXPECT_TRUE(packet_has_tcp(&handler) == true);
+    EXPECT_TRUE(packet_get_tcp_sport(&handler) == 443);
+    EXPECT_TRUE(packet_get_tcp_dport(&handler) == 46582);
+    EXPECT_TRUE(packet_get_tcp_seq(&handler) == 2198097831);
+    EXPECT_TRUE(packet_get_tcp_ack(&handler) == 2264498872);
+    EXPECT_TRUE(packet_get_tcp_flags(&handler) == 0x10);
+    EXPECT_TRUE(packet_has_tcp_flag_urg(&handler) == false);
+    EXPECT_TRUE(packet_has_tcp_flag_ack(&handler) == true);
+    EXPECT_TRUE(packet_has_tcp_flag_psh(&handler) == false);
+    EXPECT_TRUE(packet_has_tcp_flag_rst(&handler) == false);
+    EXPECT_TRUE(packet_has_tcp_flag_syn(&handler) == false);
+    EXPECT_TRUE(packet_has_tcp_flag_fin(&handler) == false);
+
+    // UDP
+    EXPECT_TRUE(packet_has_udp(&handler) == true);
+    EXPECT_TRUE(packet_get_inner_udp_sport(&handler) == 2152);
+    EXPECT_TRUE(packet_get_inner_udp_dport(&handler) == 2152);
+    EXPECT_TRUE(packet_get_outer_udp_sport(&handler) == 2152);
+    EXPECT_TRUE(packet_get_outer_udp_dport(&handler) == 2152);
+
+    packet_free(dup);
+}
+#endif
+
 int main(int argc, char **argv)
 {
     ::testing::InitGoogleTest(&argc, argv);
diff --git a/src/packet/packet.cpp b/src/packet/packet.cpp
index 04af244..b96edcc 100644
--- a/src/packet/packet.cpp
+++ b/src/packet/packet.cpp
@@ -1101,6 +1101,7 @@ const char *packet_parse(struct packet *handler, const char *data, uint16_t len)
     handler->data_ptr = data;
     handler->data_len = len;
     handler->zone_id = 0;
+    handler->user_data = NULL;
 
     // TESTED
     return parse_ether(handler, data, len);
diff --git a/src/packet/packet.h b/src/packet/packet.h
index 511cb0f..9269beb 100644
--- a/src/packet/packet.h
+++ b/src/packet/packet.h
@@ -86,6 +86,8 @@ struct packet
     const char *data_ptr;
     uint16_t data_len;
     uint64_t zone_id;
+
+    const void *user_data;
 };
 
 // return innermost payload
diff --git a/src/packet/packet_helpers.cpp b/src/packet/packet_helpers.cpp
index 58d593e..290b02b 100644
--- a/src/packet/packet_helpers.cpp
+++ b/src/packet/packet_helpers.cpp
@@ -1,3 +1,5 @@
+#include <stdlib.h>
+#include <string.h>
 #include <arpa/inet.h>
 #include <netinet/ip.h>
 #include <netinet/ip6.h>
@@ -42,6 +44,94 @@ static bool ipv6_is_fragment(const struct ip6_hdr *ip6_hdr, uint16_t hdr_len)
  * Public API
  ******************************************************************************/
 
