diff --git a/include/stellar/packet.h b/include/stellar/packet.h
index 2ffa3b0..85bcf8b 100644
--- a/include/stellar/packet.h
+++ b/include/stellar/packet.h
@@ -98,10 +98,16 @@ int packet_get_direction(const struct packet *pkt); // 1: E2I, 0: I2E
 void packet_set_session_id(struct packet *pkt, uint64_t sess_id);
 uint64_t packet_get_session_id(const struct packet *pkt);
 
-void packet_set_sid_list(struct packet *pkt, uint16_t *sid, int num);
-int packet_get_sid_list(const struct packet *pkt, uint16_t *sid, int num); // return number of sid
-void packet_prepend_sid_list(struct packet *pkt, uint16_t *sid, int num);
-void packet_append_sid_list(struct packet *pkt, uint16_t *sid, int num);
+#define MAX_SID_NUM 8
+struct sid_list
+{
+    uint16_t sid[MAX_SID_NUM];
+    int used;
+};
+void packet_set_sid_list(struct packet *pkt, const struct sid_list *list);
+void packet_get_sid_list(const struct packet *pkt, struct sid_list *list);
+void packet_prepend_sid_list(struct packet *pkt, const struct sid_list *list);
+void packet_append_sid_list(struct packet *pkt, const struct sid_list *list);
 
 /*
  ******************************************************************************
diff --git a/src/ip_reassembly/ip_reassembly.cpp b/src/ip_reassembly/ip_reassembly.cpp
index 20e66f9..1d3c0d9 100644
--- a/src/ip_reassembly/ip_reassembly.cpp
+++ b/src/ip_reassembly/ip_reassembly.cpp
@@ -729,6 +729,7 @@ static struct packet *ip_frag_reassemble(struct ip_reassembly *assy, struct ip_f
 
     // create a new packet
     packet_parse(pkt, ptr, packet_len);
+    packet_set_origin_ctx(pkt, NULL);
 
     return pkt;
 
diff --git a/src/packet/packet_priv.h b/src/packet/packet_priv.h
index 8fc8306..a55ac05 100644
--- a/src/packet/packet_priv.h
+++ b/src/packet/packet_priv.h
@@ -16,7 +16,7 @@ extern "C"
 #define PACKET_MAX_LAYERS 32
 #define PACKET_LOG_ERROR(format, ...) LOG_ERROR("packet", format, ##__VA_ARGS__)
 #define PACKET_LOG_DEBUG(format, ...) void(0)
-//#define PACKET_LOG_DEBUG(format, ...) LOG_DEBUG("packet", format, ##__VA_ARGS__)
+// #define PACKET_LOG_DEBUG(format, ...) LOG_DEBUG("packet", format, ##__VA_ARGS__)
 
 enum ldbc_method
 {
@@ -29,9 +29,10 @@ enum ldbc_method
 
 enum packet_origin
 {
-    PACKET_ORIGIN_MARSIO = 0x1,
-    PACKET_ORIGIN_DUMPFILE = 0x2,
-    PACKET_ORIGIN_USER = 0x3,
+    PACKET_ORIGIN_MARSIO = 0x1,    // packet data in mbuff      (eg: packet I/O mrzcpd mode)
+    PACKET_ORIGIN_DUMPFILE = 0x2,  // packet data in pcap       (eg: packet I/O dumpfile mode)
+    PACKET_ORIGIN_USERSTACK = 0x3, // packet data in user stack (eg: inject packet)
+    PACKET_ORIGIN_USERHEAP = 0x4,  // packet data in user heap  (eg: ip reassembly)
 };
 
 struct packet
@@ -45,7 +46,7 @@ struct packet
     uint16_t data_len;
 
     int need_drop;
-    void *io_ctx;
+    void *origin_ctx; // mbuff or pcap pointer
     enum packet_origin origin;
 };
 
@@ -64,8 +65,8 @@ uint64_t packet_get_hash(const struct packet *pkt, enum ldbc_method method, int
 void packet_set_origin(struct packet *pkt, enum packet_origin origin);
 enum packet_origin packet_get_origin(const struct packet *pkt);
 
-void packet_set_io_ctx(struct packet *pkt, void *ctx);
-void *packet_get_io_ctx(const struct packet *pkt);
+void packet_set_origin_ctx(struct packet *pkt, void *ctx);
+void *packet_get_origin_ctx(const struct packet *pkt);
 
 int packet_is_fragment(const struct packet *pkt);
 
@@ -78,8 +79,14 @@ struct packet *packet_dup(const struct packet *pkt);
 void packet_set_domain(struct packet *pkt, uint64_t domain);
 uint64_t packet_get_domain(const struct packet *pkt);
 
-void packet_set_route_ctx(struct packet *pkt, const char *route, int len);
-int packet_get_route_ctx(const struct packet *pkt, char *buff, int size); // return len of route ctx
+#define MAX_ROUTE_CTX 64
+struct route_ctx
+{
+    char data[MAX_ROUTE_CTX];
+    int used;
+};
+void packet_set_route_ctx(struct packet *pkt, const struct route_ctx *ctx);
+void packet_get_route_ctx(const struct packet *pkt, struct route_ctx *ctx);
 
 #ifdef __cplusplus
 }
diff --git a/src/packet/packet_utils.cpp b/src/packet/packet_utils.cpp
index 87e7119..f1e46d1 100644
--- a/src/packet/packet_utils.cpp
+++ b/src/packet/packet_utils.cpp
@@ -71,14 +71,14 @@ void packet_set_drop(struct packet *pkt)
     pkt->need_drop = 1;
 }
 
-void packet_set_io_ctx(struct packet *pkt, void *ctx)
+void packet_set_origin_ctx(struct packet *pkt, void *ctx)
 {
-    pkt->io_ctx = ctx;
+    pkt->origin_ctx = ctx;
 }
 
-void *packet_get_io_ctx(const struct packet *pkt)
+void *packet_get_origin_ctx(const struct packet *pkt)
 {
-    return pkt->io_ctx;
+    return pkt->origin_ctx;
 }
 
 int packet_is_fragment(const struct packet *pkt)
@@ -95,14 +95,14 @@ struct packet *packet_new(uint16_t pkt_len)
     }
     pkt->data_len = pkt_len;
     pkt->data_ptr = (const char *)pkt + sizeof(struct packet);
-    pkt->origin = PACKET_ORIGIN_USER;
+    pkt->origin = PACKET_ORIGIN_USERHEAP;
 
     return pkt;
 }
 
 void packet_free(struct packet *pkt)
 {
-    if (pkt && pkt->origin == PACKET_ORIGIN_USER)
+    if (pkt && pkt->origin == PACKET_ORIGIN_USERHEAP)
     {
         free((void *)pkt);
     }
@@ -122,8 +122,8 @@ struct packet *packet_dup(const struct packet *pkt)
     }
     memcpy(dup_pkt, pkt, sizeof(struct packet));
     memcpy((char *)dup_pkt->data_ptr, pkt->data_ptr, pkt->data_len);
-    dup_pkt->origin = PACKET_ORIGIN_USER;
-    dup_pkt->io_ctx = dup_pkt;
+    dup_pkt->origin = PACKET_ORIGIN_USERHEAP;
+    dup_pkt->origin_ctx = NULL;
 
