diff --git a/src/session/test/CMakeLists.txt b/src/session/test/CMakeLists.txt
index 8670376..7b307ab 100644
--- a/src/session/test/CMakeLists.txt
+++ b/src/session/test/CMakeLists.txt
@@ -26,6 +26,9 @@ target_link_libraries(gtest_tcp_opening_to_active session_manager gtest)
 add_executable(gtest_tcp_active_to_closing gtest_tcp_active_to_closing.cpp)
 target_link_libraries(gtest_tcp_active_to_closing session_manager gtest)
 
+add_executable(gtest_tcp_opening_to_closing gtest_tcp_opening_to_closing.cpp)
+target_link_libraries(gtest_tcp_opening_to_closing session_manager gtest)
+
 include(GoogleTest)
 gtest_discover_tests(gtest_session)
 gtest_discover_tests(gtest_session_pool)
@@ -34,4 +37,5 @@ gtest_discover_tests(gtest_session_timer)
 gtest_discover_tests(gtest_session_queue)
 gtest_discover_tests(gtest_tcp_init_to_opening)
 gtest_discover_tests(gtest_tcp_opening_to_active)
-gtest_discover_tests(gtest_tcp_active_to_closing)
\ No newline at end of file
+gtest_discover_tests(gtest_tcp_active_to_closing)
+gtest_discover_tests(gtest_tcp_opening_to_closing)
\ No newline at end of file
diff --git a/src/session/test/gtest_tcp_opening_to_closing.cpp b/src/session/test/gtest_tcp_opening_to_closing.cpp
new file mode 100644
index 0000000..70fe7aa
--- /dev/null
+++ b/src/session/test/gtest_tcp_opening_to_closing.cpp
@@ -0,0 +1,558 @@
+// TCP state machine test: opening -> closing
+
+#include "test_state_machine.h"
+
+static void build_opening_tcp_session(struct session_manager *mgr, struct session *sess)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+
+    // SYN Packet
+    printf("=> packet parse: TCP C2S SYN packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt1_c2s_syn, sizeof(tcp_pkt1_c2s_syn));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
+    EXPECT_TRUE(session_get_create_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == TCP_SYN_RECVED);
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) == NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    __session_manager_count(mgr, 1, 0, 0, 0, 0, 0);
+
+    sleep(1);
+    timestamp_update();
+}
+
+/******************************************************************************
+ * case: TCP opening -> closing (by FIN-FIN)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_OPENING_TO_CLOSING, BY_FIN_FIN)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    build_opening_tcp_session(mgr, sess);
+
+    // C2S FIN Packet
+    printf("=> packet parse: TCP C2S FIN packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt9_c2s_fin, sizeof(tcp_pkt9_c2s_fin));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == CLOSING_BY_CLIENT_FIN);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_C2S_ACK_RECVED | TCP_C2S_FIN_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) == NULL);
+
+    __session_dispatch(sess);
+
+    __session_manager_count(mgr, 1, 0, 0, 0, 0, 0);
+
+    sleep(1);
+    timestamp_update();
+
+    // S2C FIN Packet
+    printf("=> packet parse: TCP S2C FIN packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt10_s2c_fin, sizeof(tcp_pkt10_s2c_fin));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == CLOSING_BY_CLIENT_FIN);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 66);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_C2S_ACK_RECVED | TCP_S2C_ACK_RECVED | TCP_C2S_FIN_RECVED | TCP_S2C_FIN_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+
+    __session_dispatch(sess);
+
+    __session_manager_count(mgr, 0, 0, 1, 0, 0, 0);
+    __session_manager_dispatch(mgr, CLOSING_BY_CLIENT_FIN);
+    __session_manager_count(mgr, 0, 0, 0, 0, 0, 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP opening -> closing (by C2S RST)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_OPENING_TO_CLOSING, BY_C2S_RST)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    build_opening_tcp_session(mgr, sess);
+
+    // C2S RST Packet
+    printf("=> packet parse: TCP C2S RST packet\n");