+// metadata
+struct metadata *metadata_dup(const struct metadata *metadata)
+{
+    if (metadata == NULL)
+    {
+        return NULL;
+    }
+
+    struct metadata *metadata_dup = (struct metadata *)calloc(1, sizeof(struct metadata));
+    if (metadata_dup == NULL)
+    {
+        return NULL;
+    }
+
+    memcpy(metadata_dup, metadata, sizeof(struct metadata));
+
+    return metadata_dup;
+}
+
+void metadata_free(struct metadata *metadata)
+{
+    if (metadata)
+    {
+        free(metadata);
+        metadata = NULL;
+    }
+}
+
+void packet_set0_metadata(struct packet *pkt, const struct metadata *metadata)
+{
+    pkt->user_data = (const void *)metadata;
+}
+
+const struct metadata *packet_get0_metadata(const struct packet *pkt)
+{
+    return (const struct metadata *)pkt->user_data;
+}
+
+// packet
+struct packet *packet_dup(const struct packet *pkt)
+{
+    if (pkt == NULL)
+    {
+        return NULL;
+    }
+
+    struct packet *pkt_dup = (struct packet *)calloc(1, sizeof(struct packet));
+    if (pkt_dup == NULL)
+    {
+        return NULL;
+    }
+
+    memcpy(pkt_dup, pkt, sizeof(struct packet));
+
+    if (pkt->data_len)
+    {
+        pkt_dup->data_ptr = (const char *)calloc(1, pkt->data_len);
+        if (pkt_dup->data_ptr == NULL)
+        {
+            free(pkt_dup);
+            return NULL;
+        }
+        memcpy((char *)pkt_dup->data_ptr, pkt->data_ptr, pkt->data_len);
+
+        for (int8_t i = 0; i < pkt->layers_used; i++)
+        {
+            pkt_dup->layers[i].hdr_ptr = pkt_dup->data_ptr + pkt->layers[i].hdr_offset;
+            pkt_dup->layers[i].pld_ptr = pkt_dup->data_ptr + pkt->layers[i].hdr_offset + pkt->layers[i].hdr_len;
+        }
+    }
+
+    return pkt_dup;
+}
+
+void packet_free(struct packet *pkt)
+{
+    if (pkt)
+    {
+        if (pkt->data_ptr)
+        {
+            free((char *)pkt->data_ptr);
+            pkt->data_ptr = NULL;
+        }
+        free(pkt);
+        pkt = NULL;
+    }
+}
+
 // packet
 uint64_t packet_get_zone_id(const struct packet *pkt)
 {
diff --git a/src/packet/packet_helpers.h b/src/packet/packet_helpers.h
index 5158b09..91125ad 100644
--- a/src/packet/packet_helpers.h
+++ b/src/packet/packet_helpers.h
@@ -8,7 +8,21 @@ extern "C"
 
 #include "packet.h"
 
+struct metadata
+{
+    // TODO
+};
+
+// metadata
+struct metadata *metadata_dup(const struct metadata *metadata);
+void metadata_free(struct metadata *metadata);
+void packet_set0_metadata(struct packet *pkt, const struct metadata *metadata);
+const struct metadata *packet_get0_metadata(const struct packet *pkt);
+
 // packet
+struct packet *packet_dup(const struct packet *pkt);
+void packet_free(struct packet *pkt);
+
 uint64_t packet_get_zone_id(const struct packet *pkt);
 uint16_t packet_get_raw_len(const struct packet *pkt);
 const char *packet_get0_raw_data(const struct packet *pkt);
diff --git a/src/session/gtest_session_manager.cpp b/src/session/gtest_session_manager.cpp
index b7feca1..b6aff8f 100644
--- a/src/session/gtest_session_manager.cpp
+++ b/src/session/gtest_session_manager.cpp
@@ -1478,7 +1478,6 @@ const char *plugin_ctx = "hello world";
 
