diff --git a/common/include/kni_utils.h b/common/include/kni_utils.h
index 5004fc0..52b3c87 100644
--- a/common/include/kni_utils.h
+++ b/common/include/kni_utils.h
@@ -63,6 +63,7 @@ struct kni_tcpopt_info{
 	uint8_t ts_set;
 	uint8_t sack;
 	uint32_t ts_value;
+	uint32_t ts_ecr;
 };
 
 //field_stat
diff --git a/common/src/kni_utils.cpp b/common/src/kni_utils.cpp
index 676735f..b4288e4 100644
--- a/common/src/kni_utils.cpp
+++ b/common/src/kni_utils.cpp
@@ -206,6 +206,7 @@ void kni_get_tcpopt(struct kni_tcpopt_info *tcpopt, struct tcphdr* tcphdr,int tc
                         if ((opsize == TCPOLEN_TIMESTAMP)){
                             tcpopt->ts_set = 1;
 							tcpopt->ts_value = *(uint32_t*)ptr;
+							tcpopt->ts_ecr = *(uint32_t*)(ptr + 4);
                         }
                         break;
                     case TCPOPT_SACK_PERMITTED:
diff --git a/entry/src/kni_entry.cpp b/entry/src/kni_entry.cpp
index d416dc5..ee1bc7b 100644
--- a/entry/src/kni_entry.cpp
+++ b/entry/src/kni_entry.cpp
@@ -1185,6 +1185,20 @@ static int tsg_diagnose_judge_streamshunt(int maat_rule_config_id,struct pme_inf
 	}
 	return ret;
 }
+static void set_timestamp_depend_first_data(struct streaminfo *stream, struct pme_info *pmeinfo, struct pkt_info *pktinfo){
+	struct kni_tcpopt_info tcpopt_first_data;
+	if(pmeinfo->client_tcpopt.ts_set != 1 || pmeinfo->server_tcpopt.ts_set != 1)
+		return;
+	kni_get_tcpopt(&tcpopt_first_data,pktinfo->tcphdr,pktinfo->tcphdr_len);
+	if(stream->curdir == 1){
+		pmeinfo->client_tcpopt.ts_value = tcpopt_first_data.ts_value;
+		pmeinfo->server_tcpopt.ts_value = tcpopt_first_data.ts_ecr;
+	}
+	if(stream->curdir == 2){
+		pmeinfo->client_tcpopt.ts_value = tcpopt_first_data.ts_ecr;
+		pmeinfo->server_tcpopt.ts_value = tcpopt_first_data.ts_value;
+	}
+}
 
 static int first_data_intercept(struct streaminfo *stream, struct pme_info *pmeinfo, struct pkt_info *pktinfo, int thread_seq){
 	FS_operate(g_kni_fs_handle->handle, g_kni_fs_handle->fields[KNI_FIELD_INTCP_READY_STM], 0, FS_OP_ADD, 1);
@@ -1370,6 +1384,8 @@ static int first_data_intercept(struct streaminfo *stream, struct pme_info *pmei
 		}
 	}
 
+	//get intercept success first data timestamps send to tfe 
+	set_timestamp_depend_first_data(stream, pmeinfo, pktinfo);
 	//add cmsg
 	len = 0;
 	buff = add_cmsg_to_packet(pmeinfo, stream, pktinfo, &len);