     // update layers
     for (int8_t i = 0; i < pkt->layers_used; i++)
@@ -149,22 +149,27 @@ void packet_set_ctrl(struct packet *pkt)
 {
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
         marsio_buff_set_ctrlbuf(mbuff);
     }
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to set ctrl");
+    }
 }
 
 int packet_is_ctrl(const struct packet *pkt)
 {
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
         return marsio_buff_is_ctrlbuf(mbuff);
     }
     else
     {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to check ctrl");
         return 0;
     }
 }
@@ -174,13 +179,17 @@ void packet_set_direction(struct packet *pkt, int dir)
 {
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
         if (marsio_buff_set_metadata(mbuff, MR_BUFF_DIR, &dir, sizeof(dir)) != 0)
         {
             PACKET_LOG_ERROR("failed to set direction");
         }
     }
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to set direction");
+    }
 }
 
 // 1: E2I, 0: I2E
@@ -189,13 +198,17 @@ int packet_get_direction(const struct packet *pkt)
     int direction = 0;
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
         if (marsio_buff_get_metadata(mbuff, MR_BUFF_DIR, &direction, sizeof(direction)) <= 0)
         {
             PACKET_LOG_ERROR("failed to get direction");
         }
     }
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to get direction");
+    }
 
     return direction;
 }
@@ -204,13 +217,17 @@ void packet_set_session_id(struct packet *pkt, uint64_t sess_id)
 {
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
         if (marsio_buff_set_metadata(mbuff, MR_BUFF_SESSION_ID, &sess_id, sizeof(sess_id)) != 0)
         {
             PACKET_LOG_ERROR("failed to set session id");
         }
     }
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to set session id");
+    }
 }
 
 uint64_t packet_get_session_id(const struct packet *pkt)
@@ -218,13 +235,17 @@ uint64_t packet_get_session_id(const struct packet *pkt)
     uint64_t sess_id = 0;
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
         if (marsio_buff_get_metadata(mbuff, MR_BUFF_SESSION_ID, &sess_id, sizeof(sess_id)) <= 0)
         {
             PACKET_LOG_ERROR("failed to get session id");
         }
     }
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to get session id");
+    }
 
     return sess_id;
 }
@@ -233,7 +254,7 @@ void packet_set_domain(struct packet *pkt, uint64_t domain)
 {
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
 // TODO
 #if 0
@@ -243,6 +264,10 @@ void packet_set_domain(struct packet *pkt, uint64_t domain)
         }
 #endif
     }
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to set domain");
+    }
 }
 
 uint64_t packet_get_domain(const struct packet *pkt)
@@ -250,7 +275,7 @@ uint64_t packet_get_domain(const struct packet *pkt)
     uint64_t domain = 0;
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
 // TODO
 #if 0
@@ -260,89 +285,112 @@ uint64_t packet_get_domain(const struct packet *pkt)
         }
 #endif
     }
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to get domain");
+    }
 
     return domain;
 }
 
-void packet_set_route_ctx(struct packet *pkt, const char *route, int len)
+void packet_set_route_ctx(struct packet *pkt, const struct route_ctx *ctx)
 {
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
-        if (marsio_buff_set_metadata(mbuff, MR_BUFF_ROUTE_CTX, (void *)route, len) != 0)
+        if (marsio_buff_set_metadata(mbuff, MR_BUFF_ROUTE_CTX, (void *)ctx->data, ctx->used) != 0)
         {
             PACKET_LOG_ERROR("failed to set route ctx");
         }
     }
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to set route ctx");
+    }
 }
 
-// return len of route ctx
-int packet_get_route_ctx(const struct packet *pkt, char *buff, int size)
+void packet_get_route_ctx(const struct packet *pkt, struct route_ctx *ctx)
 {
-    int len = 0;
+    ctx->used = 0;
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
-        len = marsio_buff_get_metadata(mbuff, MR_BUFF_ROUTE_CTX, buff, size);
-        if (len <= 0)
+        ctx->used = marsio_buff_get_metadata(mbuff, MR_BUFF_ROUTE_CTX, ctx->data, sizeof(ctx->data));
+        if (ctx->used <= 0)
         {
             PACKET_LOG_ERROR("failed to get route ctx");
         }
     }
-
-    return len;
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to get route ctx");
+    }
 }
 
-void packet_set_sid_list(struct packet *pkt, uint16_t *sid, int num)
+void packet_set_sid_list(struct packet *pkt, const struct sid_list *list)
 {
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
-        if (marsio_buff_set_sid_list(mbuff, sid, num) != 0)
+        if (marsio_buff_set_sid_list(mbuff, (sid_t *)list->sid, list->used) != 0)
         {
             PACKET_LOG_ERROR("failed to set sid list");
         }
     }
-}
-
-// return number of sid
-int packet_get_sid_list(const struct packet *pkt, uint16_t *sid, int num)
-{
-    if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
+    else
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
-        assert(mbuff != NULL);
-        return marsio_buff_get_sid_list(mbuff, sid, num);
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to set sid list");
     }
-
-    return 0;
 }
 
-void packet_prepend_sid_list(struct packet *pkt, uint16_t *sid, int num)
+void packet_get_sid_list(const struct packet *pkt, struct sid_list *list)
+{
+    list->used = 0;
+    if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
+    {
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
+        assert(mbuff != NULL);
+        list->used = marsio_buff_get_sid_list(mbuff, (sid_t *)list->sid, sizeof(list->sid) / sizeof(list->sid[0]));
+    }
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to get sid list");
+    }
+}
+
+void packet_prepend_sid_list(struct packet *pkt, const struct sid_list *list)
 {
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
-        if (marsio_buff_prepend_sid_list(mbuff, sid, num) != 0)
+        if (marsio_buff_prepend_sid_list(mbuff, (sid_t *)list->sid, list->used) != 0)
         {
             PACKET_LOG_ERROR("failed to prepend sid list");
         }
     }
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to prepend sid list");
+    }
 }
 
-void packet_append_sid_list(struct packet *pkt, uint16_t *sid, int num)
+void packet_append_sid_list(struct packet *pkt, const struct sid_list *list)
 {
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
-        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
-        if (marsio_buff_append_sid_list(mbuff, sid, num) != 0)
+        if (marsio_buff_append_sid_list(mbuff, (sid_t *)list->sid, list->used) != 0)
         {
             PACKET_LOG_ERROR("failed to append sid list");
         }
     }
+    else
+    {
+        PACKET_LOG_ERROR("packet origin is not marsio, failed to append sid list");
+    }
 }
diff --git a/src/packet_io/dumpfile_io.cpp b/src/packet_io/dumpfile_io.cpp
index a096745..841869c 100644
--- a/src/packet_io/dumpfile_io.cpp
+++ b/src/packet_io/dumpfile_io.cpp
@@ -290,7 +290,7 @@ int dumpfile_io_ingress(struct dumpfile_io *handle, uint16_t thr_idx, struct pac
             pkt = &pkts[nr_parsed];
             memset(pkt, 0, sizeof(struct packet));
             packet_parse(pkt, pcap_pkt->data, pcap_pkt->len);
-            packet_set_io_ctx(pkt, pcap_pkt);
+            packet_set_origin_ctx(pkt, pcap_pkt);
             packet_set_origin(pkt, PACKET_ORIGIN_DUMPFILE);
             nr_parsed++;
         }
@@ -316,7 +316,7 @@ void dumpfile_io_egress(struct dumpfile_io *handle, uint16_t thr_idx, struct pac
         stat->raw_tx_pkts++;
         stat->raw_tx_bytes += len;
 
