Add Packet/IPv4/TCP/UDP helpers API

16 files changed, 509 insertions, 963 deletions

diff --git a/src/dablooms/test/CMakeLists.txt b/src/dablooms/test/CMakeLists.txt
index 9254651..3be7b84 100644
--- a/src/dablooms/test/CMakeLists.txt
+++ b/src/dablooms/test/CMakeLists.txt
@@ -3,7 +3,6 @@
 ###############################################################################
 
 add_executable(gtest_dablooms gtest_dablooms.cpp)
-target_include_directories(gtest_dablooms PUBLIC ${CMAKE_CURRENT_LIST_DIR})
 target_link_libraries(gtest_dablooms dablooms gtest)
 
 include(GoogleTest)
diff --git a/src/packet/CMakeLists.txt b/src/packet/CMakeLists.txt
index 5d18f1e..754b177 100644
--- a/src/packet/CMakeLists.txt
+++ b/src/packet/CMakeLists.txt
@@ -2,7 +2,7 @@
 # packet
 ###############################################################################
 
-add_library(packet packet.cpp packet_helpers.cpp)
+add_library(packet packet.cpp)
 target_include_directories(packet PUBLIC ${CMAKE_SOURCE_DIR}/src/packet)
 target_include_directories(packet PUBLIC ${CMAKE_SOURCE_DIR}/src/tuple)
 target_include_directories(packet PUBLIC ${CMAKE_SOURCE_DIR}/deps/uthash)
diff --git a/src/packet/ipv4_helpers.h b/src/packet/ipv4_helpers.h
index db42bea..166093e 100644
--- a/src/packet/ipv4_helpers.h
+++ b/src/packet/ipv4_helpers.h
@@ -9,6 +9,46 @@ extern "C"
 #include <arpa/inet.h>
 #include <netinet/ip.h>
 
+/*
+ * Internet Header Format
+ *
+ *   0                   1                   2                   3
+ *   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |Version|  IHL  |Type of Service|          Total Length         |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |         Identification        |Flags|      Fragment Offset    |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |  Time to Live |    Protocol   |         Header Checksum       |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |                       Source Address                          |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |                    Destination Address                        |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |                    Options                    |    Padding    |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ */
+
+static inline uint8_t ipv4_hdr_get_version(const struct ip *hdr)
+{
+    return hdr->ip_v;
+}
+
+static inline uint8_t ipv4_hdr_get_hl(const struct ip *hdr)
+{
+    return hdr->ip_hl << 2;
+}
+
+static inline uint8_t ipv4_hdr_get_tos(const struct ip *hdr)
+{
+    return hdr->ip_tos;
+}
+
+static inline uint16_t ipv4_hdr_get_len(const struct ip *hdr)
+{
+    return ntohs(hdr->ip_len);
+}
+
 static inline uint16_t ipv4_hdr_get_ipid(const struct ip *hdr)
 {
     return ntohs(hdr->ip_id);
@@ -16,7 +56,22 @@ static inline uint16_t ipv4_hdr_get_ipid(const struct ip *hdr)
 
 static inline uint8_t ipv4_hdr_get_flags(const struct ip *hdr)
 {
-    return (ntohs(hdr->ip_off) & IP_OFFMASK) >> 13;
+    return (ntohs(hdr->ip_off) & (~IP_OFFMASK)) >> 13;
+}
+
+static inline bool ipv4_hdr_has_flag_rf(const struct ip *hdr)
+{
+    return (ntohs(hdr->ip_off) & IP_RF) != 0;
+}
+
+static inline bool ipv4_hdr_has_flag_df(const struct ip *hdr)
+{
+    return (ntohs(hdr->ip_off) & IP_DF) != 0;
+}
+
+static inline bool ipv4_hdr_has_flag_mf(const struct ip *hdr)
+{
+    return (ntohs(hdr->ip_off) & IP_MF) != 0;
 }
 
 static inline uint16_t ipv4_hdr_get_frag_offset(const struct ip *hdr)
@@ -49,19 +104,14 @@ static inline uint32_t ipv4_hdr_get_dst(const struct ip *hdr)
     return ntohl(hdr->ip_dst.s_addr);
 }
 
-static inline bool ipv4_hdr_has_flag_rf(const struct ip *hdr)
+static inline uint8_t ipv4_hdr_get_opt_len(const struct ip *hdr)
 {
-    return (ntohs(hdr->ip_off) & IP_RF) != 0;
+    return ipv4_hdr_get_hl(hdr) - sizeof(struct ip);
 }
 