+    char tcp_pkt_c2s_rst[1500] = {0};
+    memcpy(tcp_pkt_c2s_rst, tcp_pkt9_c2s_fin, sizeof(tcp_pkt9_c2s_fin));
+    packet_parse(&pkt, (const char *)tcp_pkt_c2s_rst, sizeof(tcp_pkt9_c2s_fin));
+    const struct layer_record *tcp_layer = packet_get_innermost_layer(&pkt, LAYER_TYPE_TCP);
+    EXPECT_TRUE(tcp_layer);
+    struct tcphdr *hdr = (struct tcphdr *)tcp_layer->hdr_ptr;
+    tcp_hdr_set_flags(hdr, 0);
+    tcp_hdr_set_flag_rst(hdr);
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == CLOSING_BY_CLIENT_RST);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_C2S_RST_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) == NULL);
+
+    __session_dispatch(sess);
+
+    __session_manager_count(mgr, 0, 0, 1, 0, 0, 0);
+    __session_manager_dispatch(mgr, CLOSING_BY_CLIENT_RST);
+    __session_manager_count(mgr, 0, 0, 0, 0, 0, 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP opening -> closing (by S2C RST)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_OPENING_TO_CLOSING, BY_S2C_RST)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    build_opening_tcp_session(mgr, sess);
+
+    // S2C RST Packet
+    printf("=> packet parse: TCP S2C RST packet\n");
+    char tcp_pkt_s2c_rst[1500] = {0};
+    memcpy(tcp_pkt_s2c_rst, tcp_pkt10_s2c_fin, sizeof(tcp_pkt10_s2c_fin));
+    packet_parse(&pkt, (const char *)tcp_pkt_s2c_rst, sizeof(tcp_pkt10_s2c_fin));
+    const struct layer_record *tcp_layer = packet_get_innermost_layer(&pkt, LAYER_TYPE_TCP);
+    EXPECT_TRUE(tcp_layer);
+    struct tcphdr *hdr = (struct tcphdr *)tcp_layer->hdr_ptr;
+    tcp_hdr_set_flags(hdr, 0);
+    tcp_hdr_set_flag_rst(hdr);
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == CLOSING_BY_SERVER_RST);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 66);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_S2C_RST_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+
+    __session_dispatch(sess);
+
+    __session_manager_count(mgr, 0, 0, 1, 0, 0, 0);
+    __session_manager_dispatch(mgr, CLOSING_BY_SERVER_RST);
+    __session_manager_count(mgr, 0, 0, 0, 0, 0, 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP opening -> closing (by init timeout)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_OPENING_TO_CLOSING, BY_INIT_TIMEOUT)
+{
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    build_opening_tcp_session(mgr, sess);
+
+    __session_manager_dispatch(mgr, CLOSING_BY_TIMEOUT);
+    __session_manager_count(mgr, 0, 0, 0, 0, 0, 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP opening -> closing (by handshake timeout)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_OPENING_TO_CLOSING, BY_HANDSHAKE_TIMEOUT)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    build_opening_tcp_session(mgr, sess);
+
+    // S2C SYNACK Packet
+    printf("=> packet parse: TCP S2C SYNACK packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    __session_manager_count(mgr, 1, 0, 0, 0, 0, 0);
+    __session_manager_dispatch(mgr, CLOSING_BY_TIMEOUT);
+    __session_manager_count(mgr, 0, 0, 0, 0, 0, 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP opening -> closing (by data timeout)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_OPENING_TO_CLOSING, BY_DATA_TIMEOUT)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    build_opening_tcp_session(mgr, sess);
+
+    // S2C SYNACK Packet
+    printf("=> packet parse: TCP S2C SYNACK packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt2_s2c_syn_ack, sizeof(tcp_pkt2_s2c_syn_ack));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_1st_pkt(sess) == session_get0_c2s_1st_pkt(sess));
+
+    __session_dispatch(sess);
+
+    __session_manager_count(mgr, 1, 0, 0, 0, 0, 0);
+
+    sleep(1);
+    timestamp_update();
+
+    // ACK Packet
+    printf("=> packet parse: TCP C2S ACK packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt3_c2s_ack, sizeof(tcp_pkt3_c2s_ack));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 74);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_SYNACK_RECVED | TCP_C2S_ACK_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+