-        struct pcap_pkt *pcap_pkt = (struct pcap_pkt *)packet_get_io_ctx(pkt);
+        struct pcap_pkt *pcap_pkt = (struct pcap_pkt *)packet_get_origin_ctx(pkt);
         if (pcap_pkt)
         {
             free(pcap_pkt);
@@ -333,7 +333,7 @@ void dumpfile_io_drop(struct dumpfile_io *handle, uint16_t thr_idx, struct packe
     for (int i = 0; i < nr_pkts; i++)
     {
         pkt = &pkts[i];
-        struct pcap_pkt *pcap_pkt = (struct pcap_pkt *)packet_get_io_ctx(pkt);
+        struct pcap_pkt *pcap_pkt = (struct pcap_pkt *)packet_get_origin_ctx(pkt);
         if (pcap_pkt)
         {
             stat->drop_pkts++;
diff --git a/src/packet_io/marsio_io.cpp b/src/packet_io/marsio_io.cpp
index 3640407..f3204d6 100644
--- a/src/packet_io/marsio_io.cpp
+++ b/src/packet_io/marsio_io.cpp
@@ -170,7 +170,7 @@ int marsio_io_ingress(struct marsio_io *handle, uint16_t thr_idx, struct packet
         pkt = &pkts[nr_parsed];
         memset(pkt, 0, sizeof(struct packet));
         packet_parse(pkt, data, len);
-        packet_set_io_ctx(pkt, mbuff);
+        packet_set_origin_ctx(pkt, mbuff);
         packet_set_origin(pkt, PACKET_ORIGIN_MARSIO);
         nr_parsed++;
 
@@ -205,7 +205,7 @@ void marsio_io_egress(struct marsio_io *handle, uint16_t thr_idx, struct packet
         stat->dev_tx_pkts++;
         stat->dev_tx_bytes += len;
 
-        mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
 
         if (marsio_buff_is_ctrlbuf(mbuff))
@@ -233,7 +233,7 @@ void marsio_io_drop(struct marsio_io *handle, uint16_t thr_idx, struct packet *p
     for (int i = 0; i < nr_pkts; i++)
     {
         pkt = &pkts[i];
-        mbuff = (marsio_buff_t *)packet_get_io_ctx(pkt);
+        mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         if (mbuff)
         {
             stat->drop_pkts++;
@@ -252,6 +252,7 @@ int marsio_io_inject(struct marsio_io *handle, uint16_t thr_idx, struct packet *
     struct packet *pkt;
     marsio_buff_t *mbuff;
     struct io_stat *stat = &handle->stat[thr_idx];
+    struct inject_packet_meta *meta;
 
     for (int i = 0; i < nr_pkts; i++)
     {
@@ -277,7 +278,31 @@ int marsio_io_inject(struct marsio_io *handle, uint16_t thr_idx, struct packet *
 
         ptr = marsio_buff_append(mbuff, len);
         memcpy(ptr, packet_get_data(pkt), len);
-        marsio_send_burst(handle->mr_path, thr_idx, &mbuff, 1);
+        meta = (struct inject_packet_meta *)packet_get_origin_ctx(pkt);
+        if (meta)
+        {
+            if (meta->route.used && marsio_buff_set_metadata(mbuff, MR_BUFF_ROUTE_CTX, meta->route.data, meta->route.used) != 0)
+            {
+                PACKET_IO_LOG_ERROR("unable to set route context for inject packet");
+            }
+            if (meta->sids.used && marsio_buff_set_sid_list(mbuff, meta->sids.sid, meta->sids.used) != 0)
+            {
+                PACKET_IO_LOG_ERROR("unable to set sid list for inject packet");
+            }
+            if (meta->session_id && marsio_buff_set_metadata(mbuff, MR_BUFF_SESSION_ID, &meta->session_id, sizeof(meta->session_id)) != 0)
+            {
+                PACKET_IO_LOG_ERROR("unable to set session id for inject packet");
+            }
+            if (meta->link_id)
+            {
+                // TODO
+            }
+            if (meta->is_ctrl)
+            {
+                marsio_buff_set_ctrlbuf(mbuff);
+            }
+        }
+        marsio_send_burst_with_options(handle->mr_path, thr_idx, &mbuff, 1, MARSIO_SEND_OPT_REHASH);
         packet_free(pkt);
     }
 
diff --git a/src/packet_io/packet_io.h b/src/packet_io/packet_io.h
index bdd268e..7415b2d 100644
--- a/src/packet_io/packet_io.h
+++ b/src/packet_io/packet_io.h
@@ -71,6 +71,15 @@ struct packet_io_options
     uint16_t cpu_mask[MAX_THREAD_NUM];
 };
 
+struct inject_packet_meta
+{
+    struct route_ctx route;
+    struct sid_list sids;
+    uint64_t session_id;
+    uint16_t link_id;
+    int is_ctrl;
+};
+
 struct packet_io;
 struct packet_io *packet_io_new(struct packet_io_options *opts);
 void packet_io_free(struct packet_io *packet_io);
diff --git a/src/session/session.cpp b/src/session/session.cpp
index 3daa356..374890b 100644
--- a/src/session/session.cpp
+++ b/src/session/session.cpp
@@ -135,6 +135,36 @@ uint64_t session_get_timestamp(const struct session *sess, enum session_timestam
     return sess->timestamps[type];
 }
 
+void session_clear_sid_list(struct session *sess, enum session_direction dir)
+{
+    memset(&sess->sids[dir], 0, sizeof(struct sid_list));
+}
+
+void session_set_sid_list(struct session *sess, enum session_direction dir, const struct sid_list *list)
+{
+    sess->sids[dir] = *list;
+}
+
+void session_get_sid_list(const struct session *sess, enum session_direction dir, struct sid_list *list)
+{
+    *list = sess->sids[dir];
+}
+
+void session_clear_route_ctx(struct session *sess, enum session_direction dir)
+{
+    memset(&sess->route_ctx[dir], 0, sizeof(struct route_ctx));
+}
+
+void session_set_route_ctx(struct session *sess, enum session_direction dir, const struct route_ctx *ctx)
+{
+    sess->route_ctx[dir] = *ctx;
+}
+
+void session_get_route_ctx(const struct session *sess, enum session_direction dir, struct route_ctx *ctx)
+{
+    *ctx = sess->route_ctx[dir];
+}
+
 void session_set_1st_packet(struct session *sess, enum session_direction dir, const struct packet *pkt)
 {
     sess->first_pkt[dir] = packet_dup(pkt);
diff --git a/src/session/session_manager.cpp b/src/session/session_manager.cpp
index 8b00be3..b4763cf 100644
--- a/src/session/session_manager.cpp
+++ b/src/session/session_manager.cpp
@@ -538,7 +538,14 @@ static void session_update(struct session *sess, enum session_state next_state,
 
      if (!session_get_1st_packet(sess, dir))
      {
+          struct route_ctx ctx = {0};
+          struct sid_list list = {0};
+          packet_get_route_ctx(pkt, &ctx);
+          packet_get_sid_list(pkt, &list);
+
           session_set_1st_packet(sess, dir, pkt);
+          session_set_route_ctx(sess, dir, &ctx);
+          session_set_sid_list(sess, dir, &list);
      }
 
      session_set_current_packet(sess, pkt);
@@ -943,13 +950,17 @@ void session_manager_free_session(struct session_manager *mgr, struct session *s
                break;
           }
 
