diff --git a/common/include/tfe_fieldstat.h b/common/include/tfe_fieldstat.h
index baaf4c8..1116b44 100644
--- a/common/include/tfe_fieldstat.h
+++ b/common/include/tfe_fieldstat.h
@@ -38,7 +38,7 @@ struct tfe_fieldstat_metric_t
     struct fieldstat_dynamic_instance *instance;
 };
 
-void tfe_set_intercept_metric(struct tfe_fieldstat_metric_t *fieldstat, struct tfe_cmsg *cmsg, int hit_count, int downstream_rx_pkts, int downstream_rx_bytes, int upstream_rx_pkts, int upstream_rx_bytes, int thread_id);
+void tfe_set_intercept_metric(struct tfe_fieldstat_metric_t *fieldstat, struct tfe_cmsg *cmsg, int hit_count, int downstream_rx_pkts, int downstream_rx_bytes, int upstream_rx_pkts, int upstream_rx_bytes, int thread_id, int dir_is_e2i);
 int tfe_fieldstat_metric_incrby(struct tfe_fieldstat_metric_t *fieldstat, unsigned int column_id, long long value, const struct fieldstat_tag tags[], int n_tags, int thread_id);
 struct tfe_fieldstat_metric_t *tfe_fieldstat_metric_create(char *telegraf_ip, int telegraf_port, char *app_name, int cycle, int max_thread, void *local_logger);
 void tfe_fieldstat_metric_destroy(struct tfe_fieldstat_metric_t *fieldstat);
diff --git a/common/src/tfe_fieldstat.cpp b/common/src/tfe_fieldstat.cpp
index b529297..e0f7285 100644
--- a/common/src/tfe_fieldstat.cpp
+++ b/common/src/tfe_fieldstat.cpp
@@ -4,7 +4,7 @@
 #include "tfe_stream.h"
 #include "tfe_resource.h"
 
-void tfe_set_intercept_metric(struct tfe_fieldstat_metric_t *fieldstat, struct tfe_cmsg *cmsg, int hit_count, int downstream_rx_pkts, int downstream_rx_bytes, int upstream_rx_pkts, int upstream_rx_bytes, int thread_id)
+void tfe_set_intercept_metric(struct tfe_fieldstat_metric_t *fieldstat, struct tfe_cmsg *cmsg, int hit_count, int downstream_rx_pkts, int downstream_rx_bytes, int upstream_rx_pkts, int upstream_rx_bytes, int thread_id, int dir_is_e2i)
 {
     int ret;
     uint16_t out_size;
@@ -38,35 +38,6 @@ void tfe_set_intercept_metric(struct tfe_fieldstat_metric_t *fieldstat, struct t
         return;
     }
 
-    // according to KNI -> MESA_dir_link_to_human()
-    // 'E' or 'e': 表示发包方向是从Internal to External.
-    // 'I' or 'i': 表示发包方向是从External to Internal.
-    unsigned int route_dir;
-    ret = tfe_cmsg_get_value(cmsg, TFE_CMSG_COMMON_DIRECTION, (unsigned char *)&route_dir, sizeof(route_dir), &out_size);
-    if (ret != 0)
-    {
-        TFE_LOG_ERROR(g_default_logger, "failed at fetch route_dir from cmsg: %s", strerror(-ret));
-        return;
-    }
-
-    int dir_is_e2i = 0;
-    switch (route_dir)
-    {
-    case 'e':
-    /* fall through */
-    case 'E':
-        dir_is_e2i = 0;
-        break;
-    case 'i':
-    /* fall through */
-    case 'I':
-        dir_is_e2i = 1;
-        break;
-    default:
-        TFE_LOG_ERROR(g_default_logger, "failed at fetch route dir from cmsg: invalid route dir %c", route_dir);
-        return;
-    }
-
     int in_pkts = 0;
     int in_bytes = 0;
     int out_pkts = 0;
diff --git a/common/src/tfe_packet_io.cpp b/common/src/tfe_packet_io.cpp
index 6d40c9f..1b9e848 100644
--- a/common/src/tfe_packet_io.cpp
+++ b/common/src/tfe_packet_io.cpp
@@ -1225,14 +1225,13 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
     }
     raw_packet_parser_get_most_inner_tuple4(&raw_parser, &inner_tuple4, logger);
 
+    ret = intercept_policy_enforce(thread->ref_proxy->int_ply_enforcer, parser->cmsg);
+    if (ret != 0) {
+        is_passthrough = 1;
+        set_passthrough_reason(parser->cmsg, reason_invalid_intercept_param);
+        goto passthrough;
+    }
     if (parser->intercpet_data == 0) {
-        ret = intercept_policy_enforce(thread->ref_proxy->int_ply_enforcer, parser->cmsg);
-        if (ret != 0) {
-            is_passthrough = 1;
-            set_passthrough_reason(parser->cmsg, reason_invalid_intercept_param);
-            goto passthrough;
-        }
-
         tfe_cmsg_get_value(parser->cmsg, TFE_CMSG_HIT_NO_INTERCEPT, (unsigned char *)&hit_no_intercept, sizeof(hit_no_intercept), &out_size);
         if (hit_no_intercept == 1) {
             is_passthrough = 1;
@@ -1423,7 +1422,7 @@ static int handle_session_closing(struct metadata *meta, struct ctrl_pkt_parser
     {
         struct session_ctx *s_ctx = (struct session_ctx *)node->val_data;
         TFE_LOG_INFO(logger, "%s: session %lu closing", LOG_TAG_PKTIO, s_ctx->session_id);
-        tfe_set_intercept_metric(acceptor_ctx->metric, s_ctx->cmsg, 1, s_ctx->c2s_info.rx.n_pkts, s_ctx->c2s_info.rx.n_bytes, s_ctx->s2c_info.rx.n_pkts, s_ctx->s2c_info.rx.n_bytes, thread_seq);
+        tfe_set_intercept_metric(acceptor_ctx->metric, s_ctx->cmsg, 1, s_ctx->c2s_info.rx.n_pkts, s_ctx->c2s_info.rx.n_bytes, s_ctx->s2c_info.rx.n_pkts, s_ctx->s2c_info.rx.n_bytes, thread_seq, s_ctx->c2s_info.is_e2i_dir);
         session_table_delete_by_id(thread->session_table, meta->session_id);
         ATOMIC_DEC(&(packet_io_fs->session_num));
         return 0;