 void plugin_session_ex_free(struct session *sess, uint8_t idx, void *ex_ptr, void *arg)
 {
-    printf("free ex data: %s\n", (char *)ex_ptr);
     EXPECT_STREQ((char *)ex_ptr, "123");
     free(ex_ptr);
 }
@@ -1551,8 +1550,6 @@ TEST(SESSION_MANAGER, INIT_TO_OPENING_BY_SYN)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
@@ -1628,8 +1625,6 @@ TEST(SESSION_MANAGER, INIT_TO_OPENING_BY_SYNACK)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 0);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
@@ -1709,8 +1704,6 @@ TEST(SESSION_MANAGER, INIT_TO_ACTIVE_BY_UDP_C2S)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
@@ -1786,8 +1779,6 @@ TEST(SESSION_MANAGER, INIT_TO_ACTIVE_BY_UDP_S2C)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 550);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 0);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
@@ -1874,8 +1865,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_C2S_PAYLOAD)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
@@ -1919,8 +1908,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_C2S_PAYLOAD)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -2012,8 +1999,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_S2C_PAYLOAD)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
@@ -2057,8 +2042,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_S2C_PAYLOAD)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 1354);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -2149,8 +2132,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_C2S_PAYLOAD)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 0);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
@@ -2194,8 +2175,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_C2S_PAYLOAD)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -2286,8 +2265,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_S2C_PAYLOAD)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 0);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
@@ -2331,8 +2308,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYNACK_AND_S2C_PAYLOAD)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74 + 1354);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 0);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1 + 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -2428,8 +2403,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
@@ -2473,8 +2446,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -2518,8 +2489,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -2563,8 +2532,6 @@ TEST(SESSION_MANAGER, OPENING_TO_ACTIVE_BY_SYN_AND_SYNACK_AND_ACK_AND_C2S_PAYLOA
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -2756,8 +2723,6 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
@@ -2801,8 +2766,6 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -2846,8 +2809,6 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -2891,8 +2852,6 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -2936,8 +2895,6 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74 + 66);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1 + 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -2981,8 +2938,6 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74 + 66 + 1354);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1 + 1 + 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -3026,8 +2981,6 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74 + 66 + 1354 + 385);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1 + 1 + 1 + 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -3071,8 +3024,6 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74 + 66 + 1354 + 385);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1 + 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1 + 1 + 1 + 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -3116,8 +3067,6 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74 + 66 + 1354 + 385);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1 + 1 + 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1 + 1 + 1 + 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -3161,8 +3110,6 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74 + 66 + 1354 + 385 + 66);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1 + 1 + 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1 + 1 + 1 + 1 + 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -3206,8 +3153,6 @@ TEST(SESSION_MANAGER, TCP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 74 + 66 + 1354 + 385 + 66);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1 + 1 + 1 + 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1 + 1 + 1 + 1 + 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
@@ -3294,8 +3239,6 @@ TEST(SESSION_MANAGER, UDP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) == session_get_last_time(sess));
@@ -3339,8 +3282,6 @@ TEST(SESSION_MANAGER, UDP_FULL_STREAM)
     EXPECT_TRUE(session_get_s2c_bytes(sess) == 550);
     EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
     EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
-    EXPECT_TRUE(session_get0_c2s_1st_md(sess) == NULL);
-    EXPECT_TRUE(session_get0_s2c_1st_md(sess) == NULL);
     EXPECT_TRUE(session_get_create_time(sess) != 0);
     EXPECT_TRUE(session_get_last_time(sess) != 0);
     EXPECT_TRUE(session_get_create_time(sess) < session_get_last_time(sess));
diff --git a/src/session/session.cpp b/src/session/session.cpp
index 8cdfcc6..ea3bf89 100644
--- a/src/session/session.cpp
+++ b/src/session/session.cpp
@@ -20,6 +20,10 @@ struct ex_manager
 static struct ex_manager g_ex_manager = {0};
 uint8_t tcp_builtin_ex = 0; // built-in ex_data index
 uint8_t udp_builtin_ex = 0; // built-in ex_data index
+uint8_t c2s_1st_md_ex = 0;  // built-in ex_data index
+uint8_t s2c_1st_md_ex = 0;  // built-in ex_data index
+uint8_t c2s_1st_pkt_ex = 0; // built-in ex_data index
+uint8_t s2c_1st_pkt_ex = 0; // built-in ex_data index
 
 /******************************************************************************
  * ev queue
@@ -164,35 +168,6 @@ uint64_t session_get_s2c_packets(const struct session *sess)
     return sess->s2c_packets;
 }
 