+          session_free_all_ex_data(sess);
           packet_free((struct packet *)session_get_1st_packet(sess, SESSION_DIRECTION_C2S));
           packet_free((struct packet *)session_get_1st_packet(sess, SESSION_DIRECTION_S2C));
           session_set_1st_packet(sess, SESSION_DIRECTION_C2S, NULL);
           session_set_1st_packet(sess, SESSION_DIRECTION_S2C, NULL);
+          session_clear_route_ctx(sess, SESSION_DIRECTION_C2S);
+          session_clear_route_ctx(sess, SESSION_DIRECTION_S2C);
+          session_clear_sid_list(sess, SESSION_DIRECTION_C2S);
+          session_clear_sid_list(sess, SESSION_DIRECTION_S2C);
           session_set_current_packet(sess, NULL);
           session_set_current_direction(sess, SESSION_DIRECTION_NONE);
-          session_free_all_ex_data(sess);
           session_pool_push(mgr->sess_pool, sess);
           sess = NULL;
      }
diff --git a/src/session/session_priv.h b/src/session/session_priv.h
index 558da08..3675270 100644
--- a/src/session/session_priv.h
+++ b/src/session/session_priv.h
@@ -33,7 +33,7 @@ struct tcp_half
 };
 
 /*
- * sizeof(struct session) = 1024 bytes
+ * sizeof(struct session) > 1024 bytes
  * max thread number = 128
  * per thread max tcp session number = 50000
  * per thread max udp session number = 50000
@@ -42,31 +42,33 @@ struct tcp_half
  */
 struct session
 {
-    uint64_t id;                                   //   8 bytes
-    uint64_t stats[MAX_DIRECTION][MAX_STAT];       // 480 bytes
-    uint64_t timestamps[MAX_TIMESTAMP];            //  16 bytes
-    struct tcp_half tcp_halfs[MAX_DIRECTION];      //  80 bytes
-    struct timeout timeout;                        //  72 bytes -- used for timer
-    struct list_head lru;                          //  16 bytes -- used for lru queue
-    struct list_head free;                         //  16 bytes -- used for free queue
-    struct list_head evicte;                       //  16 bytes -- used for evicte queue
-    UT_hash_handle hh1;                            //  56 bytes -- used for hash table (tuple6)
-    UT_hash_handle hh2;                            //  56 bytes -- used for hash table (tuple4)
-    UT_hash_handle hh3;                            //  56 bytes -- used for hash table (session id)
-    struct tuple6 tuple;                           //  56 bytes
-    char tuple_str[TUPLE6_STR_SIZE];               // 108 bytes
-    const struct packet *first_pkt[MAX_DIRECTION]; //  16 bytes
-    const struct packet *curr_pkt;                 //   8 bytes
-    void *ex_data[EX_DATA_MAX_COUNT];              //  32 bytes
-    void *user_data;                               //   8 bytes
-    int is_symmetric;                              //   4 bytes
-    int dup;                                       //   4 bytes
-    enum session_direction tuple_dir;              //   4 bytes
-    enum session_direction cur_dir;                //   4 bytes
-    enum session_type type;                        //   4 bytes
-    enum session_state state;                      //   4 bytes
-    enum closing_reason reason;                    //   4 bytes
-    struct session_manager_stat *mgr_stat;         //   8 bytes
+    uint64_t id;
+    uint64_t stats[MAX_DIRECTION][MAX_STAT];
+    uint64_t timestamps[MAX_TIMESTAMP];
+    struct tcp_half tcp_halfs[MAX_DIRECTION];
+    struct timeout timeout;
+    struct list_head lru;
+    struct list_head free;
+    struct list_head evicte;
+    UT_hash_handle hh1;
+    UT_hash_handle hh2;
+    UT_hash_handle hh3;
+    struct tuple6 tuple;
+    char tuple_str[TUPLE6_STR_SIZE];
+    struct sid_list sids[MAX_DIRECTION];
+    struct route_ctx route_ctx[MAX_DIRECTION];
+    const struct packet *first_pkt[MAX_DIRECTION];
+    const struct packet *curr_pkt;
+    void *ex_data[EX_DATA_MAX_COUNT];
+    void *user_data;
+    int is_symmetric;
+    int dup;
+    enum session_direction tuple_dir;
+    enum session_direction cur_dir;
+    enum session_type type;
+    enum session_state state;
+    enum closing_reason reason;
+    struct session_manager_stat *mgr_stat;
 };
 
 void session_init(struct session *sess);
@@ -82,6 +84,12 @@ void session_set_dup_traffic(struct session *sess);
 void session_set_closing_reason(struct session *sess, enum closing_reason reason);
 void session_inc_stat(struct session *sess, enum session_direction dir, enum session_stat stat, uint64_t val);
 void session_set_timestamp(struct session *sess, enum session_timestamp type, uint64_t value);
+void session_clear_sid_list(struct session *sess, enum session_direction dir);
+void session_set_sid_list(struct session *sess, enum session_direction dir, const struct sid_list *list);
+void session_get_sid_list(const struct session *sess, enum session_direction dir, struct sid_list *list);
+void session_clear_route_ctx(struct session *sess, enum session_direction dir);
+void session_set_route_ctx(struct session *sess, enum session_direction dir, const struct route_ctx *ctx);
+void session_get_route_ctx(const struct session *sess, enum session_direction dir, struct route_ctx *ctx);
 void session_set_1st_packet(struct session *sess, enum session_direction dir, const struct packet *pkt);
 void session_set_current_packet(struct session *sess, const struct packet *pkt);
 const struct packet *session_get_current_packet(const struct session *sess);
diff --git a/src/stellar/CMakeLists.txt b/src/stellar/CMakeLists.txt
index fcf9dac..0f58984 100644
--- a/src/stellar/CMakeLists.txt
+++ b/src/stellar/CMakeLists.txt
@@ -4,4 +4,6 @@ target_link_libraries(core pthread fieldstat4 toml)
 
 add_executable(stellar main.cpp)
 target_link_libraries(stellar core)
-install(TARGETS stellar RUNTIME DESTINATION bin COMPONENT Program)
\ No newline at end of file
+install(TARGETS stellar RUNTIME DESTINATION bin COMPONENT Program)
+
+add_subdirectory(test)
\ No newline at end of file
diff --git a/src/stellar/inject.cpp b/src/stellar/inject.cpp
index 1f4ae38..e81a8e1 100644
--- a/src/stellar/inject.cpp
+++ b/src/stellar/inject.cpp
@@ -1,4 +1,5 @@
 #include <time.h>
+#include <errno.h>
 #include "tcp_utils.h"
 #include "udp_utils.h"
 #include "ipv4_utils.h"
@@ -8,31 +9,152 @@
 #include "session_priv.h"
 #include "stellar_priv.h"
 
-// OK
-#define CHECKSUM_CARRY(x) (x = (x >> 16) + (x & 0xffff), (~(x + (x >> 16)) & 0xffff))
-static inline int checksum(uint16_t *data, int len)
+#define INJECT_PACKET_LOG_ERROR(format, ...) LOG_ERROR("inject packet", format, ##__VA_ARGS__)
+#define INJECT_PACKE_LOG_DEBUG(format, ...) LOG_DEBUG("inject packet", format, ##__VA_ARGS__)
+
+static uint16_t checksum(const char *data, uint16_t len)
 {
-    int sum = 0;
-    int nleft = len;
-    uint16_t ans = 0;
-    uint16_t *w = data;
+    uint32_t sum = 0;
+    const uint16_t *ip1 = (const uint16_t *)data;
 
