diff --git a/include/stellar/packet.h b/include/stellar/packet.h
index 85bcf8b..9715b25 100644
--- a/include/stellar/packet.h
+++ b/include/stellar/packet.h
@@ -78,7 +78,30 @@ const struct packet_layer *packet_get_outermost_layer(const struct packet *pkt,
  * Utils
  ******************************************************************************/
 
-int8_t packet_get_layers(const struct packet *pkt);
+#define MAX_SID_NUM 8
+struct sid_list
+{
+    uint16_t sid[MAX_SID_NUM];
+    int used;
+};
+
+enum packet_direction
+{
+    PACKET_DIRECTION_OUTGOING = 0, // Internal -> External: 0
+    PACKET_DIRECTION_INCOMING = 1, // External -> Internal: 1
+};
+
+enum packet_action
+{
+    PACKET_ACTION_FORWARD = 0,
+    PACKET_ACTION_DROP = 1,
+};
+
+enum packet_direction packet_get_direction(const struct packet *pkt);
+uint64_t packet_get_session_id(const struct packet *pkt);
+void packet_prepend_sid_list(struct packet *pkt, const struct sid_list *list);
+
+int8_t packet_get_layers_number(const struct packet *pkt);
 const struct packet_layer *packet_get_layer(const struct packet *pkt, int8_t idx);
 
 const char *packet_get_data(const struct packet *pkt);
@@ -87,27 +110,8 @@ uint16_t packet_get_len(const struct packet *pkt);
 const char *packet_get_payload(const struct packet *pkt);
 uint16_t packet_get_payload_len(const struct packet *pkt);
 
-int packet_need_drop(const struct packet *pkt);
-void packet_set_drop(struct packet *pkt);
-
-int packet_is_ctrl(const struct packet *pkt);
-
-void packet_set_direction(struct packet *pkt, int dir);
-int packet_get_direction(const struct packet *pkt); // 1: E2I, 0: I2E
-
-void packet_set_session_id(struct packet *pkt, uint64_t sess_id);
-uint64_t packet_get_session_id(const struct packet *pkt);
-
-#define MAX_SID_NUM 8
-struct sid_list
-{
-    uint16_t sid[MAX_SID_NUM];
-    int used;
-};
-void packet_set_sid_list(struct packet *pkt, const struct sid_list *list);
-void packet_get_sid_list(const struct packet *pkt, struct sid_list *list);
-void packet_prepend_sid_list(struct packet *pkt, const struct sid_list *list);
-void packet_append_sid_list(struct packet *pkt, const struct sid_list *list);
+void packet_set_action(struct packet *pkt, enum packet_action action);
+enum packet_action packet_get_action(const struct packet *pkt);
 
 /*
  ******************************************************************************
@@ -138,7 +142,7 @@ void packet_append_sid_list(struct packet *pkt, const struct sid_list *list);
  ******************************************************************************
  *
  *    // inorder
- *    int8_t layers = packet_get_layers(pkt);
+ *    int8_t layers = packet_get_layers_number(pkt);
  *    for (int8_t i = 0; i < layers; i++)
  *    {
  *        const struct packet_layer *layer = packet_get_layer(pkt, i);
diff --git a/include/stellar/session.h b/include/stellar/session.h
index c14267b..976ffca 100644
--- a/include/stellar/session.h
+++ b/include/stellar/session.h
@@ -29,10 +29,16 @@ enum session_type
 
 enum session_direction
 {
-    SESSION_DIRECTION_NONE = -1,
-    SESSION_DIRECTION_C2S = 0,
-    SESSION_DIRECTION_S2C = 1,
-    MAX_DIRECTION = 2,
+    SESSION_DIRECTION_INBOUND = 0,
+    SESSION_DIRECTION_OUTBOUND = 1,
+};
+
+enum flow_direction
+{
+    FLOW_DIRECTION_NONE = -1,
+    FLOW_DIRECTION_C2S = 0,
+    FLOW_DIRECTION_S2C = 1,
+    MAX_FLOW_DIRECTION = 2,
 };
 
 enum closing_reason
@@ -118,18 +124,15 @@ int session_has_dup_traffic(const struct session *sess);
 enum session_type session_get_type(const struct session *sess);
 enum session_state session_get_state(const struct session *sess);
 enum closing_reason session_get_closing_reason(const struct session *sess);
-enum session_direction session_get_current_direction(const struct session *sess);
-const struct packet *session_get_1st_packet(const struct session *sess, enum session_direction dir);
+enum session_direction session_get_direction(const struct session *sess);
+enum flow_direction session_get_flow_direction(const struct session *sess);
+const struct packet *session_get_first_packet(const struct session *sess, enum flow_direction dir);
 
 uint64_t session_get_id(const struct session *sess);
 uint64_t session_get_timestamp(const struct session *sess, enum session_timestamp type);
-uint64_t session_get_stat(const struct session *sess, enum session_direction dir, enum session_stat stat);
+uint64_t session_get_stat(const struct session *sess, enum flow_direction dir, enum session_stat stat);
 
 const char *session_get_tuple_str(const struct session *sess);
-const char *session_type_to_str(enum session_type type);
-const char *session_state_to_str(enum session_state state);
-const char *session_direction_to_str(enum session_direction dir);
-const char *closing_reason_to_str(enum closing_reason reason);
 
 #ifdef __cplusplus
 }
diff --git a/include/stellar/stellar.h b/include/stellar/stellar.h
index c633825..824bbd0 100644
--- a/include/stellar/stellar.h
+++ b/include/stellar/stellar.h
@@ -11,12 +11,9 @@ extern "C"
 uint16_t stellar_get_current_thread_index();
 
 // return 0: success, -1: failed
-int stellar_inject_icmp_unreach(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx);
-int stellar_inject_tcp_rst(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx);
-int stellar_inject_tcp_payload(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx, const char *payload, uint16_t len);
-int stellar_inject_udp_payload(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx, const char *payload, uint16_t len);
-int stellar_inject_ctrl_msg(const struct session *sess, uint16_t *sids, int nr_sid, uint16_t thr_idx, const char *msg, uint16_t len);
-int stellar_inject_stateless_pkt(uint16_t link_id, uint16_t thr_idx, const char *packet, uint16_t len);
+int stellar_inject_tcp_flags(const struct session *sess, enum flow_direction inject_dir, uint8_t flags);
+int stellar_inject_payload(const struct session *sess, enum flow_direction inject_dir, const char *payload, uint16_t len);
+int stellar_inject_ctrl_msg(const struct session *sess, const struct sid_list *sids, const char *msg, uint16_t len);
 
 #ifdef __cplusplus
 }
diff --git a/src/packet/packet_priv.h b/src/packet/packet_priv.h
index a55ac05..864dfcc 100644
--- a/src/packet/packet_priv.h
+++ b/src/packet/packet_priv.h
@@ -45,8 +45,8 @@ struct packet
     const char *data_ptr;
     uint16_t data_len;
 
-    int need_drop;
     void *origin_ctx; // mbuff or pcap pointer
+    enum packet_action action;
     enum packet_origin origin;
 };
 
@@ -62,23 +62,6 @@ uint64_t packet_get_hash(const struct packet *pkt, enum ldbc_method method, int
  * Utils
  ******************************************************************************/
 
-void packet_set_origin(struct packet *pkt, enum packet_origin origin);
-enum packet_origin packet_get_origin(const struct packet *pkt);
-
-void packet_set_origin_ctx(struct packet *pkt, void *ctx);
-void *packet_get_origin_ctx(const struct packet *pkt);
-
-int packet_is_fragment(const struct packet *pkt);
-
-void packet_set_ctrl(struct packet *pkt);
-
-struct packet *packet_new(uint16_t pkt_len);
-void packet_free(struct packet *pkt);
-struct packet *packet_dup(const struct packet *pkt);
-
-void packet_set_domain(struct packet *pkt, uint64_t domain);
-uint64_t packet_get_domain(const struct packet *pkt);
-
 #define MAX_ROUTE_CTX 64
 struct route_ctx
 {
@@ -88,6 +71,31 @@ struct route_ctx
 void packet_set_route_ctx(struct packet *pkt, const struct route_ctx *ctx);
 void packet_get_route_ctx(const struct packet *pkt, struct route_ctx *ctx);
 