-static inline bool ipv4_hdr_has_flag_df(const struct ip *hdr)
+static inline const uint8_t *ipv4_hdr_get_opt_ptr(const struct ip *hdr)
 {
-    return (ntohs(hdr->ip_off) & IP_DF) != 0;
-}
-
-static inline bool ipv4_hdr_has_flag_mf(const struct ip *hdr)
-{
-    return (ntohs(hdr->ip_off) & IP_MF) != 0;
+    return (const uint8_t *)hdr + sizeof(struct ip);
 }
 
 #ifdef __cpluscplus
diff --git a/src/packet/packet_helpers.cpp b/src/packet/packet_helpers.cpp
deleted file mode 100644
index 290b02b..0000000
--- a/src/packet/packet_helpers.cpp
+++ /dev/null
@@ -1,595 +0,0 @@
-#include <stdlib.h>
-#include <string.h>
-#include <arpa/inet.h>
-#include <netinet/ip.h>
-#include <netinet/ip6.h>
-#define __FAVOR_BSD 1
-#include <netinet/tcp.h>
-#include <netinet/udp.h>
-
-#include "packet_helpers.h"
-#include "tcp_helpers.h"
-#include "udp_helpers.h"
-
-/******************************************************************************
- * Private API
- ******************************************************************************/
-
-static bool ipv4_is_fragment(const struct ip *ip_hdr, uint16_t hdr_len)
-{
-    if ((ntohs(ip_hdr->ip_off) & IP_MF) || (ntohs(ip_hdr->ip_off) & IP_OFFMASK))
-    {
-        return true;
-    }
-    else
-    {
-        return false;
-    }
-}
-
-static bool ipv6_is_fragment(const struct ip6_hdr *ip6_hdr, uint16_t hdr_len)
-{
-    uint8_t next_hdr = ip6_hdr->ip6_nxt;
-    if (next_hdr == IPPROTO_FRAGMENT)
-    {
-        return true;
-    }
-    else
-    {
-        return false;
-    }
-}
-
-/******************************************************************************
- * Public API
- ******************************************************************************/
-
-// metadata
-struct metadata *metadata_dup(const struct metadata *metadata)
-{
-    if (metadata == NULL)
-    {
-        return NULL;
-    }
-
-    struct metadata *metadata_dup = (struct metadata *)calloc(1, sizeof(struct metadata));
-    if (metadata_dup == NULL)
-    {
-        return NULL;
-    }
-
-    memcpy(metadata_dup, metadata, sizeof(struct metadata));
-
-    return metadata_dup;
-}
-
-void metadata_free(struct metadata *metadata)
-{
-    if (metadata)
-    {
-        free(metadata);
-        metadata = NULL;
-    }
-}
-
-void packet_set0_metadata(struct packet *pkt, const struct metadata *metadata)
-{
-    pkt->user_data = (const void *)metadata;
-}
-
-const struct metadata *packet_get0_metadata(const struct packet *pkt)
-{
-    return (const struct metadata *)pkt->user_data;
-}
-
-// packet
-struct packet *packet_dup(const struct packet *pkt)
-{
-    if (pkt == NULL)
-    {
-        return NULL;
-    }
-
-    struct packet *pkt_dup = (struct packet *)calloc(1, sizeof(struct packet));
-    if (pkt_dup == NULL)
-    {
-        return NULL;
-    }
-
-    memcpy(pkt_dup, pkt, sizeof(struct packet));
-
-    if (pkt->data_len)
-    {
-        pkt_dup->data_ptr = (const char *)calloc(1, pkt->data_len);
-        if (pkt_dup->data_ptr == NULL)
-        {
-            free(pkt_dup);
-            return NULL;
-        }
-        memcpy((char *)pkt_dup->data_ptr, pkt->data_ptr, pkt->data_len);
-
-        for (int8_t i = 0; i < pkt->layers_used; i++)
-        {
-            pkt_dup->layers[i].hdr_ptr = pkt_dup->data_ptr + pkt->layers[i].hdr_offset;
-            pkt_dup->layers[i].pld_ptr = pkt_dup->data_ptr + pkt->layers[i].hdr_offset + pkt->layers[i].hdr_len;
-        }
-    }
-
-    return pkt_dup;
-}
-
-void packet_free(struct packet *pkt)
-{
-    if (pkt)
-    {
-        if (pkt->data_ptr)
-        {
-            free((char *)pkt->data_ptr);
-            pkt->data_ptr = NULL;
-        }
-        free(pkt);
-        pkt = NULL;
-    }
-}
-
-// packet
-uint64_t packet_get_zone_id(const struct packet *pkt)
-{
-    return pkt->zone_id;
-}
-
-uint16_t packet_get_raw_len(const struct packet *pkt)
-{
-    return pkt->data_len;
-}
-
-const char *packet_get0_raw_data(const struct packet *pkt)
-{
-    return pkt->data_ptr;
-}
-
-bool paket_is_fragment(const struct packet *pkt)
-{
-    for (int8_t i = 0; i < pkt->layers_used; i++)
-    {
-        if (pkt->layers[i].type == LAYER_TYPE_IPV4)
-        {
-            struct ip *ip_hdr = (struct ip *)pkt->layers[i].hdr_ptr;
-            uint16_t hdr_len = pkt->layers[i].hdr_len;