-    while (nleft > 1)
+    while (len > 1)
     {
-        sum += *w++;
-        nleft -= 2;
+        sum += *ip1++;
+        if (sum & 0x80000000)
+        {
+            sum = (sum & 0xFFFF) + (sum >> 16);
+        }
+        len -= 2;
     }
 
-    if (nleft == 1)
+    while (sum >> 16)
     {
-        *(char *)(&ans) = *(char *)w;
-        sum += ans;
+        sum = (sum & 0xFFFF) + (sum >> 16);
     }
 
-    return sum;
+    return (~sum);
+}
+
+static uint16_t checksum_v4(const void *l4_hdr, uint16_t l4_total_len, uint8_t l4_proto, struct in_addr *src_addr, struct in_addr *dst_addr)
+{
+    uint16_t *ip_src = (uint16_t *)src_addr;
+    uint16_t *ip_dst = (uint16_t *)dst_addr;
+    const uint16_t *buffer = (u_int16_t *)l4_hdr;
+
+    uint32_t sum = 0;
+    size_t len = l4_total_len;
+
+    while (len > 1)
+    {
+        sum += *buffer++;
+        if (sum & 0x80000000)
+        {
+            sum = (sum & 0xFFFF) + (sum >> 16);
+        }
+        len -= 2;
+    }
+
+    if (len & 1)
+    {
+        sum += *((uint8_t *)buffer);
+    }
+
+    sum += *(ip_src++);
+    sum += *ip_src;
+    sum += *(ip_dst++);
+    sum += *ip_dst;
+    sum += htons(l4_proto);
+    sum += htons(l4_total_len);
+
+    while (sum >> 16)
+    {
+        sum = (sum & 0xFFFF) + (sum >> 16);
+    }
+
+    return ((uint16_t)(~sum));
+}
+
+static uint16_t checksum_v6(const void *l4_hdr, uint16_t l4_total_len, uint8_t l4_proto, struct in6_addr *src_addr, struct in6_addr *dst_addr)
+{
+    uint16_t *ip_src = (uint16_t *)src_addr;
+    uint16_t *ip_dst = (uint16_t *)dst_addr;
+    const uint16_t *buffer = (u_int16_t *)l4_hdr;
+
+    uint32_t sum = 0;
+    size_t len = l4_total_len;
+
+    while (len > 1)
+    {
+        sum += *buffer++;
+        if (sum & 0x80000000)
+        {
+            sum = (sum & 0xFFFF) + (sum >> 16);
+        }
+        len -= 2;
+    }
+
+    if (len & 1)
+    {
+        sum += *((uint8_t *)buffer);
+    }
+
+    for (int i = 0; i < 8; i++)
+    {
+        sum += *ip_src;
+        ip_src++;
+    }
+
+    for (int i = 0; i < 8; i++)
+    {
+        sum += *ip_dst;
+        ip_dst++;
+    }
+    sum += htons(l4_proto);
+    sum += htons(l4_total_len);
+
+    while (sum >> 16)
+    {
+        sum = (sum & 0xFFFF) + (sum >> 16);
+    }
+
+    return ((uint16_t)(~sum));
+}
+
+static void update_tcp_hdr(struct tcphdr *tcphdr, uint32_t seq, uint32_t ack, uint16_t win, uint8_t flags)
+{
+    tcp_hdr_set_seq(tcphdr, seq);
+    tcp_hdr_set_ack(tcphdr, ack);
+    tcp_hdr_set_hdr_len(tcphdr, sizeof(struct tcphdr));
+    tcp_hdr_set_flags(tcphdr, flags);
+    tcp_hdr_set_window(tcphdr, win);
+    tcp_hdr_set_urg_ptr(tcphdr, 0);
+    tcp_hdr_set_checksum(tcphdr, 0);
+}
+
+static void update_udp_hdr(struct udphdr *udphdr, int trim)
+{
+    uint16_t total = udp_hdr_get_total_len(udphdr);
+    udp_hdr_set_total_len(udphdr, total - trim);
+    udp_hdr_set_checksum(udphdr, 0);
+}
+
+static void update_ip4_hdr(struct ip *iphdr, uint16_t ipid, uint8_t ttl, int trim)
+{
+    int hdr_len = ipv4_hdr_get_hdr_len(iphdr);
+    uint16_t total = ipv4_hdr_get_total_len(iphdr);
+    ipv4_hdr_set_total_len(iphdr, total - trim);
+    ipv4_hdr_set_ipid(iphdr, ipid);
+    ipv4_hdr_set_ttl(iphdr, ttl);
+    iphdr->ip_sum = 0;
+    iphdr->ip_sum = checksum((char *)iphdr, hdr_len);
+}
+
+static void update_ip6_hdr(struct ip6_hdr *ip6hdr, int trim)
+{
+    uint16_t len = ipv6_hdr_get_payload_len(ip6hdr);
+    ipv6_hdr_set_payload_len(ip6hdr, len - trim);
 }
 
-// OK
 static inline void calc_tcp_seq_and_ack(const struct session *sess, enum session_direction inj_dir, uint32_t *seq, uint32_t *ack)
 {
     /*
@@ -49,14 +171,12 @@ static inline void calc_tcp_seq_and_ack(const struct session *sess, enum session
      *      ack = current_packet_ack
      *
      * inject direction != current direction (inject S2C RST)
-     *      seq = s2c_direction_last_seq + s2c_direction_last_len
-     *      ack = current_packet_seq
+     *      seq = current_packet_ack
+     *      ack = current_packet_seq + current_packet_payload_len
      */
 
     enum session_direction curr_dir = session_get_current_direction(sess);
-    enum session_direction peer_dir = (curr_dir == SESSION_DIRECTION_C2S) ? SESSION_DIRECTION_S2C : SESSION_DIRECTION_C2S;
     const struct tcp_half *tcp_curr_half = &sess->tcp_halfs[curr_dir];
-    const struct tcp_half *tcp_peer_half = &sess->tcp_halfs[peer_dir];
     if (inj_dir == curr_dir)
     {
         *seq = tcp_curr_half->seq;
@@ -64,15 +184,15 @@ static inline void calc_tcp_seq_and_ack(const struct session *sess, enum session
     }
     else
     {
-        *seq = tcp_peer_half->seq + tcp_peer_half->len;
-        *ack = tcp_curr_half->seq;
+        *seq = tcp_curr_half->ack;
+        *ack = tcp_curr_half->seq + tcp_curr_half->len;
     }
 }
 
-// OK
-#define RANGE(rand, start, end) (start + rand % (end - start + 1)) // [start, end]
 static inline void calc_ipid_ttl_win(uint16_t *ipid, uint8_t *ttl, uint16_t *win)
 {
+#define RANGE(rand, start, end) (start + rand % (end - start + 1)) // [start, end]
+
     struct timespec curtime;
     clock_gettime(CLOCK_THREAD_CPUTIME_ID, &curtime);
     uint64_t random = (0x013579ABCDEF ^ (uint64_t)curtime.tv_nsec);
@@ -81,57 +201,106 @@ static inline void calc_ipid_ttl_win(uint16_t *ipid, uint8_t *ttl, uint16_t *win
     *win = (uint16_t)(RANGE(random, 1000, 1460));
 }
 