+void packet_set_origin(struct packet *pkt, enum packet_origin origin);
+enum packet_origin packet_get_origin(const struct packet *pkt);
+
+void packet_set_origin_ctx(struct packet *pkt, void *ctx);
+void *packet_get_origin_ctx(const struct packet *pkt);
+
+void packet_set_domain(struct packet *pkt, uint64_t domain);
+uint64_t packet_get_domain(const struct packet *pkt);
+
+void packet_set_ctrl(struct packet *pkt);
+int packet_is_ctrl(const struct packet *pkt);
+
+void packet_set_sid_list(struct packet *pkt, const struct sid_list *list);
+void packet_get_sid_list(const struct packet *pkt, struct sid_list *list);
+void packet_append_sid_list(struct packet *pkt, const struct sid_list *list);
+
+struct packet *packet_new(uint16_t pkt_len);
+void packet_free(struct packet *pkt);
+struct packet *packet_dup(const struct packet *pkt);
+
+void packet_set_session_id(struct packet *pkt, uint64_t sess_id);
+void packet_set_direction(struct packet *pkt, enum packet_direction dir);
+
+int packet_is_fragment(const struct packet *pkt);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/packet/packet_utils.cpp b/src/packet/packet_utils.cpp
index f1e46d1..8ffc0da 100644
--- a/src/packet/packet_utils.cpp
+++ b/src/packet/packet_utils.cpp
@@ -19,7 +19,7 @@ enum packet_origin packet_get_origin(const struct packet *pkt)
     return pkt->origin;
 }
 
-int8_t packet_get_layers(const struct packet *pkt)
+int8_t packet_get_layers_number(const struct packet *pkt)
 {
     return pkt->layers_used;
 }
@@ -61,14 +61,14 @@ uint16_t packet_get_payload_len(const struct packet *pkt)
     return pkt->layers[pkt->layers_used - 1].pld_len;
 }
 
-int packet_need_drop(const struct packet *pkt)
+void packet_set_action(struct packet *pkt, enum packet_action action)
 {
-    return pkt->need_drop;
+    pkt->action = action;
 }
 
-void packet_set_drop(struct packet *pkt)
+enum packet_action packet_get_action(const struct packet *pkt)
 {
-    pkt->need_drop = 1;
+    return pkt->action;
 }
 
 void packet_set_origin_ctx(struct packet *pkt, void *ctx)
@@ -174,8 +174,7 @@ int packet_is_ctrl(const struct packet *pkt)
     }
 }
 
-// 1: E2I, 0: I2E
-void packet_set_direction(struct packet *pkt, int dir)
+void packet_set_direction(struct packet *pkt, enum packet_direction dir)
 {
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
@@ -192,15 +191,14 @@ void packet_set_direction(struct packet *pkt, int dir)
     }
 }
 
-// 1: E2I, 0: I2E
-int packet_get_direction(const struct packet *pkt)
+enum packet_direction packet_get_direction(const struct packet *pkt)
 {
-    int direction = 0;
+    enum packet_direction dir = PACKET_DIRECTION_INCOMING;
     if (packet_get_origin(pkt) == PACKET_ORIGIN_MARSIO)
     {
         marsio_buff_t *mbuff = (marsio_buff_t *)packet_get_origin_ctx(pkt);
         assert(mbuff != NULL);
-        if (marsio_buff_get_metadata(mbuff, MR_BUFF_DIR, &direction, sizeof(direction)) <= 0)
+        if (marsio_buff_get_metadata(mbuff, MR_BUFF_DIR, &dir, sizeof(dir)) <= 0)
         {
             PACKET_LOG_ERROR("failed to get direction");
         }
@@ -210,7 +208,7 @@ int packet_get_direction(const struct packet *pkt)
         PACKET_LOG_ERROR("packet origin is not marsio, failed to get direction");
     }
 
-    return direction;
+    return dir;
 }
 
 void packet_set_session_id(struct packet *pkt, uint64_t sess_id)
diff --git a/src/packet_io/dumpfile_io.cpp b/src/packet_io/dumpfile_io.cpp
index 841869c..127d3e5 100644
--- a/src/packet_io/dumpfile_io.cpp
+++ b/src/packet_io/dumpfile_io.cpp
@@ -292,6 +292,7 @@ int dumpfile_io_ingress(struct dumpfile_io *handle, uint16_t thr_idx, struct pac
             packet_parse(pkt, pcap_pkt->data, pcap_pkt->len);
             packet_set_origin_ctx(pkt, pcap_pkt);
             packet_set_origin(pkt, PACKET_ORIGIN_DUMPFILE);
+            packet_set_action(pkt, PACKET_ACTION_FORWARD);
             nr_parsed++;
         }
     }
diff --git a/src/packet_io/marsio_io.cpp b/src/packet_io/marsio_io.cpp
index f3204d6..0b2eada 100644
--- a/src/packet_io/marsio_io.cpp
+++ b/src/packet_io/marsio_io.cpp
@@ -172,6 +172,7 @@ int marsio_io_ingress(struct marsio_io *handle, uint16_t thr_idx, struct packet
         packet_parse(pkt, data, len);
         packet_set_origin_ctx(pkt, mbuff);
         packet_set_origin(pkt, PACKET_ORIGIN_MARSIO);
+        packet_set_action(pkt, PACKET_ACTION_FORWARD);
         nr_parsed++;
 
         if (marsio_buff_is_ctrlbuf(mbuff))
diff --git a/src/session/session.cpp b/src/session/session.cpp
index 374890b..ff7bb55 100644
--- a/src/session/session.cpp
+++ b/src/session/session.cpp
@@ -50,12 +50,12 @@ const struct tuple6 *session_get_tuple(const struct session *sess)
     return &sess->tuple;
 }
 
-void session_set_tuple_direction(struct session *sess, enum session_direction dir)
+void session_set_tuple_direction(struct session *sess, enum flow_direction dir)
 {
     sess->tuple_dir = dir;
 }
 
-enum session_direction session_get_tuple_direction(const struct session *sess)
+enum flow_direction session_get_tuple_direction(const struct session *sess)
 {
     return sess->tuple_dir;
 }
@@ -65,14 +65,24 @@ const char *session_get_tuple_str(const struct session *sess)
     return sess->tuple_str;
 }
 
-void session_set_current_direction(struct session *sess, enum session_direction dir)
+void session_set_direction(struct session *sess, enum session_direction dir)
 {
-    sess->cur_dir = dir;
+    sess->sess_dir = dir;
 }
 
-enum session_direction session_get_current_direction(const struct session *sess)
+enum session_direction session_get_direction(const struct session *sess)
 {
-    return sess->cur_dir;
+    return sess->sess_dir;
+}
+
+void session_set_flow_direction(struct session *sess, enum flow_direction dir)
+{
+    sess->flow_dir = dir;
+}
+
+enum flow_direction session_get_flow_direction(const struct session *sess)
+{
+    return sess->flow_dir;
 }
 
 void session_set_state(struct session *sess, enum session_state state)
@@ -115,12 +125,12 @@ enum closing_reason session_get_closing_reason(const struct session *sess)
     return sess->reason;
 }
 
-void session_inc_stat(struct session *sess, enum session_direction dir, enum session_stat stat, uint64_t val)
+void session_inc_stat(struct session *sess, enum flow_direction dir, enum session_stat stat, uint64_t val)
 {
     sess->stats[dir][stat] += val;
 }
 
-uint64_t session_get_stat(const struct session *sess, enum session_direction dir, enum session_stat stat)
+uint64_t session_get_stat(const struct session *sess, enum flow_direction dir, enum session_stat stat)
 {
     return sess->stats[dir][stat];
 }
@@ -135,42 +145,42 @@ uint64_t session_get_timestamp(const struct session *sess, enum session_timestam
     return sess->timestamps[type];
 }
 
-void session_clear_sid_list(struct session *sess, enum session_direction dir)
+void session_clear_sid_list(struct session *sess, enum flow_direction dir)
 {
     memset(&sess->sids[dir], 0, sizeof(struct sid_list));
 }
 
-void session_set_sid_list(struct session *sess, enum session_direction dir, const struct sid_list *list)
+void session_set_sid_list(struct session *sess, enum flow_direction dir, const struct sid_list *list)
 {
     sess->sids[dir] = *list;
 }
 
-void session_get_sid_list(const struct session *sess, enum session_direction dir, struct sid_list *list)
+void session_get_sid_list(const struct session *sess, enum flow_direction dir, struct sid_list *list)
 {
     *list = sess->sids[dir];
 }
 
-void session_clear_route_ctx(struct session *sess, enum session_direction dir)
+void session_clear_route_ctx(struct session *sess, enum flow_direction dir)
 {
     memset(&sess->route_ctx[dir], 0, sizeof(struct route_ctx));
 }
 