-            if (ipv4_is_fragment(ip_hdr, hdr_len))
-            {
-                return true;
-            }
-        }
-
-        if (pkt->layers[i].type == LAYER_TYPE_IPV6)
-        {
-            struct ip6_hdr *ip6_hdr = (struct ip6_hdr *)pkt->layers[i].hdr_ptr;
-            uint16_t hdr_len = pkt->layers[i].hdr_len;
-            if (ipv6_is_fragment(ip6_hdr, hdr_len))
-            {
-                return true;
-            }
-        }
-    }
-
-    return false;
-}
-
-bool packet_has_tcp(const struct packet *pkt)
-{
-    if (packet_get_innermost_layer(pkt, LAYER_TYPE_TCP))
-    {
-        return true;
-    }
-    else
-    {
-        return false;
-    }
-}
-
-bool packet_has_udp(const struct packet *pkt)
-{
-    if (packet_get_innermost_layer(pkt, LAYER_TYPE_UDP))
-    {
-        return true;
-    }
-    else
-    {
-        return false;
-    }
-}
-
-// foreach layer
-uint8_t packet_get_layer_count(const struct packet *pkt)
-{
-    return pkt->layers_used;
-}
-
-enum layer_type packet_get_layer_type(const struct packet *pkt, uint8_t index)
-{
-    return pkt->layers[index].type;
-}
-
-const char *packet_get_layer_hdr_ptr(const struct packet *pkt, uint8_t index)
-{
-    return pkt->layers[index].hdr_ptr;
-}
-
-const char *packet_get_layer_pld_ptr(const struct packet *pkt, uint8_t index)
-{
-    return pkt->layers[index].pld_ptr;
-}
-
-uint16_t packet_get_layer_hdr_len(const struct packet *pkt, uint8_t index)
-{
-    return pkt->layers[index].hdr_len;
-}
-
-uint16_t packet_get_layer_pld_len(const struct packet *pkt, uint8_t index)
-{
-    return pkt->layers[index].pld_len;
-}
-
-// get tcp layer
-const struct layer_record *packet_get0_tcp_layer(const struct packet *pkt)
-{
-    return packet_get_innermost_layer(pkt, LAYER_TYPE_TCP);
-}
-
-const char *packet_get_tcp_hdr_ptr(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_tcp_layer(pkt);
-    if (layer)
-    {
-        return layer->hdr_ptr;
-    }
-    else
-    {
-        return NULL;
-    }
-}
-
-const char *packet_get_tcp_pld_ptr(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_tcp_layer(pkt);
-    if (layer)
-    {
-        return layer->pld_ptr;
-    }
-    else
-    {
-        return NULL;
-    }
-}
-
-uint16_t packet_get_tcp_hdr_len(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_tcp_layer(pkt);
-    if (layer)
-    {
-        return layer->hdr_len;
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint16_t packet_get_tcp_pld_len(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_tcp_layer(pkt);
-    if (layer)
-    {
-        return layer->pld_len;
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint16_t packet_get_tcp_sport(const struct packet *pkt)
-{
-    const char *hdr_ptr = packet_get_tcp_hdr_ptr(pkt);
-    if (hdr_ptr)
-    {
-        return tcp_hdr_get_sport((struct tcphdr *)hdr_ptr);
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint16_t packet_get_tcp_dport(const struct packet *pkt)
-{
-    const char *hdr_ptr = packet_get_tcp_hdr_ptr(pkt);
-    if (hdr_ptr)
-    {
-        return tcp_hdr_get_dport((struct tcphdr *)hdr_ptr);
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint32_t packet_get_tcp_seq(const struct packet *pkt)
-{
-    const char *hdr_ptr = packet_get_tcp_hdr_ptr(pkt);
-    if (hdr_ptr)
-    {
-        return tcp_hdr_get_seq((struct tcphdr *)hdr_ptr);
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint32_t packet_get_tcp_ack(const struct packet *pkt)
-{
-    const char *hdr_ptr = packet_get_tcp_hdr_ptr(pkt);
-    if (hdr_ptr)
-    {
-        return tcp_hdr_get_ack((struct tcphdr *)hdr_ptr);
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint8_t packet_get_tcp_flags(const struct packet *pkt)
-{
-    const char *hdr_ptr = packet_get_tcp_hdr_ptr(pkt);
-    if (hdr_ptr)
-    {
-        return tcp_hdr_get_flags((struct tcphdr *)hdr_ptr);
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-bool packet_has_tcp_flag_urg(const struct packet *pkt)
-{
-    if (packet_get_tcp_flags(pkt) & TH_URG)
-    {
-        return true;
-    }
-    else
-    {
-        return false;
-    }
-}
-
-bool packet_has_tcp_flag_ack(const struct packet *pkt)
-{
-    if (packet_get_tcp_flags(pkt) & TH_ACK)
-    {
-        return true;
-    }
-    else
-    {