-// OK
-static inline void update_ip6_hdr(struct ip6_hdr *ip6hdr, int trim)
-{
-    uint16_t len = ipv6_hdr_get_payload_len(ip6hdr);
-    ipv6_hdr_set_payload_len(ip6hdr, len - trim);
-}
-
-// OK
-static inline void update_ip4_hdr(struct ip *iphdr, uint16_t ipid, uint8_t ttl, int trim)
-{
-    int hdr_len = ipv4_hdr_get_hdr_len(iphdr);
-    uint16_t total = ipv4_hdr_get_total_len(iphdr);
-    ipv4_hdr_set_total_len(iphdr, total - trim);
-    ipv4_hdr_set_ipid(iphdr, ipid);
-    ipv4_hdr_set_ttl(iphdr, ttl);
-    ipv4_hdr_set_checksum(iphdr, 0);
-    uint16_t sum = checksum((uint16_t *)iphdr, hdr_len);
-    sum = CHECKSUM_CARRY(sum);
-    ipv4_hdr_set_checksum(iphdr, ntohs(sum));
-}
-
-// OK
-static inline void update_tcp_hdr(struct tcphdr *tcphdr, uint32_t seq, uint32_t ack, uint16_t win, uint8_t flags)
-{
-    tcp_hdr_set_seq(tcphdr, seq);
-    tcp_hdr_set_ack(tcphdr, ack);
-    tcp_hdr_set_hdr_len(tcphdr, sizeof(struct tcphdr));
-    tcp_hdr_set_flags(tcphdr, flags);
-    tcp_hdr_set_window(tcphdr, win);
-    tcp_hdr_set_checksum(tcphdr, 0);
-    tcp_hdr_set_urg_ptr(tcphdr, 0);
-    uint16_t sum = checksum((uint16_t *)tcphdr, sizeof(struct tcphdr));
-    sum = CHECKSUM_CARRY(sum);
-    tcp_hdr_set_checksum(tcphdr, ntohs(sum));
-}
-
-// OK
-static inline void update_udp_hdr(struct udphdr *udphdr, uint16_t trim)
-{
-    uint16_t total = udp_hdr_get_total_len(udphdr);
-    udp_hdr_set_total_len(udphdr, total - trim);
-    udp_hdr_set_checksum(udphdr, 0);
-    uint16_t sum = checksum((uint16_t *)udphdr, total - trim);
-    sum = CHECKSUM_CARRY(sum);
-    udp_hdr_set_checksum(udphdr, ntohs(sum));
-}
-
 /******************************************************************************
  * Public API
  ******************************************************************************/
 
+struct fingerprint
+{
+    uint16_t ipid;
+    uint8_t ttl;
+    uint16_t win;
+};
+
+// return packet length
+int build_tcp_packet(const struct packet *first, const struct fingerprint *finger,
+                     uint32_t tcp_seq, uint32_t tcp_ack, uint8_t tcp_flags, char *tcp_pld, int pld_len, char *pkt_buff, int buff_size)
+{
+    int trim = 0;
+    struct tcphdr *tcphdr;
+    struct udphdr *udphdr;
+    struct ip *iphdr;
+    struct ip6_hdr *ip6hdr;
+    struct packet_layer *curr;
+    struct packet_layer *last;
+    int len = packet_get_len(first);
+    int8_t layers = packet_get_layers(first);
+
+    if ((tcp_pld == NULL && pld_len > 0) || (tcp_pld != NULL && pld_len <= 0))
+    {
+        return -EINVAL;
+    }
+
+    if (len > buff_size)
+    {
+        return -ENOMEM;
+    }
+
+    memcpy(pkt_buff, packet_get_data(first), len);
+    for (int8_t i = layers - 1; i >= 0; i--)
+    {
+        curr = (struct packet_layer *)packet_get_layer(first, i);
+        switch (curr->type)
+        {
+        case LAYER_TYPE_TCP:
+            trim = curr->hdr_len + curr->pld_len - sizeof(struct tcphdr) + pld_len;
+            if (len + trim > buff_size)
+            {
+                return -ENOMEM;
+            }
+            tcphdr = (struct tcphdr *)(pkt_buff + curr->hdr_offset);
+            update_tcp_hdr(tcphdr, tcp_seq, tcp_ack, finger->win, TH_RST | TH_ACK);
+            if (pld_len)
+            {
+                memcpy(pkt_buff + curr->hdr_offset + sizeof(struct tcphdr), tcp_pld, pld_len);
+            }
+            break;
+        case LAYER_TYPE_UDP:
+            udphdr = (struct udphdr *)(pkt_buff + curr->hdr_offset);
+            update_udp_hdr(udphdr, trim);
+            break;
+        case LAYER_TYPE_IPV4:
+            iphdr = (struct ip *)(pkt_buff + curr->hdr_offset);
+            last = (struct packet_layer *)packet_get_layer(first, i + 1);
+            if (last->type == LAYER_TYPE_TCP)
+            {
+                tcphdr = (struct tcphdr *)(pkt_buff + last->hdr_offset);
+                tcphdr->th_sum = checksum_v4(tcphdr, len - trim - last->hdr_offset, IPPROTO_TCP, &iphdr->ip_src, &iphdr->ip_dst);
+            }
+            if (last->type == LAYER_TYPE_UDP)
+            {
+                udphdr = (struct udphdr *)(pkt_buff + last->hdr_offset);
+                udphdr->uh_sum = checksum_v4(udphdr, len - trim - last->hdr_offset + pld_len, IPPROTO_UDP, &iphdr->ip_src, &iphdr->ip_dst);
+            }
+            update_ip4_hdr(iphdr, finger->ipid, finger->ttl, trim);
+            break;
+        case LAYER_TYPE_IPV6:
+            ip6hdr = (struct ip6_hdr *)(pkt_buff + curr->hdr_offset);
+            last = (struct packet_layer *)packet_get_layer(first, i + 1);
+            if (last->type == LAYER_TYPE_TCP)
+            {
+                tcphdr = (struct tcphdr *)(pkt_buff + last->hdr_offset);
+                tcphdr->th_sum = checksum_v6(tcphdr, len - trim - last->hdr_offset, IPPROTO_TCP, &ip6hdr->ip6_src, &ip6hdr->ip6_dst);
+            }
+            if (last->type == LAYER_TYPE_UDP)
+            {
+                udphdr = (struct udphdr *)(pkt_buff + last->hdr_offset);
+                udphdr->uh_sum = checksum_v6(udphdr, len - trim - last->hdr_offset + pld_len, IPPROTO_UDP, &ip6hdr->ip6_src, &ip6hdr->ip6_dst);
+            }
+            update_ip6_hdr(ip6hdr, trim);
+            break;
+        case LAYER_TYPE_GRE:
+            return -EPROTONOSUPPORT;
+            // TODO
+            break;
+        default:
+            break;
+        }
+    }
+
+    return len - trim;
+}
+
 // return 0: success, -1: failed
 
 int stellar_inject_icmp_unreach(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx)
@@ -140,12 +309,12 @@ int stellar_inject_icmp_unreach(const struct session *sess, enum session_directi
     return -1;
 }
 