-void session_set_route_ctx(struct session *sess, enum session_direction dir, const struct route_ctx *ctx)
+void session_set_route_ctx(struct session *sess, enum flow_direction dir, const struct route_ctx *ctx)
 {
     sess->route_ctx[dir] = *ctx;
 }
 
-void session_get_route_ctx(const struct session *sess, enum session_direction dir, struct route_ctx *ctx)
+void session_get_route_ctx(const struct session *sess, enum flow_direction dir, struct route_ctx *ctx)
 {
     *ctx = sess->route_ctx[dir];
 }
 
-void session_set_1st_packet(struct session *sess, enum session_direction dir, const struct packet *pkt)
+void session_set_first_packet(struct session *sess, enum flow_direction dir, const struct packet *pkt)
 {
     sess->first_pkt[dir] = packet_dup(pkt);
 }
 
-const struct packet *session_get_1st_packet(const struct session *sess, enum session_direction dir)
+const struct packet *session_get_first_packet(const struct session *sess, enum flow_direction dir)
 {
     return sess->first_pkt[dir];
 }
@@ -197,7 +207,7 @@ void *session_get_user_data(const struct session *sess)
 
 struct tcp_segment *session_get_tcp_segment(struct session *sess)
 {
-    enum session_direction dir = session_get_current_direction(sess);
+    enum flow_direction dir = session_get_flow_direction(sess);
     struct tcp_half *half = &sess->tcp_halfs[dir];
 
     if (half->in_order.data != NULL && half->in_order.len > 0)
@@ -225,7 +235,7 @@ void session_free_tcp_segment(struct session *sess, struct tcp_segment *seg)
         return;
     }
 
-    enum session_direction dir = session_get_current_direction(sess);
+    enum flow_direction dir = session_get_flow_direction(sess);
     struct tcp_half *half = &sess->tcp_halfs[dir];
 
     if (seg == &half->in_order)
@@ -405,13 +415,13 @@ const char *session_type_to_str(enum session_type type)
     }
 }
 
-const char *session_direction_to_str(enum session_direction dir)
+const char *flow_direction_to_str(enum flow_direction dir)
 {
     switch (dir)
     {
-    case SESSION_DIRECTION_C2S:
+    case FLOW_DIRECTION_C2S:
         return "C2S";
-    case SESSION_DIRECTION_S2C:
+    case FLOW_DIRECTION_S2C:
         return "S2C";
     default:
         return "unknown";
@@ -458,7 +468,7 @@ int session_to_json(struct session *sess, char *buff, int size)
     used += snprintf(buff + used, size - used, "\"current_packet\":\"%p\",", session_get_current_packet(sess));
 
     const char *str[] = {"c2s", "s2c"};
-    enum session_direction dir[] = {SESSION_DIRECTION_C2S, SESSION_DIRECTION_S2C};
+    enum flow_direction dir[] = {FLOW_DIRECTION_C2S, FLOW_DIRECTION_S2C};
     for (int i = 0; i < 2; i++)
     {
         if (session_get_type(sess) == SESSION_TYPE_TCP)
@@ -486,7 +496,7 @@ int session_to_json(struct session *sess, char *buff, int size)
             used += snprintf(buff + used, size - used, "\"%s_tcp_plds_released\":%" PRIu64 ",", str[i], session_get_stat(sess, dir[i], STAT_TCP_PLDS_RELEASED));
         }
 
-        used += snprintf(buff + used, size - used, "\"%s_1st_pkt\":\"%p\",", str[i], session_get_1st_packet(sess, dir[i]));
+        used += snprintf(buff + used, size - used, "\"%s_1st_pkt\":\"%p\",", str[i], session_get_first_packet(sess, dir[i]));
         used += snprintf(buff + used, size - used, "\"%s_raw_pkts_rx\":%" PRIu64 ",", str[i], session_get_stat(sess, dir[i], STAT_RAW_PKTS_RX));
         used += snprintf(buff + used, size - used, "\"%s_raw_bytes_rx\":%" PRIu64 ",", str[i], session_get_stat(sess, dir[i], STAT_RAW_BYTES_RX));
         used += snprintf(buff + used, size - used, "\"%s_raw_pkts_tx\":%" PRIu64 ",", str[i], session_get_stat(sess, dir[i], STAT_RAW_PKTS_TX));
diff --git a/src/session/session_manager.cpp b/src/session/session_manager.cpp
index b4763cf..8e5a6ef 100644
--- a/src/session/session_manager.cpp
+++ b/src/session/session_manager.cpp
@@ -227,15 +227,15 @@ static int check_options(const struct session_manager_options *opts)
 
 static void tcp_clean(struct session_manager *mgr, struct session *sess)
 {
-     struct tcp_reassembly *c2s_ssembler = sess->tcp_halfs[SESSION_DIRECTION_C2S].assembler;
-     struct tcp_reassembly *s2c_ssembler = sess->tcp_halfs[SESSION_DIRECTION_S2C].assembler;
+     struct tcp_reassembly *c2s_ssembler = sess->tcp_halfs[FLOW_DIRECTION_C2S].assembler;
+     struct tcp_reassembly *s2c_ssembler = sess->tcp_halfs[FLOW_DIRECTION_S2C].assembler;
      struct tcp_segment *seg;
      if (c2s_ssembler)
      {
           while ((seg = tcp_reassembly_expire(c2s_ssembler, UINT64_MAX)))
           {
-               session_inc_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_RELEASED, 1);
-               session_inc_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_RELEASED, seg->len);
+               session_inc_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_RELEASED, 1);
+               session_inc_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_RELEASED, seg->len);
                mgr->stat.nr_tcp_seg_released++;
                tcp_segment_free(seg);
           }
@@ -245,8 +245,8 @@ static void tcp_clean(struct session_manager *mgr, struct session *sess)
      {
           while ((seg = tcp_reassembly_expire(s2c_ssembler, UINT64_MAX)))
           {
-               session_inc_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_RELEASED, 1);
-               session_inc_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_RELEASED, seg->len);
+               session_inc_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_RELEASED, 1);
+               session_inc_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_RELEASED, seg->len);
                mgr->stat.nr_tcp_seg_released++;
                tcp_segment_free(seg);
           }
@@ -261,9 +261,9 @@ static int tcp_init(struct session_manager *mgr, struct session *sess)
           return 0;
      }
 
-     sess->tcp_halfs[SESSION_DIRECTION_C2S].assembler = tcp_reassembly_new(mgr->opts.tcp_reassembly_max_timeout, mgr->opts.tcp_reassembly_max_segments);
-     sess->tcp_halfs[SESSION_DIRECTION_S2C].assembler = tcp_reassembly_new(mgr->opts.tcp_reassembly_max_timeout, mgr->opts.tcp_reassembly_max_segments);
-     if (sess->tcp_halfs[SESSION_DIRECTION_C2S].assembler == NULL || sess->tcp_halfs[SESSION_DIRECTION_S2C].assembler == NULL)
+     sess->tcp_halfs[FLOW_DIRECTION_C2S].assembler = tcp_reassembly_new(mgr->opts.tcp_reassembly_max_timeout, mgr->opts.tcp_reassembly_max_segments);
+     sess->tcp_halfs[FLOW_DIRECTION_S2C].assembler = tcp_reassembly_new(mgr->opts.tcp_reassembly_max_timeout, mgr->opts.tcp_reassembly_max_segments);
+     if (sess->tcp_halfs[FLOW_DIRECTION_C2S].assembler == NULL || sess->tcp_halfs[FLOW_DIRECTION_S2C].assembler == NULL)
      {
           tcp_clean(mgr, sess);
           return -1;
@@ -271,13 +271,13 @@ static int tcp_init(struct session_manager *mgr, struct session *sess)
 
      SESSION_LOG_DEBUG("session %lu %s new c2s tcp assembler %p, s2c tcp assembler %p",
                        session_get_id(sess), session_get_tuple_str(sess),
-                       sess->tcp_halfs[SESSION_DIRECTION_C2S].assembler,
-                       sess->tcp_halfs[SESSION_DIRECTION_S2C].assembler);
+                       sess->tcp_halfs[FLOW_DIRECTION_C2S].assembler,
+                       sess->tcp_halfs[FLOW_DIRECTION_S2C].assembler);
 
      return 0;
 }
 
-static void tcp_update(struct session_manager *mgr, struct session *sess, enum session_direction dir, const struct packet_layer *tcp_layer, uint64_t now)
+static void tcp_update(struct session_manager *mgr, struct session *sess, enum flow_direction dir, const struct packet_layer *tcp_layer, uint64_t now)
 {
      struct tcp_segment *seg;
      struct tcphdr *hdr = (struct tcphdr *)tcp_layer->hdr_ptr;
@@ -400,25 +400,25 @@ static void tcp_update(struct session_manager *mgr, struct session *sess, enum s
  * Session Direction
  ******************************************************************************/
 