-        return false;
-    }
-}
-
-bool packet_has_tcp_flag_psh(const struct packet *pkt)
-{
-    if (packet_get_tcp_flags(pkt) & TH_PUSH)
-    {
-        return true;
-    }
-    else
-    {
-        return false;
-    }
-}
-
-bool packet_has_tcp_flag_rst(const struct packet *pkt)
-{
-    if (packet_get_tcp_flags(pkt) & TH_RST)
-    {
-        return true;
-    }
-    else
-    {
-        return false;
-    }
-}
-
-bool packet_has_tcp_flag_syn(const struct packet *pkt)
-{
-    if (packet_get_tcp_flags(pkt) & TH_SYN)
-    {
-        return true;
-    }
-    else
-    {
-        return false;
-    }
-}
-
-bool packet_has_tcp_flag_fin(const struct packet *pkt)
-{
-    if (packet_get_tcp_flags(pkt) & TH_FIN)
-    {
-        return true;
-    }
-    else
-    {
-        return false;
-    }
-}
-
-// get inner udp layer
-const struct layer_record *packet_get0_inner_udp_layer(const struct packet *pkt)
-{
-    return packet_get_innermost_layer(pkt, LAYER_TYPE_UDP);
-}
-
-const char *packet_get_inner_udp_hdr_ptr(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_inner_udp_layer(pkt);
-    if (layer)
-    {
-        return layer->hdr_ptr;
-    }
-    else
-    {
-        return NULL;
-    }
-}
-
-const char *packet_get_inner_udp_pld_ptr(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_inner_udp_layer(pkt);
-    if (layer)
-    {
-        return layer->pld_ptr;
-    }
-    else
-    {
-        return NULL;
-    }
-}
-
-uint16_t packet_get_inner_udp_hdr_len(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_inner_udp_layer(pkt);
-    if (layer)
-    {
-        return layer->hdr_len;
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint16_t packet_get_inner_udp_pld_len(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_inner_udp_layer(pkt);
-    if (layer)
-    {
-        return layer->pld_len;
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint16_t packet_get_inner_udp_sport(const struct packet *pkt)
-{
-    const char *hdr_ptr = packet_get_inner_udp_hdr_ptr(pkt);
-    if (hdr_ptr)
-    {
-        return udp_hdr_get_sport((struct udphdr *)hdr_ptr);
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint16_t packet_get_inner_udp_dport(const struct packet *pkt)
-{
-    const char *hdr_ptr = packet_get_inner_udp_hdr_ptr(pkt);
-    if (hdr_ptr)
-    {
-        return udp_hdr_get_dport((struct udphdr *)hdr_ptr);
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-// get outer udp layer
-const struct layer_record *packet_get0_outer_udp_layer(const struct packet *pkt)
-{
-    return packet_get_outermost_layer(pkt, LAYER_TYPE_UDP);
-}
-
-const char *packet_get_outer_udp_hdr_ptr(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_outer_udp_layer(pkt);
-    if (layer)
-    {
-        return layer->hdr_ptr;
-    }
-    else
-    {
-        return NULL;
-    }
-}
-
-const char *packet_get_outer_udp_pld_ptr(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_outer_udp_layer(pkt);
-    if (layer)
-    {
-        return layer->pld_ptr;
-    }
-    else
-    {
-        return NULL;
-    }
-}
-
-uint16_t packet_get_outer_udp_hdr_len(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_outer_udp_layer(pkt);
-    if (layer)
-    {
-        return layer->hdr_len;
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint16_t packet_get_outer_udp_pld_len(const struct packet *pkt)
-{
-    const struct layer_record *layer = packet_get0_outer_udp_layer(pkt);
-    if (layer)
-    {
-        return layer->pld_len;
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint16_t packet_get_outer_udp_sport(const struct packet *pkt)
-{
-    const char *hdr_ptr = packet_get_outer_udp_hdr_ptr(pkt);
-    if (hdr_ptr)
-    {
-        return udp_hdr_get_sport((struct udphdr *)hdr_ptr);
-    }
-    else
-    {
-        return 0;
-    }
-}
-
-uint16_t packet_get_outer_udp_dport(const struct packet *pkt)
-{
-    const char *hdr_ptr = packet_get_outer_udp_hdr_ptr(pkt);
-    if (hdr_ptr)
-    {
-        return udp_hdr_get_dport((struct udphdr *)hdr_ptr);
-    }
-    else
-    {
-        return 0;
-    }
-}
diff --git a/src/packet/packet_helpers.h b/src/packet/packet_helpers.h
index 91125ad..181ce25 100644
--- a/src/packet/packet_helpers.h
+++ b/src/packet/packet_helpers.h
@@ -6,74 +6,186 @@ extern "C"
 {
 #endif
 