-// OK
 int stellar_inject_tcp_rst(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx)
 {
     if (session_get_type(sess) != SESSION_TYPE_TCP)
     {
         session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
+        INJECT_PACKET_LOG_ERROR("session %ld is not a TCP session, cannot inject TCP RST", session_get_id(sess));
         return -1;
     }
 
@@ -153,62 +322,44 @@ int stellar_inject_tcp_rst(const struct session *sess, enum session_direction in
     if (pkt == NULL)
     {
         session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
+        INJECT_PACKET_LOG_ERROR("session %ld has no %s first packet, cannot inject TCP RST", session_get_id(sess), session_direction_to_str(inj_dir));
         return -1;
     }
 
-    uint8_t ttl = 0;
-    uint16_t win = 0;
-    uint16_t ipid = 0;
-    uint32_t seq = 0;
-    uint32_t ack = 0;
-
-    int trim = 0;
+    struct fingerprint finger = {0};
+    uint32_t tcp_seq = 0;
+    uint32_t tcp_ack = 0;
+    uint8_t tcp_flags = TH_RST | TH_ACK;
     char buff[4096] = {0};
-    struct ip *iphdr;
-    struct ip6_hdr *ip6hdr;
-    struct tcphdr *tcphdr;
-    struct packet_layer *layer;
+    calc_tcp_seq_and_ack(sess, inj_dir, &tcp_seq, &tcp_ack);
+    calc_ipid_ttl_win(&finger.ipid, &finger.ttl, &finger.win);
 
-    int len = packet_get_len(pkt);
-    int8_t layers = packet_get_layers(pkt);
-    memcpy(buff, packet_get_data(pkt), len);
-
-    calc_tcp_seq_and_ack(sess, inj_dir, &seq, &ack);
-    calc_ipid_ttl_win(&ipid, &ttl, &win);
-
-    for (int8_t i = layers - 1; i >= 0; i--)
+    int len = build_tcp_packet(pkt, &finger, tcp_seq, tcp_ack, tcp_flags, NULL, 0, buff, sizeof(buff));
+    if (len <= 0)
     {
-        layer = (struct packet_layer *)packet_get_layer(pkt, i);
-        switch (layer->type)
-        {
-        case LAYER_TYPE_TCP:
-            trim = layer->hdr_len + layer->pld_len - sizeof(struct tcphdr);
-            tcphdr = (struct tcphdr *)(buff + layer->hdr_offset);
-            update_tcp_hdr(tcphdr, seq, ack, win, TH_RST | TH_ACK);
-            break;
-        case LAYER_TYPE_IPV4:
-            iphdr = (struct ip *)(buff + layer->hdr_offset);
-            update_ip4_hdr(iphdr, ipid, ttl, trim);
-            break;
-        case LAYER_TYPE_IPV6:
-            ip6hdr = (struct ip6_hdr *)(buff + layer->hdr_offset);
-            update_ip6_hdr(ip6hdr, trim);
-            break;
-        default:
-            break;
-        }
+        INJECT_PACKET_LOG_ERROR("session %ld build TCP %s RST packet failed, %s", session_get_id(sess), session_direction_to_str(inj_dir), strerror(len));
+        session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
+        return -1;
     }
 