-static enum session_direction identify_direction_by_port(uint16_t src_port, uint16_t dst_port)
+static enum flow_direction identify_direction_by_port(uint16_t src_port, uint16_t dst_port)
 {
      // big port is client
      if (src_port > dst_port)
      {
-          return SESSION_DIRECTION_C2S;
+          return FLOW_DIRECTION_C2S;
      }
      else if (src_port < dst_port)
      {
-          return SESSION_DIRECTION_S2C;
+          return FLOW_DIRECTION_S2C;
      }
      else
      {
           // if port is equal, first packet is C2S
-          return SESSION_DIRECTION_C2S;
+          return FLOW_DIRECTION_C2S;
      }
 }
 
-static enum session_direction identify_direction_by_history(const struct session *sess, const struct tuple6 *key)
+static enum flow_direction identify_direction_by_history(const struct session *sess, const struct tuple6 *key)
 {
      if (tuple6_cmp(session_get_tuple(sess), key) == 0)
      {
@@ -426,7 +426,7 @@ static enum session_direction identify_direction_by_history(const struct session
      }
      else
      {
-          return (session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S ? SESSION_DIRECTION_S2C : SESSION_DIRECTION_C2S);
+          return (session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S ? FLOW_DIRECTION_S2C : FLOW_DIRECTION_C2S);
      }
 }
 
@@ -471,7 +471,7 @@ static int duplicated_packet_bypass(struct session_manager *mgr, struct session
           return 0;
      }
 
-     enum session_direction dir = identify_direction_by_history(sess, key);
+     enum flow_direction dir = identify_direction_by_history(sess, key);
      if (session_get_stat(sess, dir, STAT_RAW_PKTS_RX) < 3 || session_has_dup_traffic(sess))
      {
           if (duplicated_packet_filter_lookup(mgr->dup_pkt_filter, pkt, now))
@@ -507,7 +507,7 @@ static int duplicated_packet_bypass(struct session_manager *mgr, struct session
  * Session Manager
  ******************************************************************************/
 
-static void session_update(struct session *sess, enum session_state next_state, const struct packet *pkt, const struct tuple6 *key, enum session_direction dir)
+static void session_update(struct session *sess, enum session_state next_state, const struct packet *pkt, const struct tuple6 *key, enum flow_direction dir)
 {
      struct timespec real;
      clock_gettime(CLOCK_REALTIME, &real); // must be realtime
@@ -517,6 +517,32 @@ static void session_update(struct session *sess, enum session_state next_state,
           session_set_id(sess, id_generator_alloc());
           session_set_tuple(sess, key);
           session_set_tuple_direction(sess, dir);
+
+          enum packet_direction pkt_dir = packet_get_direction(pkt);
+
+          if (dir == FLOW_DIRECTION_C2S)
+          {
+               if (pkt_dir == PACKET_DIRECTION_OUTGOING) // Internal -> External
+               {
+                    session_set_direction(sess, SESSION_DIRECTION_OUTBOUND);
+               }
+               else
+               {
+                    session_set_direction(sess, SESSION_DIRECTION_INBOUND);
+               }
+          }
+          else
+          {
+               if (pkt_dir == PACKET_DIRECTION_OUTGOING) // Internal -> External
+               {
+                    session_set_direction(sess, SESSION_DIRECTION_INBOUND);
+               }
+               else
+               {
+                    session_set_direction(sess, SESSION_DIRECTION_OUTBOUND);
+               }
+          }
+
           tuple6_to_str(key, sess->tuple_str, sizeof(sess->tuple_str));
           session_set_timestamp(sess, SESSION_TIMESTAMP_START, real.tv_sec);
           switch (key->ip_proto)
@@ -536,20 +562,20 @@ static void session_update(struct session *sess, enum session_state next_state,
      session_inc_stat(sess, dir, STAT_RAW_PKTS_RX, 1);
      session_inc_stat(sess, dir, STAT_RAW_BYTES_RX, packet_get_len(pkt));
 
-     if (!session_get_1st_packet(sess, dir))
+     if (!session_get_first_packet(sess, dir))
      {
           struct route_ctx ctx = {0};
           struct sid_list list = {0};
           packet_get_route_ctx(pkt, &ctx);
           packet_get_sid_list(pkt, &list);
 
-          session_set_1st_packet(sess, dir, pkt);
+          session_set_first_packet(sess, dir, pkt);
           session_set_route_ctx(sess, dir, &ctx);
           session_set_sid_list(sess, dir, &list);
      }
 
      session_set_current_packet(sess, pkt);
-     session_set_current_direction(sess, dir);
+     session_set_flow_direction(sess, dir);
      session_set_timestamp(sess, SESSION_TIMESTAMP_LAST, real.tv_sec);
      session_set_state(sess, next_state);
 }
@@ -615,7 +641,7 @@ static struct session *session_manager_new_tcp_session(struct session_manager *m
           session_manager_evicte_session(mgr, evic_sess, now);
      }
 
-     enum session_direction dir = (flags & TH_ACK) ? SESSION_DIRECTION_S2C : SESSION_DIRECTION_C2S;
+     enum flow_direction dir = (flags & TH_ACK) ? FLOW_DIRECTION_S2C : FLOW_DIRECTION_C2S;
      struct session *sess = session_pool_pop(mgr->sess_pool);
      if (sess == NULL)
      {
@@ -671,7 +697,7 @@ static struct session *session_manager_new_udp_session(struct session_manager *m
      session_init(sess);
      sess->mgr_stat = &mgr->stat;
 
-     enum session_direction dir = identify_direction_by_port(ntohs(key->src_port), ntohs(key->dst_port));
+     enum flow_direction dir = identify_direction_by_port(ntohs(key->src_port), ntohs(key->dst_port));
      enum session_state next_state = session_transition_run(SESSION_STATE_INIT, UDP_DATA);
      session_update(sess, next_state, pkt, key, dir);
      session_transition_log(sess, SESSION_STATE_INIT, next_state, UDP_DATA);
@@ -690,7 +716,7 @@ static int session_manager_update_tcp_session(struct session_manager *mgr, struc
 {
      const struct packet_layer *tcp_layer = packet_get_innermost_layer(pkt, LAYER_TYPE_TCP);
      const struct tcphdr *hdr = (const struct tcphdr *)tcp_layer->hdr_ptr;
-     enum session_direction dir = identify_direction_by_history(sess, key);
+     enum flow_direction dir = identify_direction_by_history(sess, key);
      uint8_t flags = tcp_hdr_get_flags(hdr);
      int inputs = 0;
      inputs |= (flags & TH_SYN) ? TCP_SYN : NONE;
@@ -714,17 +740,17 @@ static int session_manager_update_tcp_session(struct session_manager *mgr, struc
      {
           if (flags & TH_FIN)
           {
-               session_set_closing_reason(sess, (dir == SESSION_DIRECTION_C2S ? CLOSING_BY_CLIENT_FIN : CLOSING_BY_SERVER_FIN));
+               session_set_closing_reason(sess, (dir == FLOW_DIRECTION_C2S ? CLOSING_BY_CLIENT_FIN : CLOSING_BY_SERVER_FIN));
           }
           if (flags & TH_RST)
           {
-               session_set_closing_reason(sess, (dir == SESSION_DIRECTION_C2S ? CLOSING_BY_CLIENT_RST : CLOSING_BY_SERVER_RST));
+               session_set_closing_reason(sess, (dir == FLOW_DIRECTION_C2S ? CLOSING_BY_CLIENT_RST : CLOSING_BY_SERVER_RST));
           }
      }
 