+#include <stdlib.h>
+#include <string.h>
+#include <netinet/ip.h>
+#include <netinet/ip6.h>
+
 #include "packet.h"
+#include "ipv4_helpers.h"
 
 struct metadata
 {
     // TODO
 };
 
-// metadata
-struct metadata *metadata_dup(const struct metadata *metadata);
-void metadata_free(struct metadata *metadata);
-void packet_set0_metadata(struct packet *pkt, const struct metadata *metadata);
-const struct metadata *packet_get0_metadata(const struct packet *pkt);
-
-// packet
-struct packet *packet_dup(const struct packet *pkt);
-void packet_free(struct packet *pkt);
-
-uint64_t packet_get_zone_id(const struct packet *pkt);
-uint16_t packet_get_raw_len(const struct packet *pkt);
-const char *packet_get0_raw_data(const struct packet *pkt);
-
-bool paket_is_fragment(const struct packet *pkt);
-bool packet_has_tcp(const struct packet *pkt);
-bool packet_has_udp(const struct packet *pkt);
-
-// foreach layer
-uint8_t packet_get_layer_count(const struct packet *pkt);
-enum layer_type packet_get_layer_type(const struct packet *pkt, uint8_t index);
-const char *packet_get_layer_hdr_ptr(const struct packet *pkt, uint8_t index);
-const char *packet_get_layer_pld_ptr(const struct packet *pkt, uint8_t index);
-uint16_t packet_get_layer_hdr_len(const struct packet *pkt, uint8_t index);
-uint16_t packet_get_layer_pld_len(const struct packet *pkt, uint8_t index);
-
-// get tcp layer
-const struct layer_record *packet_get0_tcp_layer(const struct packet *pkt);
-const char *packet_get_tcp_hdr_ptr(const struct packet *pkt);
-const char *packet_get_tcp_pld_ptr(const struct packet *pkt);
-uint16_t packet_get_tcp_hdr_len(const struct packet *pkt);
-uint16_t packet_get_tcp_pld_len(const struct packet *pkt);
-uint16_t packet_get_tcp_sport(const struct packet *pkt);
-uint16_t packet_get_tcp_dport(const struct packet *pkt);
-uint32_t packet_get_tcp_seq(const struct packet *pkt);
-uint32_t packet_get_tcp_ack(const struct packet *pkt);
-uint8_t packet_get_tcp_flags(const struct packet *pkt);
-bool packet_has_tcp_flag_urg(const struct packet *pkt);
-bool packet_has_tcp_flag_ack(const struct packet *pkt);
-bool packet_has_tcp_flag_psh(const struct packet *pkt);
-bool packet_has_tcp_flag_rst(const struct packet *pkt);
-bool packet_has_tcp_flag_syn(const struct packet *pkt);
-bool packet_has_tcp_flag_fin(const struct packet *pkt);
-
-// get inner udp layer
-const struct layer_record *packet_get0_inner_udp_layer(const struct packet *pkt);
-const char *packet_get_inner_udp_hdr_ptr(const struct packet *pkt);
-const char *packet_get_inner_udp_pld_ptr(const struct packet *pkt);
-uint16_t packet_get_inner_udp_hdr_len(const struct packet *pkt);
-uint16_t packet_get_inner_udp_pld_len(const struct packet *pkt);
-uint16_t packet_get_inner_udp_sport(const struct packet *pkt);
-uint16_t packet_get_inner_udp_dport(const struct packet *pkt);
-
-// get outer udp layer
-const struct layer_record *packet_get0_outer_udp_layer(const struct packet *pkt);
-const char *packet_get_outer_udp_hdr_ptr(const struct packet *pkt);
-const char *packet_get_outer_udp_pld_ptr(const struct packet *pkt);
-uint16_t packet_get_outer_udp_hdr_len(const struct packet *pkt);
-uint16_t packet_get_outer_udp_pld_len(const struct packet *pkt);
-uint16_t packet_get_outer_udp_sport(const struct packet *pkt);
-uint16_t packet_get_outer_udp_dport(const struct packet *pkt);
+/******************************************************************************
+ * metadata
+ ******************************************************************************/
+
+static inline struct metadata *metadata_dup(const struct metadata *metadata)
+{
+    if (metadata == NULL)
+    {
+        return NULL;
+    }
+
+    struct metadata *metadata_dup = (struct metadata *)calloc(1, sizeof(struct metadata));
+    if (metadata_dup == NULL)
