diff --git a/common/include/utils.h b/common/include/utils.h
index f5097d9..d0d6bcf 100644
--- a/common/include/utils.h
+++ b/common/include/utils.h
@@ -27,6 +27,9 @@ extern "C"
 #define	ATOMIC_ADD(x, y) __atomic_fetch_add(x, y, __ATOMIC_RELAXED)
 #define ATOMIC_SET(x, y) __atomic_store_n(x, y, __ATOMIC_RELAXED)
 
+#define likely(expr)   __builtin_expect((expr), 1)
+#define unlikely(expr) __builtin_expect((expr), 0)
+
 /******************************************************************************
  * fixed_num_array
  ******************************************************************************/
diff --git a/conf/sce.conf b/conf/sce.conf
index 73af692..a1a9681 100644
--- a/conf/sce.conf
+++ b/conf/sce.conf
@@ -39,8 +39,11 @@ redis_port_range=6379
 max_chaining_size=32
 
 [packet_io]
-# bypass_all_traffic:1 NF2NF and SF2SF
-bypass_all_traffic=0
+# bypass_traffic:0 disable
+# bypass_traffic:1 bypass all       traffic
+# bypass_traffic:2 bypass raw       traffic
+# bypass_traffic:3 bypass decrypted traffic
+bypass_traffic=0
 rx_burst_max=128
 app_symbol=sce
 dev_endpoint=eth_sf_endpoint
diff --git a/platform/src/packet_io.cpp b/platform/src/packet_io.cpp
index 4b207e5..ad37240 100644
--- a/platform/src/packet_io.cpp
+++ b/platform/src/packet_io.cpp
@@ -24,7 +24,7 @@
 
 struct config
 {
-    int bypass_all_traffic;
+    int bypass_traffic;
     int rx_burst_max;
     char app_symbol[256];
     char dev_endpoint[256];
@@ -896,6 +896,22 @@ static void handle_raw_packet(marsio_buff_t *rx_buff, struct thread_ctx *thread_
         goto error_bypass;
     }
 
+    // bypass_traffic:0 disable
+    // bypass_traffic:1 bypass all       traffic
+    // bypass_traffic:2 bypass raw       traffic
+    // bypass_traffic:3 bypass decrypted traffic
+    if (unlikely(thread_ctx->ref_io->config.bypass_traffic == 2 && meta.is_decrypted == 0))
+    {
+        LOG_DEBUG("%s: session %lu bypass, enable raw traffic bypass !!!", LOG_TAG_PKTIO);
+        goto error_bypass;
+    }
+
+    if (unlikely(thread_ctx->ref_io->config.bypass_traffic == 3 && meta.is_decrypted == 1))
+    {
+        LOG_DEBUG("%s: session %lu bypass, enable decrypted traffic bypass !!!", LOG_TAG_PKTIO);
+        goto error_bypass;
+    }
+
     session_ctx = raw_packet_search_session(session_table, meta.raw_data, meta.raw_len, meta.session_id);
     if (session_ctx == NULL)
     {
@@ -1033,7 +1049,11 @@ error_block:
 // return -1 : error
 static int packet_io_config(const char *profile, struct config *config)
 {
-    MESA_load_profile_int_def(profile, "PACKET_IO", "bypass_all_traffic", (int *)&(config->bypass_all_traffic), 0);
+    // bypass_traffic:0 disable
+    // bypass_traffic:1 bypass all       traffic
+    // bypass_traffic:2 bypass raw       traffic
+    // bypass_traffic:3 bypass decrypted traffic
+    MESA_load_profile_int_def(profile, "PACKET_IO", "bypass_traffic", (int *)&(config->bypass_traffic), 0);
     MESA_load_profile_int_def(profile, "PACKET_IO", "rx_burst_max", (int *)&(config->rx_burst_max), 1);
     MESA_load_profile_string_nodef(profile, "PACKET_IO", "app_symbol", config->app_symbol, sizeof(config->app_symbol));
     MESA_load_profile_string_nodef(profile, "PACKET_IO", "dev_endpoint", config->dev_endpoint, sizeof(config->dev_endpoint));
@@ -1066,7 +1086,7 @@ static int packet_io_config(const char *profile, struct config *config)
         return -1;
     }
 
-    LOG_DEBUG("%s: PACKET_IO->bypass_all_traffic   : %d", LOG_TAG_PKTIO, config->bypass_all_traffic);
+    LOG_DEBUG("%s: PACKET_IO->bypass_traffic       : %d", LOG_TAG_PKTIO, config->bypass_traffic);
     LOG_DEBUG("%s: PACKET_IO->rx_burst_max         : %d", LOG_TAG_PKTIO, config->rx_burst_max);
     LOG_DEBUG("%s: PACKET_IO->app_symbol           : %s", LOG_TAG_PKTIO, config->app_symbol);
     LOG_DEBUG("%s: PACKET_IO->dev_endpoint         : %s", LOG_TAG_PKTIO, config->dev_endpoint);
@@ -1229,7 +1249,7 @@ int packet_io_thread_polling_nf(struct packet_io *handle, struct thread_ctx *thr
         return 0;
     }
 
-    if (handle->config.bypass_all_traffic == 1)
+    if (handle->config.bypass_traffic == 1)
     {
         for (int j = 0; j < nr_recv; j++)
         {
@@ -1292,7 +1312,7 @@ int packet_io_thread_polling_endpoint(struct packet_io *handle, struct thread_ct
         return 0;
     }
 
-    if (handle->config.bypass_all_traffic == 1)
+    if (handle->config.bypass_traffic == 1)
     {
         for (int j = 0; j < nr_recv; j++)
         {