      // update timeout
      struct tcp_half *curr = &sess->tcp_halfs[dir];
-     struct tcp_half *peer = &sess->tcp_halfs[(dir == SESSION_DIRECTION_C2S ? SESSION_DIRECTION_S2C : SESSION_DIRECTION_C2S)];
+     struct tcp_half *peer = &sess->tcp_halfs[(dir == FLOW_DIRECTION_C2S ? FLOW_DIRECTION_S2C : FLOW_DIRECTION_C2S)];
      uint64_t timeout = 0;
      switch (next_state)
      {
@@ -773,7 +799,7 @@ static int session_manager_update_tcp_session(struct session_manager *mgr, struc
 
 static int session_manager_update_udp_session(struct session_manager *mgr, struct session *sess, const struct packet *pkt, const struct tuple6 *key, uint64_t now)
 {
-     enum session_direction dir = identify_direction_by_history(sess, key);
+     enum flow_direction dir = identify_direction_by_history(sess, key);
      enum session_state curr_state = session_get_state(sess);
      enum session_state next_state = session_transition_run(curr_state, UDP_DATA);
      session_update(sess, next_state, pkt, key, dir);
@@ -951,16 +977,16 @@ void session_manager_free_session(struct session_manager *mgr, struct session *s
           }
 
           session_free_all_ex_data(sess);
-          packet_free((struct packet *)session_get_1st_packet(sess, SESSION_DIRECTION_C2S));
-          packet_free((struct packet *)session_get_1st_packet(sess, SESSION_DIRECTION_S2C));
-          session_set_1st_packet(sess, SESSION_DIRECTION_C2S, NULL);
-          session_set_1st_packet(sess, SESSION_DIRECTION_S2C, NULL);
-          session_clear_route_ctx(sess, SESSION_DIRECTION_C2S);
-          session_clear_route_ctx(sess, SESSION_DIRECTION_S2C);
-          session_clear_sid_list(sess, SESSION_DIRECTION_C2S);
-          session_clear_sid_list(sess, SESSION_DIRECTION_S2C);
+          packet_free((struct packet *)session_get_first_packet(sess, FLOW_DIRECTION_C2S));
+          packet_free((struct packet *)session_get_first_packet(sess, FLOW_DIRECTION_S2C));
+          session_set_first_packet(sess, FLOW_DIRECTION_C2S, NULL);
+          session_set_first_packet(sess, FLOW_DIRECTION_S2C, NULL);
+          session_clear_route_ctx(sess, FLOW_DIRECTION_C2S);
+          session_clear_route_ctx(sess, FLOW_DIRECTION_S2C);
+          session_clear_sid_list(sess, FLOW_DIRECTION_C2S);
+          session_clear_sid_list(sess, FLOW_DIRECTION_S2C);
           session_set_current_packet(sess, NULL);
-          session_set_current_direction(sess, SESSION_DIRECTION_NONE);
+          session_set_flow_direction(sess, FLOW_DIRECTION_NONE);
           session_pool_push(mgr->sess_pool, sess);
           sess = NULL;
      }
diff --git a/src/session/session_priv.h b/src/session/session_priv.h
index 3675270..20aaa29 100644
--- a/src/session/session_priv.h
+++ b/src/session/session_priv.h
@@ -43,9 +43,9 @@ struct tcp_half
 struct session
 {
     uint64_t id;
-    uint64_t stats[MAX_DIRECTION][MAX_STAT];
+    uint64_t stats[MAX_FLOW_DIRECTION][MAX_STAT];
     uint64_t timestamps[MAX_TIMESTAMP];
-    struct tcp_half tcp_halfs[MAX_DIRECTION];
+    struct tcp_half tcp_halfs[MAX_FLOW_DIRECTION];
     struct timeout timeout;
     struct list_head lru;
     struct list_head free;
@@ -55,16 +55,17 @@ struct session
     UT_hash_handle hh3;
     struct tuple6 tuple;
     char tuple_str[TUPLE6_STR_SIZE];
-    struct sid_list sids[MAX_DIRECTION];
-    struct route_ctx route_ctx[MAX_DIRECTION];
-    const struct packet *first_pkt[MAX_DIRECTION];
+    struct sid_list sids[MAX_FLOW_DIRECTION];
+    struct route_ctx route_ctx[MAX_FLOW_DIRECTION];
+    const struct packet *first_pkt[MAX_FLOW_DIRECTION];
     const struct packet *curr_pkt;
     void *ex_data[EX_DATA_MAX_COUNT];
     void *user_data;
     int is_symmetric;
     int dup;
-    enum session_direction tuple_dir;
-    enum session_direction cur_dir;
+    enum session_direction sess_dir;
+    enum flow_direction tuple_dir;
+    enum flow_direction flow_dir;
     enum session_type type;
     enum session_state state;
     enum closing_reason reason;
@@ -73,28 +74,37 @@ struct session
 
 void session_init(struct session *sess);
 void session_set_id(struct session *sess, uint64_t id);
+
 void session_set_tuple(struct session *sess, const struct tuple6 *key);
 const struct tuple6 *session_get_tuple(const struct session *sess);
-void session_set_tuple_direction(struct session *sess, enum session_direction dir);
-enum session_direction session_get_tuple_direction(const struct session *sess);
-void session_set_current_direction(struct session *sess, enum session_direction dir);
+
+void session_set_tuple_direction(struct session *sess, enum flow_direction dir);
+enum flow_direction session_get_tuple_direction(const struct session *sess);
+
+void session_set_direction(struct session *sess, enum session_direction dir);
+void session_set_flow_direction(struct session *sess, enum flow_direction dir);
 void session_set_state(struct session *sess, enum session_state state);
 void session_set_type(struct session *sess, enum session_type type);
 void session_set_dup_traffic(struct session *sess);
 void session_set_closing_reason(struct session *sess, enum closing_reason reason);
-void session_inc_stat(struct session *sess, enum session_direction dir, enum session_stat stat, uint64_t val);
+void session_inc_stat(struct session *sess, enum flow_direction dir, enum session_stat stat, uint64_t val);
 void session_set_timestamp(struct session *sess, enum session_timestamp type, uint64_t value);
-void session_clear_sid_list(struct session *sess, enum session_direction dir);
-void session_set_sid_list(struct session *sess, enum session_direction dir, const struct sid_list *list);
-void session_get_sid_list(const struct session *sess, enum session_direction dir, struct sid_list *list);
-void session_clear_route_ctx(struct session *sess, enum session_direction dir);
-void session_set_route_ctx(struct session *sess, enum session_direction dir, const struct route_ctx *ctx);
-void session_get_route_ctx(const struct session *sess, enum session_direction dir, struct route_ctx *ctx);
-void session_set_1st_packet(struct session *sess, enum session_direction dir, const struct packet *pkt);
+
+void session_clear_sid_list(struct session *sess, enum flow_direction dir);
+void session_set_sid_list(struct session *sess, enum flow_direction dir, const struct sid_list *list);
+void session_get_sid_list(const struct session *sess, enum flow_direction dir, struct sid_list *list);
+
+void session_clear_route_ctx(struct session *sess, enum flow_direction dir);
+void session_set_route_ctx(struct session *sess, enum flow_direction dir, const struct route_ctx *ctx);
+void session_get_route_ctx(const struct session *sess, enum flow_direction dir, struct route_ctx *ctx);
+
+void session_set_first_packet(struct session *sess, enum flow_direction dir, const struct packet *pkt);
 void session_set_current_packet(struct session *sess, const struct packet *pkt);
 const struct packet *session_get_current_packet(const struct session *sess);
+
 void session_set_user_data(struct session *sess, void *user_data);
 void *session_get_user_data(const struct session *sess);
+
 struct tcp_segment *session_get_tcp_segment(struct session *sess);
 void session_free_tcp_segment(struct session *sess, struct tcp_segment *seg);
 
@@ -133,6 +143,10 @@ void session_free_all_ex_data(struct session *sess);
  * debug
  ******************************************************************************/
 
+const char *session_type_to_str(enum session_type type);
+const char *session_state_to_str(enum session_state state);
+const char *flow_direction_to_str(enum flow_direction dir);
+const char *closing_reason_to_str(enum closing_reason reason);
 void session_print(struct session *sess);
 int session_to_json(struct session *sess, char *buff, int size);
 
diff --git a/src/session/test/gtest_case_tcp_fast_open.cpp b/src/session/test/gtest_case_tcp_fast_open.cpp
index 1a5362e..4424f6e 100644
--- a/src/session/test/gtest_case_tcp_fast_open.cpp
+++ b/src/session/test/gtest_case_tcp_fast_open.cpp
@@ -319,60 +319,60 @@ TEST(CASE, TCP_FAST_OPEN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "2400:ac40:620:a4d8:484f:d2b0:d539:bd4c:51682 -> 2001:4860:4860::8844:853, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 280);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 280);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
 
     // TCP Segment
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_RX) == 166);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_EXPIRED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_EXPIRED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_RETRANSMIT) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_RETRANSMIT) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_OVERLAP) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_OVERLAP) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_NOSPACE) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_NOSPACE) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_INORDER) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_INORDER) == 166);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_REORDERED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_REORDERED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_BUFFERED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_BUFFERED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_RELEASED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_PLDS_RELEASED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_RX) == 166);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_EXPIRED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_EXPIRED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_RETRANSMIT) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_RETRANSMIT) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_OVERLAP) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_OVERLAP) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_NOSPACE) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_NOSPACE) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_INORDER) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_INORDER) == 166);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_REORDERED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_REORDERED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_BUFFERED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_BUFFERED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_RELEASED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_PLDS_RELEASED) == 0);
 