+    {
+        return NULL;
+    }
+    memcpy(metadata_dup, metadata, sizeof(struct metadata));
+
+    return metadata_dup;
+}
+
+static inline void metadata_free(struct metadata *metadata)
+{
+    if (metadata)
+    {
+        free(metadata);
+        metadata = NULL;
+    }
+}
+
+static inline void packet_set0_metadata(struct packet *pkt, const struct metadata *metadata)
+{
+    pkt->user_data = (const void *)metadata;
+}
+
+static inline const struct metadata *packet_get0_metadata(const struct packet *pkt)
+{
+    return (const struct metadata *)pkt->user_data;
+}
+
+/******************************************************************************
+ * packet
+ ******************************************************************************/
+
+static inline bool paket_is_fragment(const struct packet *pkt)
+{
+    for (int8_t i = 0; i < pkt->layers_used; i++)
+    {
+        if (pkt->layers[i].type == LAYER_TYPE_IPV4)
+        {
+            struct ip *ip_hdr = (struct ip *)pkt->layers[i].hdr_ptr;
+            if (ipv4_hdr_has_flag_mf(ip_hdr) || ipv4_hdr_get_frag_offset(ip_hdr))
+            {
+                return true;
+            }
+        }
+
+        if (pkt->layers[i].type == LAYER_TYPE_IPV6)
+        {
+            struct ip6_hdr *ip6_hdr = (struct ip6_hdr *)pkt->layers[i].hdr_ptr;
+            if (ip6_hdr->ip6_nxt == IPPROTO_FRAGMENT)
+            {
+                return true;
+            }
+        }
+    }
+
+    return false;
+}
+
+static inline struct packet *packet_dup(const struct packet *pkt)
+{
+    if (pkt == NULL)
+    {
+        return NULL;
+    }
+
+    struct packet *pkt_dup = (struct packet *)calloc(1, sizeof(struct packet));
+    if (pkt_dup == NULL)
+    {
+        return NULL;
+    }
+    memcpy(pkt_dup, pkt, sizeof(struct packet));
+
+    if (pkt->data_len)
+    {
+        pkt_dup->data_ptr = (const char *)calloc(1, pkt->data_len);
+        if (pkt_dup->data_ptr == NULL)
+        {
+            free(pkt_dup);
+            return NULL;
+        }
+        memcpy((char *)pkt_dup->data_ptr, pkt->data_ptr, pkt->data_len);
+
+        for (int8_t i = 0; i < pkt->layers_used; i++)
+        {
+            pkt_dup->layers[i].hdr_ptr = pkt_dup->data_ptr + pkt->layers[i].hdr_offset;
+            pkt_dup->layers[i].pld_ptr = pkt_dup->data_ptr + pkt->layers[i].hdr_offset + pkt->layers[i].hdr_len;
+        }
+    }
+
+    return pkt_dup;
+}
+
+static inline void packet_free(struct packet *pkt)
+{
+    if (pkt)
+    {
+        if (pkt->data_ptr)
+        {
+            free((char *)pkt->data_ptr);
+            pkt->data_ptr = NULL;
+        }
+        free(pkt);
+        pkt = NULL;
+    }
+}
+
+static inline uint64_t packet_get_zone_id(const struct packet *pkt)
+{
+    return pkt->zone_id;
+}
+
+static inline uint16_t packet_get_raw_len(const struct packet *pkt)
+{
+    return pkt->data_len;
+}
+
+static inline const char *packet_get0_raw_data(const struct packet *pkt)
+{
+    return pkt->data_ptr;
+}
+
+static inline uint8_t packet_get_layer_count(const struct packet *pkt)
+{
+    return pkt->layers_used;
+}
+
+static inline const struct layer_record *packet_get_layer(const struct packet *pkt, uint8_t index)
+{
+    return &pkt->layers[index];
+}
+
+static inline enum layer_type layer_get_type(const struct layer_record *layer)
+{
+    return layer->type;
+}
+
+static inline const char *layer_get_hdr_ptr(const struct layer_record *layer)
+{
+    return layer->hdr_ptr;
+}
+
+static inline const char *layer_get_pld_ptr(const struct layer_record *layer)
+{
+    return layer->pld_ptr;
+}
+
+static inline uint16_t layer_get_hdr_len(const struct layer_record *layer)
+{
+    return layer->hdr_len;
+}
+
+static inline uint16_t layer_get_pld_len(const struct layer_record *layer)
+{
+    return layer->pld_len;
+}
 