-// session metadata
-void session_set_c2s_1st_md(struct session *sess, struct metadata *md)
-{
-    memcpy(&sess->c2s_1st_md, md, sizeof(struct metadata));
-}
-
-void session_set_s2c_1st_md(struct session *sess, struct metadata *md)
-{
-    memcpy(&sess->s2c_1st_md, md, sizeof(struct metadata));
-}
-
-const struct metadata *session_get0_c2s_1st_md(const struct session *sess)
-{
-    if (sess->c2s_1st_md.len == 0)
-    {
-        return NULL;
-    }
-    return &sess->c2s_1st_md;
-}
-
-const struct metadata *session_get0_s2c_1st_md(const struct session *sess)
-{
-    if (sess->s2c_1st_md.len == 0)
-    {
-        return NULL;
-    }
-    return &sess->s2c_1st_md;
-}
-
 // session timestamp
 void session_set_create_time(struct session *sess, uint64_t timestamp)
 {
@@ -337,6 +312,7 @@ void session_free_ex_data(struct session *sess, uint8_t idx)
     }
 
     struct ex_schema *schema = &g_ex_manager.schemas[idx];
+    printf("free ex_data, idx: %d, key: %s, val: %p\n", idx, schema->key, sess->ex_data[idx]);
     if (schema->free_cb != NULL && sess->ex_data[idx] != NULL)
     {
         schema->free_cb(sess, idx, sess->ex_data[idx], schema->args);
@@ -459,8 +435,8 @@ const char *session_event_tostring(enum session_event event)
         return "none";
     case SESSION_EVENT_OPENING:
         return "opening";
-    case SESSION_EVENT_ACTIVE:
-        return "active";
+    case SESSION_EVENT_PACKET:
+        return "packet";
     case SESSION_EVENT_CLOSING:
         return "closing";
     default:
@@ -478,8 +454,6 @@ const char *session_state_tostring(enum session_state state)
         return "opening";
     case SESSION_STATE_ACTIVE:
         return "active";
-    case SESSION_STATE_DISCARD:
-        return "discard";
     case SESSION_STATE_CLOSING:
         return "closing";
     case SESSION_STATE_CLOSED:
@@ -535,8 +509,6 @@ void session_dump(struct session *sess)
     printf("session c2s bytes          : %" PRIu64 "\n", session_get_c2s_bytes(sess));
     printf("session s2c packets        : %" PRIu64 "\n", session_get_s2c_packets(sess));
     printf("session s2c bytes          : %" PRIu64 "\n", session_get_s2c_bytes(sess));
-    printf("session c2s 1st metadata   : %p\n", (void *)session_get0_c2s_1st_md(sess));
-    printf("session s2c 1st metadata   : %p\n", (void *)session_get0_s2c_1st_md(sess));
     printf("session create time        : %" PRIu64 "\n", session_get_create_time(sess));
     printf("session last time          : %" PRIu64 "\n", session_get_last_time(sess));
     printf("session current packet ptr : %p\n", (void *)session_get0_cur_pkt(sess));
diff --git a/src/session/session.h b/src/session/session.h
index e82a7fd..273dda5 100644
--- a/src/session/session.h
+++ b/src/session/session.h
@@ -16,11 +16,16 @@ enum session_state
     SESSION_STATE_INIT = 0,
     SESSION_STATE_OPENING,
     SESSION_STATE_ACTIVE,
-    SESSION_STATE_DISCARD,
     SESSION_STATE_CLOSING,
     SESSION_STATE_CLOSED,
 };
 
+enum session_action
+{
+    SESSION_ACTION_DISCARD,
+    SESSION_ACTION_FASTFORWARD,
+};
+
 enum session_type
 {
     SESSION_TYPE_NONE = 0,
@@ -33,7 +38,7 @@ enum session_event
 {
     SESSION_EVENT_NONE = 0,
     SESSION_EVENT_OPENING,
-    SESSION_EVENT_ACTIVE,
+    SESSION_EVENT_PACKET,
     SESSION_EVENT_CLOSING,
 
     // Add new event before SESSION_EVENT_MAX
@@ -48,12 +53,6 @@ enum session_dir
     SESSION_DIR_S2C = 2,
 };
 
-struct metadata
-{
-    char data[64]; // TODO
-    int len;
-};
-
 struct session;
 