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_EXPIRED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_EXPIRED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_RETRANSMIT) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_RETRANSMIT) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_OVERLAP) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_OVERLAP) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_NOSPACE) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_NOSPACE) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_INORDER) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_INORDER) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_REORDERED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_REORDERED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_BUFFERED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_BUFFERED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_RELEASED) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_PLDS_RELEASED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_EXPIRED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_EXPIRED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_RETRANSMIT) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_RETRANSMIT) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_OVERLAP) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_OVERLAP) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_NOSPACE) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_NOSPACE) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_INORDER) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_INORDER) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_REORDERED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_REORDERED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_BUFFERED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_BUFFERED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_RELEASED) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_PLDS_RELEASED) == 0);
 
     session_print(sess);
 
diff --git a/src/session/test/gtest_state_tcp_active_to_closing.cpp b/src/session/test/gtest_state_tcp_active_to_closing.cpp
index b66d7af..5766d3b 100644
--- a/src/session/test/gtest_state_tcp_active_to_closing.cpp
+++ b/src/session/test/gtest_state_tcp_active_to_closing.cpp
@@ -117,21 +117,21 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_FIN_FIN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
@@ -203,21 +203,21 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_C2S_RST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_RST);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
     session_print(sess);
 
     // check stat
@@ -289,21 +289,21 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_S2C_RST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_SERVER_RST);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
@@ -415,21 +415,21 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_C2S_HALF_CLOSED_TIMEOUT)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
     session_print(sess);
 
     // check stat
@@ -494,21 +494,21 @@ TEST(TCP_ACTIVE_TO_CLOSING, BY_S2C_HALF_CLOSED_TIMEOUT)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_SERVER_FIN);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
diff --git a/src/session/test/gtest_state_tcp_init_to_opening.cpp b/src/session/test/gtest_state_tcp_init_to_opening.cpp
index e352912..39a891f 100644
--- a/src/session/test/gtest_state_tcp_init_to_opening.cpp
+++ b/src/session/test/gtest_state_tcp_init_to_opening.cpp
@@ -76,21 +76,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
     session_print(sess);
 
     // check stat
@@ -153,21 +153,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYNACK)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_S2C);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) == NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) == NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
@@ -241,21 +241,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN_SYNACK)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
@@ -340,21 +340,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN_SYNACK_ACK)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
@@ -435,21 +435,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYN_RETRANSMISSION)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 78);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 78);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
     session_print(sess);
 
     // check stat
@@ -531,21 +531,21 @@ TEST(TCP_INIT_TO_OPENING, BY_SYNACK_RETRANSMISSION)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_S2C);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) == NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) == NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
@@ -619,21 +619,21 @@ TEST(TCP_INIT_TO_OPENING, BY_C2S_ASMMETRIC)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
     session_print(sess);
 
     // check stat
@@ -707,21 +707,21 @@ TEST(TCP_INIT_TO_OPENING, BY_S2C_ASMMETRIC)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_S2C);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) == NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) == NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
diff --git a/src/session/test/gtest_state_tcp_init_to_opening_to_active_to_closing_to_closed.cpp b/src/session/test/gtest_state_tcp_init_to_opening_to_active_to_closing_to_closed.cpp
index b65b582..c18f6f0 100644
--- a/src/session/test/gtest_state_tcp_init_to_opening_to_active_to_closing_to_closed.cpp
+++ b/src/session/test/gtest_state_tcp_init_to_opening_to_active_to_closing_to_closed.cpp
@@ -72,21 +72,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
 
     // S2C SYNACK Packet
     printf("\n=> Packet Parse: TCP S2C SYNACK packet\n");
@@ -103,21 +103,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
 
     // C2S ACK Packet
     printf("\n=> Packet Parse: TCP C2S ACK packet\n");
@@ -134,21 +134,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
 
     // C2S REQ Packet
     printf("\n=> Packet Parse: TCP C2S REQ packet\n");
@@ -165,21 +165,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
 
     // S2C ACK Packet
     printf("\n=> Packet Parse: TCP S2C ACK packet\n");
@@ -196,21 +196,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
 
     // S2C HTTP Resp Packet1
     printf("\n=> Packet Parse: TCP S2C Resp packet1\n");
@@ -227,21 +227,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
 
     // S2C HTTP Resp Packet2
     printf("\n=> Packet Parse: TCP S2C Resp packet2\n");
@@ -258,21 +258,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
 
     // C2S ACK Packet
     printf("\n=> Packet Parse: TCP C2S ACK packet\n");
@@ -289,21 +289,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
 
     // C2S FIN Packet
     printf("\n=> Packet Parse: TCP C2S FIN packet\n");
@@ -320,21 +320,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
 
     // S2C FIN Packet
     printf("\n=> Packet Parse: TCP S2C FIN packet\n");
@@ -351,21 +351,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
 
     // C2S ACK Packet
     printf("\n=> Packet Parse: TCP C2S ACK packet\n");
@@ -382,21 +382,21 @@ TEST(TCP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING_TO_CLOSED, TEST)
     memset(buffer, 0, sizeof(buffer));
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66 + 145 + 66 + 66 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 66 + 1354 + 385 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1 + 1 + 1 + 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
 
     // check stat
     stat = session_manager_stat(mgr);
diff --git a/src/session/test/gtest_state_tcp_opening_to_active.cpp b/src/session/test/gtest_state_tcp_opening_to_active.cpp
index 32d2fb8..06b310b 100644
--- a/src/session/test/gtest_state_tcp_opening_to_active.cpp
+++ b/src/session/test/gtest_state_tcp_opening_to_active.cpp
@@ -86,21 +86,21 @@ TEST(TCP_OPENING_TO_ACTIVE, BY_SYN_C2S_DATA)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 145);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
     session_print(sess);
 
     // check stat
@@ -174,21 +174,21 @@ TEST(TCP_OPENING_TO_ACTIVE, BY_SYNACK_S2C_DATA)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "93.184.216.34:80 -> 192.168.38.105:60111, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_S2C);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 1354);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74 + 1354);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1 + 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) == NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) == NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
diff --git a/src/session/test/gtest_state_tcp_opening_to_closing.cpp b/src/session/test/gtest_state_tcp_opening_to_closing.cpp
index cd80c3a..ffa47f7 100644
--- a/src/session/test/gtest_state_tcp_opening_to_closing.cpp
+++ b/src/session/test/gtest_state_tcp_opening_to_closing.cpp
@@ -98,21 +98,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_FIN_FIN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
@@ -192,21 +192,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_C2S_RST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_RST);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
     session_print(sess);
 
     // check stat
@@ -286,21 +286,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_S2C_RST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_SERVER_RST);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
@@ -429,21 +429,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_HANDSHAKE_TIMEOUT)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
@@ -528,21 +528,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_DATA_TIMEOUT)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
@@ -616,21 +616,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_C2S_HALF_FIN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_CLIENT_FIN);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78 + 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 + 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
     session_print(sess);
 
     // check stat
@@ -703,21 +703,21 @@ TEST(TCP_OPENING_TO_CLOSING, BY_S2C_HALF_FIN)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:60111 -> 93.184.216.34:80, proto: 6, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_CLOSING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_TCP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == CLOSING_BY_SERVER_FIN);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 78);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 66);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
diff --git a/src/session/test/gtest_state_udp_init_to_opening_to_active_to_closing.cpp b/src/session/test/gtest_state_udp_init_to_opening_to_active_to_closing.cpp
index 83a01aa..1e000d5 100644
--- a/src/session/test/gtest_state_udp_init_to_opening_to_active_to_closing.cpp
+++ b/src/session/test/gtest_state_udp_init_to_opening_to_active_to_closing.cpp
@@ -71,21 +71,21 @@ TEST(UDP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING, TEST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:61099 -> 121.14.154.93:53, proto: 17, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
 