+    __session_dispatch(sess);
+
+    __session_manager_count(mgr, 1, 0, 0, 0, 0, 0);
+    __session_manager_dispatch(mgr, CLOSING_BY_TIMEOUT);
+    __session_manager_count(mgr, 0, 0, 0, 0, 0, 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP opening -> closing (by C2S half closed timeout)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_OPENING_TO_CLOSING, BY_C2S_HALF_CLOSED_TIMEOUT)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    build_opening_tcp_session(mgr, sess);
+
+    // C2S FIN Packet
+    printf("=> packet parse: TCP C2S FIN packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt9_c2s_fin, sizeof(tcp_pkt9_c2s_fin));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == CLOSING_BY_CLIENT_FIN);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78 + 66);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 0);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1 + 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 0);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_C2S_ACK_RECVED | TCP_C2S_FIN_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) == NULL);
+
+    __session_dispatch(sess);
+
+    __session_manager_count(mgr, 1, 0, 0, 0, 0, 0);
+    __session_manager_dispatch(mgr, CLOSING_BY_CLIENT_FIN);
+    __session_manager_count(mgr, 0, 0, 0, 0, 0, 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+/******************************************************************************
+ * case: TCP opening -> closing (by S2C half closed timeout)
+ ******************************************************************************/
+
+#if 1
+TEST(TCP_OPENING_TO_CLOSING, BY_S2C_HALF_CLOSED_TIMEOUT)
+{
+    char buffer[1024] = {0};
+    struct packet pkt;
+    struct session *sess = NULL;
+    struct session_manager *mgr = NULL;
+
+    timestamp_update();
+
+    mgr = session_manager_create(&config);
+    EXPECT_TRUE(mgr != NULL);
+
+    // SYN Packet
+    build_opening_tcp_session(mgr, sess);
+
+    // S2C FIN Packet
+    printf("=> packet parse: TCP S2C FIN packet\n");
+    packet_parse(&pkt, (const char *)tcp_pkt10_s2c_fin, sizeof(tcp_pkt10_s2c_fin));
+    printf("<= packet parse\n\n");
+    sess = session_manager_update_session(mgr, &pkt);
+    EXPECT_TRUE(sess);
+
+    EXPECT_TRUE(session_get_id(sess) == 0);
+    tuple6_tostring(session_get0_key(sess), buffer, sizeof(buffer));
+    EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
+    EXPECT_TRUE(session_get_key_dir(sess) == SESSION_DIR_C2S);
+    EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
+    EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
+    EXPECT_TRUE(session_get_dup_traffic_flag(sess) == 0);
+    EXPECT_TRUE(session_get_closing_reasion(sess) == CLOSING_BY_SERVER_FIN);
+    EXPECT_TRUE(session_get_c2s_bytes(sess) == 78);
+    EXPECT_TRUE(session_get_s2c_bytes(sess) == 66);
+    EXPECT_TRUE(session_get_c2s_packets(sess) == 1);
+    EXPECT_TRUE(session_get_s2c_packets(sess) == 1);
+    EXPECT_TRUE(session_get_create_time(sess) < timestamp_get_msec());
+    EXPECT_TRUE(session_get_last_time(sess) == timestamp_get_msec());
+    EXPECT_TRUE(session_get0_cur_pkt(sess) == &pkt);
+    EXPECT_TRUE(session_get_cur_dir(sess) == SESSION_DIR_S2C);
+    EXPECT_TRUE(session_get_tcp_state(sess) == (TCP_SYN_RECVED | TCP_S2C_ACK_RECVED | TCP_S2C_FIN_RECVED));
+    EXPECT_TRUE(session_get0_c2s_1st_pkt(sess) != NULL);
+    EXPECT_TRUE(session_get0_s2c_1st_pkt(sess) != NULL);
+
+    __session_dispatch(sess);
+
+    __session_manager_count(mgr, 1, 0, 0, 0, 0, 0);
+    __session_manager_dispatch(mgr, CLOSING_BY_SERVER_FIN);
+    __session_manager_count(mgr, 0, 0, 0, 0, 0, 0);
+
+    session_manager_destroy(mgr);
+}
+#endif
+
+int main(int argc, char **argv)
+{
+    ::testing::InitGoogleTest(&argc, argv);
+    return RUN_ALL_TESTS();
+}