 /******************************************************************************
@@ -88,12 +87,6 @@ uint64_t session_get_s2c_bytes(const struct session *sess);
 uint64_t session_get_c2s_packets(const struct session *sess);
 uint64_t session_get_s2c_packets(const struct session *sess);
 
-// session metadata
-void session_set_c2s_1st_md(struct session *sess, struct metadata *md);
-void session_set_s2c_1st_md(struct session *sess, struct metadata *md);
-const struct metadata *session_get0_c2s_1st_md(const struct session *sess);
-const struct metadata *session_get0_s2c_1st_md(const struct session *sess);
-
 // session timestamp
 void session_set_create_time(struct session *sess, uint64_t timestamp);
 void session_set_last_time(struct session *sess, uint64_t timestamp);
diff --git a/src/session/session_manager.cpp b/src/session/session_manager.cpp
index a3b721d..5d9f290 100644
--- a/src/session/session_manager.cpp
+++ b/src/session/session_manager.cpp
@@ -46,12 +46,21 @@ static uint64_t alloc_session_id(void)
      return 0;
 }
 
-// TODO
-struct metadata *packet_get0_metadata(const struct packet *pkt)
+static void metadata_ex_free_cb(struct session *sess, uint8_t idx, void *ex_ptr, void *arg)
 {
-     static struct metadata md = {0};
-     return &md;
-};
+     if (ex_ptr)
+     {
+          metadata_free((struct metadata *)ex_ptr);
+     }
+}
+
+static void packet_ex_free_cb(struct session *sess, uint8_t idx, void *ex_ptr, void *arg)
+{
+     if (ex_ptr)
+     {
+          packet_free((struct packet *)ex_ptr);
+     }
+}
 
 /******************************************************************************
  * session manager counter
@@ -269,21 +278,29 @@ static int tcp_need_active(uint64_t state)
 static void update_session_base(struct session *sess, const struct packet *pkt, enum session_dir curr_dir)
 {
      uint64_t len = packet_get_raw_len(pkt);
-     struct metadata *md = packet_get0_metadata(pkt);
+     const struct metadata *md = packet_get0_metadata(pkt);
      if (curr_dir == SESSION_DIR_C2S)
      {
           session_inc_c2s_metrics(sess, 1, len);
-          if (session_get0_c2s_1st_md(sess) == NULL)
+          if (session_get0_ex_data(sess, c2s_1st_md_ex) == NULL)
           {
-               session_set_c2s_1st_md(sess, md);
+               session_set_ex_data(sess, c2s_1st_md_ex, metadata_dup(md));
+          }
+          if (session_get0_ex_data(sess, c2s_1st_pkt_ex) == NULL)
+          {
+               session_set_ex_data(sess, c2s_1st_pkt_ex, packet_dup(pkt));
           }
      }
      else
      {
           session_inc_s2c_metrics(sess, 1, len);
-          if (session_get0_s2c_1st_md(sess) == NULL)
+          if (session_get0_ex_data(sess, s2c_1st_md_ex) == NULL)
           {
-               session_set_s2c_1st_md(sess, md);
+               session_set_ex_data(sess, s2c_1st_md_ex, metadata_dup(md));
+          }
+          if (session_get0_ex_data(sess, s2c_1st_pkt_ex) == NULL)
+          {
+               session_set_ex_data(sess, s2c_1st_pkt_ex, packet_dup(pkt));
           }
      }
      session_set_last_time(sess, timestamp_get_msec());
@@ -441,7 +458,7 @@ static int handle_udp_new_session(struct session_manager *mgr, struct tuple6 *ke
      update_session_base(sess, pkt, curr_dir);
 
      session_manager_trigger_session_event(mgr, sess, SESSION_EVENT_OPENING);
-     session_manager_trigger_session_event(mgr, sess, SESSION_EVENT_ACTIVE);
+     session_manager_trigger_session_event(mgr, sess, SESSION_EVENT_PACKET);
      session_manager_update_session_timer(mgr, sess, packet_expire_callback, mgr->packet_timeout_ms);
 