     // S2C RESP Packet
     printf("\n=> Packet Parse: UDP S2C RESP packet\n");
@@ -101,21 +101,21 @@ TEST(UDP_INIT_TO_OPENING_TO_ACTIVE_TO_CLOSING, TEST)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:61099 -> 121.14.154.93:53, proto: 17, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_ACTIVE);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 550);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 550);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
diff --git a/src/session/test/gtest_state_udp_init_to_opening_to_closing.cpp b/src/session/test/gtest_state_udp_init_to_opening_to_closing.cpp
index 6cdebfc..58a9523 100644
--- a/src/session/test/gtest_state_udp_init_to_opening_to_closing.cpp
+++ b/src/session/test/gtest_state_udp_init_to_opening_to_closing.cpp
@@ -76,21 +76,21 @@ TEST(UDP_INIT_TO_OPENING_TO_CLOSING, BY_C2S)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "192.168.38.105:61099 -> 121.14.154.93:53, proto: 17, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_C2S);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 74);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_C2S);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) != NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) == NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_C2S);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) != NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) == NULL);
     session_print(sess);
 
     // check stat
@@ -154,21 +154,21 @@ TEST(UDP_INIT_TO_OPENING_TO_CLOSING, BY_S2C)
     EXPECT_TRUE(session_get_id(sess) != 0);
     tuple6_to_str(session_get_tuple(sess), buffer, sizeof(buffer));
     EXPECT_STREQ(buffer, "121.14.154.93:53 -> 192.168.38.105:61099, proto: 17, domain: 0");
-    EXPECT_TRUE(session_get_tuple_direction(sess) == SESSION_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_tuple_direction(sess) == FLOW_DIRECTION_S2C);
     EXPECT_TRUE(session_get_state(sess) == SESSION_STATE_OPENING);
     EXPECT_TRUE(session_get_type(sess) == SESSION_TYPE_UDP);
     EXPECT_TRUE(session_has_dup_traffic(sess) == 0);
     EXPECT_TRUE(session_get_closing_reason(sess) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 550);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
-    EXPECT_TRUE(session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_BYTES_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_BYTES_RX) == 550);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 0);
+    EXPECT_TRUE(session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1);
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_START));
     EXPECT_TRUE(session_get_timestamp(sess, SESSION_TIMESTAMP_LAST));
     EXPECT_TRUE(session_get_current_packet(sess) == &pkt);
-    EXPECT_TRUE(session_get_current_direction(sess) == SESSION_DIRECTION_S2C);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_C2S) == NULL);
-    EXPECT_TRUE(session_get_1st_packet(sess, SESSION_DIRECTION_S2C) != NULL);
+    EXPECT_TRUE(session_get_flow_direction(sess) == FLOW_DIRECTION_S2C);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_C2S) == NULL);
+    EXPECT_TRUE(session_get_first_packet(sess, FLOW_DIRECTION_S2C) != NULL);
     session_print(sess);
 
     // check stat
diff --git a/src/stellar/inject.cpp b/src/stellar/inject.cpp
index e81a8e1..88696d3 100644
--- a/src/stellar/inject.cpp
+++ b/src/stellar/inject.cpp
@@ -155,7 +155,7 @@ static void update_ip6_hdr(struct ip6_hdr *ip6hdr, int trim)
     ipv6_hdr_set_payload_len(ip6hdr, len - trim);
 }
 
-static inline void calc_tcp_seq_and_ack(const struct session *sess, enum session_direction inj_dir, uint32_t *seq, uint32_t *ack)
+static inline void calc_tcp_seq_and_ack(const struct session *sess, enum flow_direction inject_dir, uint32_t *seq, uint32_t *ack)
 {
     /*
      * +--------+  current packet  +---------+     C2S RST      +--------+
@@ -175,9 +175,9 @@ static inline void calc_tcp_seq_and_ack(const struct session *sess, enum session
      *      ack = current_packet_seq + current_packet_payload_len
      */
 
-    enum session_direction curr_dir = session_get_current_direction(sess);
+    enum flow_direction curr_dir = session_get_flow_direction(sess);
     const struct tcp_half *tcp_curr_half = &sess->tcp_halfs[curr_dir];
-    if (inj_dir == curr_dir)
+    if (inject_dir == curr_dir)
     {
         *seq = tcp_curr_half->seq;
         *ack = tcp_curr_half->ack;
@@ -213,8 +213,8 @@ struct fingerprint
 };
 
 // return packet length
-int build_tcp_packet(const struct packet *first, const struct fingerprint *finger,
-                     uint32_t tcp_seq, uint32_t tcp_ack, uint8_t tcp_flags, char *tcp_pld, int pld_len, char *pkt_buff, int buff_size)
+static int build_tcp_packet(const struct packet *first, const struct fingerprint *finger,
+                            uint32_t tcp_seq, uint32_t tcp_ack, uint8_t tcp_flags, char *tcp_pld, int pld_len, char *pkt_buff, int buff_size)
 {
     int trim = 0;
     struct tcphdr *tcphdr;
@@ -224,7 +224,7 @@ int build_tcp_packet(const struct packet *first, const struct fingerprint *finge
     struct packet_layer *curr;
     struct packet_layer *last;
     int len = packet_get_len(first);
-    int8_t layers = packet_get_layers(first);
+    int8_t layers = packet_get_layers_number(first);
 
     if ((tcp_pld == NULL && pld_len > 0) || (tcp_pld != NULL && pld_len <= 0))
     {
@@ -302,50 +302,44 @@ int build_tcp_packet(const struct packet *first, const struct fingerprint *finge
 }
 
 // return 0: success, -1: failed
-
-int stellar_inject_icmp_unreach(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx)
+int stellar_inject_tcp_flags(const struct session *sess, enum flow_direction inject_dir, uint8_t flags)
 {
-    // TODO
-    return -1;
-}
+    uint16_t thr_idx = stellar_get_current_thread_index();
 
-int stellar_inject_tcp_rst(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx)
-{
     if (session_get_type(sess) != SESSION_TYPE_TCP)
     {
-        session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
+        session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_PKTS_FAIL, 1);
         INJECT_PACKET_LOG_ERROR("session %ld is not a TCP session, cannot inject TCP RST", session_get_id(sess));
         return -1;
     }
 
-    const struct packet *pkt = session_get_1st_packet(sess, inj_dir);
+    const struct packet *pkt = session_get_first_packet(sess, inject_dir);
     if (pkt == NULL)
     {
-        session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
-        INJECT_PACKET_LOG_ERROR("session %ld has no %s first packet, cannot inject TCP RST", session_get_id(sess), session_direction_to_str(inj_dir));
+        session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_PKTS_FAIL, 1);
+        INJECT_PACKET_LOG_ERROR("session %ld has no %s first packet, cannot inject TCP RST", session_get_id(sess), flow_direction_to_str(inject_dir));
         return -1;
     }
 
     struct fingerprint finger = {0};
     uint32_t tcp_seq = 0;
     uint32_t tcp_ack = 0;
-    uint8_t tcp_flags = TH_RST | TH_ACK;
     char buff[4096] = {0};
-    calc_tcp_seq_and_ack(sess, inj_dir, &tcp_seq, &tcp_ack);
+    calc_tcp_seq_and_ack(sess, inject_dir, &tcp_seq, &tcp_ack);
     calc_ipid_ttl_win(&finger.ipid, &finger.ttl, &finger.win);
 
-    int len = build_tcp_packet(pkt, &finger, tcp_seq, tcp_ack, tcp_flags, NULL, 0, buff, sizeof(buff));
+    int len = build_tcp_packet(pkt, &finger, tcp_seq, tcp_ack, flags, NULL, 0, buff, sizeof(buff));
     if (len <= 0)
     {
-        INJECT_PACKET_LOG_ERROR("session %ld build TCP %s RST packet failed, %s", session_get_id(sess), session_direction_to_str(inj_dir), strerror(len));
-        session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
+        INJECT_PACKET_LOG_ERROR("session %ld build TCP %s RST packet failed, %s", session_get_id(sess), flow_direction_to_str(inject_dir), strerror(len));
+        session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_PKTS_FAIL, 1);
         return -1;
     }
 
     struct inject_packet_meta meta = {0};
     meta.session_id = session_get_id(sess);
-    session_get_route_ctx(sess, inj_dir, &meta.route);
-    session_get_sid_list(sess, inj_dir, &meta.sids);
+    session_get_route_ctx(sess, inject_dir, &meta.route);
+    session_get_sid_list(sess, inject_dir, &meta.sids);
 
     struct packet inj_pkt;
     packet_parse(&inj_pkt, buff, len);
@@ -353,37 +347,25 @@ int stellar_inject_tcp_rst(const struct session *sess, enum session_direction in
     packet_set_origin_ctx(&inj_pkt, &meta);
     if (packet_io_inject(runtime->packet_io, thr_idx, &inj_pkt, 1) == 1)
     {
-        session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_SUSS, 1);
-        session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_BYTES_SUSS, len);
+        session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_PKTS_SUSS, 1);
+        session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_BYTES_SUSS, len);
         return 0;
     }
     else
     {
-        INJECT_PACKET_LOG_ERROR("session %ld inject TCP %s RST packet failed, packet I/O nospace", session_get_id(sess), session_direction_to_str(inj_dir));
-        session_inc_stat((struct session *)sess, inj_dir, STAT_INJ_PKTS_FAIL, 1);
+        INJECT_PACKET_LOG_ERROR("session %ld inject TCP %s RST packet failed, packet I/O nospace", session_get_id(sess), flow_direction_to_str(inject_dir));
+        session_inc_stat((struct session *)sess, inject_dir, STAT_INJ_PKTS_FAIL, 1);
         return -1;
     }
 }
 