+    struct inject_packet_meta meta = {0};
+    meta.session_id = session_get_id(sess);
+    session_get_route_ctx(sess, inj_dir, &meta.route);
+    session_get_sid_list(sess, inj_dir, &meta.sids);
+
     struct packet inj_pkt;
-    packet_parse(&inj_pkt, buff, len - trim);
+    packet_parse(&inj_pkt, buff, len);
+    packet_set_origin(&inj_pkt, PACKET_ORIGIN_USERSTACK);
+    packet_set_origin_ctx(&inj_pkt, &meta);
     if (packet_io_inject(runtime->packet_io, thr_idx, &inj_pkt, 1) == 1)
     {
         session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_SUSS, 1);
-        session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_BYTES_SUSS, len - trim);
+        session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_BYTES_SUSS, len);
         return 0;
     }
     else
     {
+        INJECT_PACKET_LOG_ERROR("session %ld inject TCP %s RST packet failed, packet I/O nospace", session_get_id(sess), session_direction_to_str(inj_dir));
         session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
         return -1;
     }
diff --git a/src/stellar/test/CMakeLists.txt b/src/stellar/test/CMakeLists.txt
new file mode 100644
index 0000000..6c57402
--- /dev/null
+++ b/src/stellar/test/CMakeLists.txt
@@ -0,0 +1,5 @@
+add_executable(gtest_inject_packet gtest_inject_packet.cpp ../config.cpp ../stat.cpp ../stellar.cpp ../inject.cpp)
+target_link_libraries(gtest_inject_packet timestamp session_manager ip_reassembly packet_io pthread fieldstat4 toml gtest)
+
+file(COPY ./conf/log.toml DESTINATION ./conf/)
+file(COPY ./conf/stellar.toml DESTINATION ./conf/)
\ No newline at end of file
diff --git a/src/stellar/test/conf/log.toml b/src/stellar/test/conf/log.toml
new file mode 100644
index 0000000..8f155c0
--- /dev/null
+++ b/src/stellar/test/conf/log.toml
@@ -0,0 +1,4 @@
+[log]
+output = stderr      # stderr, file
+level  = DEBUG       # TRACE, DEBUG, INFO, WARN, ERROR, FATAL
+file = "log/stellar.log"
diff --git a/src/stellar/test/conf/stellar.toml b/src/stellar/test/conf/stellar.toml
new file mode 100644
index 0000000..a004d0e
--- /dev/null
+++ b/src/stellar/test/conf/stellar.toml
@@ -0,0 +1,56 @@
+[device]
+base = 1   # [0, 31]
+offset = 2 # [0, 127]
+
+[packet_io]
+mode = marsio                        # dumpfile, marsio
+app_symbol = stellar
+dev_symbol = nf_0_fw
+
+dumpfile_dir = "/tmp/dumpfile/"
+nr_threads = 1                  # [1, 256]
+cpu_mask = [5]
+
+[ip_reassembly]
+enable = 1
+timeout = 10000    # range: [1, 60000] (ms)
+bucket_entries = 8 # range: [1, 256] (must be power of 2)
+bucket_num = 4096  # range: [1, 4294967295]
+
+[session_manager]
+# max session number
+max_tcp_session_num = 50000
+max_udp_session_num = 50000
+
+# session overload evict
+tcp_overload_evict_old_sess = 1 # 1: evict old session, 0: bypass new session
+udp_overload_evict_old_sess = 1 # 1: evict old session, 0: bypass new session
+
+# TCP timeout
+tcp_init_timeout = 5000           # range: [1, 60000] (ms)
+tcp_handshake_timeout = 5000      # range: [1, 60000] (ms)
+tcp_data_timeout = 5000           # range: [1, 15999999000] (ms)
+tcp_half_closed_timeout = 5000    # range: [1, 604800000] (ms)
+tcp_time_wait_timeout = 5000      # range: [1, 600000] (ms)
+tcp_discard_timeout = 10000       # range: [1, 15999999000] (ms)
+tcp_unverified_rst_timeout = 5000 # range: [1, 600000] (ms)
+# UDP timeout
+udp_data_timeout = 5000    # range: [1, 15999999000] (ms)
+udp_discard_timeout = 5000 # range: [1, 15999999000] (ms)
+
+# duplicate packet filter
+duplicated_packet_filter_enable = 1
+duplicated_packet_filter_capacity = 1000000   # range: [1, 4294967295]
+duplicated_packet_filter_timeout = 10000      # range: [1, 60000] (ms)
+duplicated_packet_filter_error_rate = 0.00001 # range: [0.0, 1.0]
+
+# evicted session filter
+evicted_session_filter_enable = 1
+evicted_session_filter_capacity = 1000000   # range: [1, 4294967295]
+evicted_session_filter_timeout = 10000      # range: [1, 60000] (ms)
+evicted_session_filter_error_rate = 0.00001 # range: [0.0, 1.0]
+
+# TCP reassembly (Per direction)
+tcp_reassembly_enable = 1
+tcp_reassembly_max_timeout = 10000 # range: [1, 60000] (ms)
+tcp_reassembly_max_segments = 128  # range: [2, 512]
diff --git a/src/stellar/test/gtest_inject_packet.cpp b/src/stellar/test/gtest_inject_packet.cpp
new file mode 100644
index 0000000..a4f08a4
--- /dev/null
+++ b/src/stellar/test/gtest_inject_packet.cpp
@@ -0,0 +1,197 @@
+#include <gtest/gtest.h>
+#include <stdio.h>
+#include <errno.h>
+#include <unistd.h>
+#include <string.h>
+#include <signal.h>
+#include <stdlib.h>
+
+#include "config.h"
+#include "timestamp.h"
+#include "id_generator.h"
+#include "stellar_priv.h"
+#include "session_priv.h"
+
+#define GMOCK_PLUGIN_MANAGER_LOG_ERROR(format, ...) LOG_ERROR("gmock plugin manager", format, ##__VA_ARGS__)
+#define GMOCK_PLUGIN_MANAGER_LOG_DEBUG(format, ...) LOG_DEBUG("gomck plugin manager", format, ##__VA_ARGS__)
+
+static void inject_tcp_rst_condtion(struct session *sess, uint16_t thr_idx)
+{
+    uint64_t session_num = sess->mgr_stat->total_nr_tcp_sess_used;
+
+    switch (session_num)
+    {
+    case 1:
+        // recv SYN packet
+        if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0)
+        {
+            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == -1);
+            GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv SYN packet", session_get_id(sess), session_get_tuple_str(sess));
+        }
+        break;
+    case 2:
+        // recv SYN-ACK packet
+        if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1)
+        {
+            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
+            GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv SYN-ACK packet", session_get_id(sess), session_get_tuple_str(sess));
+        }
+        break;
+    case 3:
+        // recv sub-ACK packet
+        if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 2 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1)
+        {
+            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
+            GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv sub-ACK packet", session_get_id(sess), session_get_tuple_str(sess));
+        }
+        break;
+    case 4:
+        // recv C2S Payload
+        if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_INJ_PKTS_SUSS) == 0 && session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_RX) == 1)
+        {
+            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
+            GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv C2S first payload packet", session_get_id(sess), session_get_tuple_str(sess));
+        }
+        break;
+    case 5:
+        // recv S2C Payload
+        if (session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_INJ_PKTS_SUSS) == 0 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_RX) == 1)
+        {
+            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
+            GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv S2C first payload packet", session_get_id(sess), session_get_tuple_str(sess));
+        }
+        break;
+    default:
+        break;
+    }
+}
+
+/******************************************************************************
+ * gmock plugin manager
+ ******************************************************************************/
+
+struct plugin_manager
+{
+};
+
+void *plugin_manager_new_ctx(struct session *sess)
+{
+    return sess;
+}
+
+void plugin_manager_free_ctx(void *ctx)
+{
+    struct session *sess = (struct session *)ctx;
+
+    char buff[4096] = {0};
+    session_to_json(sess, buff, sizeof(buff));
+    GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> session: %s", buff);
+}
+
+struct plugin_manager *plugin_manager_new(void)
+{
+    static struct plugin_manager mgr;
+    return &mgr;
+}
+
+void plugin_manager_free(struct plugin_manager *mgr)
+{
+}
+
+void plugin_manager_dispatch_session(struct plugin_manager *mgr, struct session *sess, struct packet *pkt)
+{
+    struct tcp_segment *seg;
+    enum session_type type = session_get_type(sess);
+    uint16_t thr_idx = stellar_get_current_thread_index();
+    GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> thread [%d] plugin dispatch session: %lu %s, type: %s, state: %s", thr_idx,
+                                   session_get_id(sess), session_get_tuple_str(sess), session_type_to_str(type), session_state_to_str(session_get_state(sess)));
+
+    if (packet_is_ctrl(pkt))
+    {
+    }
+    else
+    {
+        switch (type)
+        {
+        case SESSION_TYPE_TCP:
+            while ((seg = session_get_tcp_segment(sess)) != NULL)
+            {
+                session_free_tcp_segment(sess, seg);
+            }
+            inject_tcp_rst_condtion(sess, thr_idx);
+            break;
+        case SESSION_TYPE_UDP:
+            break;
+        default:
+            assert(0);
+            break;
+        }
+    }
+}
+
+void plugin_manager_dispatch_packet(struct plugin_manager *mgr, struct packet *pkt)
+{
+}
+
+/******************************************************************************
+ * gmock main
+ ******************************************************************************/
+
+static const char *log_config_file = "./conf/log.toml";
+static const char *stellar_config_file = "./conf/stellar.toml";
+
+int gmock_main(int argc, char **argv)
+{
+    int run_time_ms = atoi(argv[0]);
+    timestamp_update();
+    EXPECT_TRUE(log_init(log_config_file) == 0);
+    EXPECT_TRUE(stellar_load_config(stellar_config_file, config) == 0);
+    EXPECT_TRUE(id_generator_init(config->dev_opts.base, config->dev_opts.offset) == 0);
+    runtime->stat = stellar_stat_new(config->io_opts.nr_threads);
+    EXPECT_TRUE(runtime->stat);
+    runtime->plug_mgr = plugin_manager_new();
+    EXPECT_TRUE(runtime->plug_mgr);
+    runtime->packet_io = packet_io_new(&config->io_opts);
+    EXPECT_TRUE(runtime->packet_io);
+    EXPECT_TRUE(stellar_thread_init(runtime, config) == 0);
+    EXPECT_TRUE(stellar_thread_run(runtime, config) == 0);
+    runtime->stat_last_output_ts = timestamp_get_msec();
+    for (int i = 0; i < run_time_ms; i++)
+    {
+        timestamp_update();
+        if (timestamp_get_msec() - runtime->stat_last_output_ts > 2000)
+        {
+            runtime->stat_last_output_ts = timestamp_get_msec();
+            stellar_stat_output(runtime->stat);
+        }
+        usleep(1000); // 1ms
+    }
+    ATOMIC_SET(&runtime->need_exit, 1);
+    stellar_thread_join(runtime, config);
+    stellar_thread_clean(runtime, config);
+    packet_io_free(runtime->packet_io);
+    plugin_manager_free(runtime->plug_mgr);
+    stellar_stat_free(runtime->stat);
+    log_free();
+
+    return 0;
+}
+
+#if 1
+TEST(INJECT, TCP_RST)
+{
+    char *argv[] = {"30000"}; // 30 seconds
+    EXPECT_TRUE(gmock_main(1, argv) == 0);
+}
+#endif
+
+int main(int argc, char **argv)
+{
+    ::testing::InitGoogleTest(&argc, argv);
+    return RUN_ALL_TESTS();
+}