      return 0;
@@ -467,7 +484,7 @@ static void handle_tcp_old_session(struct session_manager *mgr, struct tuple6 *k
      {
           update_counter_on_active(mgr, sess);
           session_set_state(sess, SESSION_STATE_ACTIVE);
-          session_manager_trigger_session_event(mgr, sess, SESSION_EVENT_ACTIVE);
+          session_manager_trigger_session_event(mgr, sess, SESSION_EVENT_PACKET);
           session_manager_update_session_timer(mgr, sess, packet_expire_callback, mgr->packet_timeout_ms);
           return;
      }
@@ -481,7 +498,7 @@ static void handle_udp_old_session(struct session_manager *mgr, struct tuple6 *k
 
      update_counter_on_active(mgr, sess);
      session_set_state(sess, SESSION_STATE_ACTIVE);
-     session_manager_trigger_session_event(mgr, sess, SESSION_EVENT_ACTIVE);
+     session_manager_trigger_session_event(mgr, sess, SESSION_EVENT_PACKET);
      session_manager_update_session_timer(mgr, sess, packet_expire_callback, mgr->packet_timeout_ms);
 }
 
@@ -565,6 +582,10 @@ struct session_manager *session_manager_create(uint64_t max_session_num)
 
      tcp_builtin_ex = session_get_ex_new_index("tcp_builtin_ex", NULL, NULL);
      udp_builtin_ex = session_get_ex_new_index("udp_builtin_ex", NULL, NULL);
+     c2s_1st_md_ex = session_get_ex_new_index("c2s_1st_md_ex", metadata_ex_free_cb, NULL);
+     s2c_1st_md_ex = session_get_ex_new_index("s2c_1st_md_ex", metadata_ex_free_cb, NULL);
+     c2s_1st_pkt_ex = session_get_ex_new_index("c2s_1st_pkt_ex", packet_ex_free_cb, NULL);
+     s2c_1st_pkt_ex = session_get_ex_new_index("s2c_1st_pkt_ex", packet_ex_free_cb, NULL);
 
      return mgr;
 
@@ -616,14 +637,13 @@ struct session *session_manager_find_session(struct session_manager *mgr, const
      struct session *sess = session_table_find_session(mgr->sess_table, &key);
      if (sess == NULL)
      {
-          // if session pool is full, discard oldest session
           if (session_pool_get_count(mgr->sess_pool) == 1)
           {
                struct session *unused_sess = session_table_find_least_recently_unused_session(mgr->sess_table);
                assert(unused_sess);
 
                update_counter_on_closing(mgr, unused_sess);
-               session_set_state(unused_sess, SESSION_STATE_DISCARD);
+               session_set_state(unused_sess, SESSION_STATE_CLOSING);
                session_manager_trigger_session_event(mgr, unused_sess, SESSION_EVENT_CLOSING);
                session_manager_update_session_timer(mgr, unused_sess, closing_expire_callback, mgr->closing_timeout_ms);
           }
diff --git a/src/session/session_private.h b/src/session/session_private.h
index 73436b8..f0162a4 100644
--- a/src/session/session_private.h
+++ b/src/session/session_private.h
@@ -63,10 +63,6 @@ struct session
     uint64_t c2s_packets;
     uint64_t s2c_packets;
 
-    // session metadata
-    struct metadata c2s_1st_md;
-    struct metadata s2c_1st_md;
-
     // session timestamp
     uint64_t create_time;
     uint64_t last_time;
@@ -129,10 +125,12 @@ struct session
     struct session *next_ready_ptr;
 };
 
-// tcp_builtin_ex = session_get_ex_new_index("tcp_builtin_ex", NULL, NULL);
-// udp_builtin_ex = session_get_ex_new_index("udp_builtin_ex", NULL, NULL);
 extern uint8_t tcp_builtin_ex;
 extern uint8_t udp_builtin_ex;
+extern uint8_t c2s_1st_md_ex;
+extern uint8_t s2c_1st_md_ex;
+extern uint8_t c2s_1st_pkt_ex;
+extern uint8_t s2c_1st_pkt_ex;
 
 #ifdef __cpluscplus
 }