-int stellar_inject_tcp_payload(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx, const char *payload, uint16_t len)
+int stellar_inject_payload(const struct session *sess, enum flow_direction inject_dir, const char *payload, uint16_t len)
 {
     // TODO
     return -1;
 }
 
-int stellar_inject_udp_payload(const struct session *sess, enum session_direction inj_dir, uint16_t thr_idx, const char *payload, uint16_t len)
-{
-    // TODO
-    return -1;
-}
-
-int stellar_inject_ctrl_msg(const struct session *sess, uint16_t *sids, int nr_sid, uint16_t thr_idx, const char *msg, uint16_t len)
-{
-    // TODO
-    return -1;
-}
-
-int stellar_inject_stateless_pkt(uint16_t link_id, uint16_t thr_idx, const char *packet, uint16_t len)
+int stellar_inject_ctrl_msg(const struct session *sess, const struct sid_list *sids, const char *msg, uint16_t len)
 {
     // TODO
     return -1;
diff --git a/src/stellar/stellar.cpp b/src/stellar/stellar.cpp
index 1fd176a..8cd8573 100644
--- a/src/stellar/stellar.cpp
+++ b/src/stellar/stellar.cpp
@@ -1,4 +1,5 @@
 #include <errno.h>
+#include <assert.h>
 #include <unistd.h>
 #include <pthread.h>
 #include <sys/prctl.h>
@@ -19,23 +20,27 @@ static void update_session_stat(struct session *sess, struct packet *pkt)
     {
         enum session_stat stat_pkt;
         enum session_stat stat_byte;
-        enum session_direction dir = session_get_current_direction(sess);
+        enum flow_direction dir = session_get_flow_direction(sess);
         int is_ctrl = packet_is_ctrl(pkt);
-        if (packet_need_drop(pkt))
+        switch (packet_get_action(pkt))
         {
+        case PACKET_ACTION_DROP:
             stat_pkt = is_ctrl ? STAT_CTRL_PKTS_DROP : STAT_RAW_PKTS_DROP;
             stat_byte = is_ctrl ? STAT_CTRL_BYTES_DROP : STAT_RAW_BYTES_DROP;
-        }
-        else
-        {
+            break;
+        case PACKET_ACTION_FORWARD:
+            break;
             stat_pkt = is_ctrl ? STAT_CTRL_PKTS_TX : STAT_RAW_PKTS_TX;
             stat_byte = is_ctrl ? STAT_CTRL_BYTES_TX : STAT_RAW_BYTES_TX;
+        default:
+            assert(0);
+            break;
         }
 
         session_inc_stat(sess, dir, stat_pkt, 1);
         session_inc_stat(sess, dir, stat_byte, packet_get_len(pkt));
         session_set_current_packet(sess, NULL);
-        session_set_current_direction(sess, SESSION_DIRECTION_NONE);
+        session_set_flow_direction(sess, FLOW_DIRECTION_NONE);
     }
 }
 
@@ -167,11 +172,15 @@ static void *work_thread(void *arg)
                     goto fast_path;
                 }
             }
+            if (packet_get_session_id(pkt) == 0)
+            {
+                packet_set_session_id(pkt, session_get_id(sess));
+            }
             plugin_manager_dispatch_session(plug_mgr, sess, pkt);
 
         fast_path:
             update_session_stat(sess, pkt);
-            if (packet_need_drop(pkt))
+            if (packet_get_action(pkt) == PACKET_ACTION_DROP)
             {
                 if (pkt == defraged_pkt)
                 {
diff --git a/src/stellar/test/gtest_inject_packet.cpp b/src/stellar/test/gtest_inject_packet.cpp
index a4f08a4..f3d28d7 100644
--- a/src/stellar/test/gtest_inject_packet.cpp
+++ b/src/stellar/test/gtest_inject_packet.cpp
@@ -5,6 +5,7 @@
 #include <string.h>
 #include <signal.h>
 #include <stdlib.h>
+#include <netinet/tcp.h>
 
 #include "config.h"
 #include "timestamp.h"
@@ -15,7 +16,7 @@
 #define GMOCK_PLUGIN_MANAGER_LOG_ERROR(format, ...) LOG_ERROR("gmock plugin manager", format, ##__VA_ARGS__)
 #define GMOCK_PLUGIN_MANAGER_LOG_DEBUG(format, ...) LOG_DEBUG("gomck plugin manager", format, ##__VA_ARGS__)
 
-static void inject_tcp_rst_condtion(struct session *sess, uint16_t thr_idx)
+static void inject_tcp_rst(struct session *sess)
 {
     uint64_t session_num = sess->mgr_stat->total_nr_tcp_sess_used;
 
@@ -23,46 +24,46 @@ static void inject_tcp_rst_condtion(struct session *sess, uint16_t thr_idx)
     {
     case 1:
         // recv SYN packet
-        if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0)
+        if (session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 && session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 0)
         {
-            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
-            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == -1);
+            EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_C2S, TH_RST | TH_ACK) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_S2C, TH_RST | TH_ACK) == -1);
             GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv SYN packet", session_get_id(sess), session_get_tuple_str(sess));
         }
         break;
     case 2:
         // recv SYN-ACK packet
-        if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1)
+        if (session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 1 && session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1)
         {
-            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
-            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_C2S, TH_RST | TH_ACK) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_S2C, TH_RST | TH_ACK) == 0);
             GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv SYN-ACK packet", session_get_id(sess), session_get_tuple_str(sess));
         }
         break;
     case 3:
         // recv sub-ACK packet
-        if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 2 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1)
+        if (session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_RAW_PKTS_RX) == 2 && session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_RAW_PKTS_RX) == 1)
         {
-            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
-            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_C2S, TH_RST | TH_ACK) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_S2C, TH_RST | TH_ACK) == 0);
             GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv sub-ACK packet", session_get_id(sess), session_get_tuple_str(sess));
         }
         break;
     case 4:
         // recv C2S Payload
-        if (session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_INJ_PKTS_SUSS) == 0 && session_get_stat(sess, SESSION_DIRECTION_C2S, STAT_TCP_SEGS_RX) == 1)
+        if (session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_INJ_PKTS_SUSS) == 0 && session_get_stat(sess, FLOW_DIRECTION_C2S, STAT_TCP_SEGS_RX) == 1)
         {
-            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
-            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_C2S, TH_RST | TH_ACK) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_S2C, TH_RST | TH_ACK) == 0);
             GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv C2S first payload packet", session_get_id(sess), session_get_tuple_str(sess));
         }
         break;
     case 5:
         // recv S2C Payload
-        if (session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_INJ_PKTS_SUSS) == 0 && session_get_stat(sess, SESSION_DIRECTION_S2C, STAT_TCP_SEGS_RX) == 1)
+        if (session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_INJ_PKTS_SUSS) == 0 && session_get_stat(sess, FLOW_DIRECTION_S2C, STAT_TCP_SEGS_RX) == 1)
         {
-            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_C2S, thr_idx) == 0);
-            EXPECT_TRUE(stellar_inject_tcp_rst(sess, SESSION_DIRECTION_S2C, thr_idx) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_C2S, TH_RST | TH_ACK) == 0);
+            EXPECT_TRUE(stellar_inject_tcp_flags(sess, FLOW_DIRECTION_S2C, TH_RST | TH_ACK) == 0);
             GMOCK_PLUGIN_MANAGER_LOG_DEBUG("=> inject TCP RST for session %u %s on recv S2C first payload packet", session_get_id(sess), session_get_tuple_str(sess));
         }
         break;
@@ -123,7 +124,7 @@ void plugin_manager_dispatch_session(struct plugin_manager *mgr, struct session
             {
                 session_free_tcp_segment(sess, seg);
             }
-            inject_tcp_rst_condtion(sess, thr_idx);
+            inject_tcp_rst(sess);
             break;
         case SESSION_TYPE_UDP:
             break;