 #ifdef __cpluscplus
 }
diff --git a/src/packet/tcp_helpers.h b/src/packet/tcp_helpers.h
index e4a3d4b..7468c79 100644
--- a/src/packet/tcp_helpers.h
+++ b/src/packet/tcp_helpers.h
@@ -10,24 +10,53 @@ extern "C"
 #define __FAVOR_BSD 1
 #include <netinet/tcp.h>
 
+/*
+ * TCP Header Format
+ *
+ *   0                   1                   2                   3
+ *   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |          Source Port          |       Destination Port        |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |                        Sequence Number                        |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |                    Acknowledgment Number                      |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |  Data |           |U|A|P|R|S|F|                               |
+ *  | Offset| Reserved  |R|C|S|S|Y|I|            Window             |
+ *  |       |           |G|K|H|T|N|N|                               |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |           Checksum            |         Urgent Pointer        |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |                    Options                    |    Padding    |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |                             data                              |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ */
+
 static inline uint16_t tcp_hdr_get_sport(const struct tcphdr *hdr)
 {
-    return ntohs(hdr->source);
+    return ntohs(hdr->th_sport);
 }
 
 static inline uint16_t tcp_hdr_get_dport(const struct tcphdr *hdr)
 {
-    return ntohs(hdr->dest);
+    return ntohs(hdr->th_dport);
 }
 
 static inline uint32_t tcp_hdr_get_seq(const struct tcphdr *hdr)
 {
-    return ntohl(hdr->seq);
+    return ntohl(hdr->th_seq);
 }
 
 static inline uint32_t tcp_hdr_get_ack(const struct tcphdr *hdr)
 {
-    return ntohl(hdr->ack_seq);
+    return ntohl(hdr->th_ack);
+}
+
+static inline uint8_t tcp_hdr_get_doff(const struct tcphdr *hdr)
+{
+    return hdr->th_off << 2;
 }
 
 static inline uint8_t tcp_hdr_get_flags(const struct tcphdr *hdr)
@@ -65,6 +94,31 @@ static inline bool tcp_hdr_has_flag_fin(const struct tcphdr *hdr)
     return hdr->th_flags & TH_FIN;
 }
 
+static inline uint16_t tcp_hdr_get_window(const struct tcphdr *hdr)
+{
+    return ntohs(hdr->th_win);
+}
+
+static inline uint16_t tcp_hdr_get_checksum(const struct tcphdr *hdr)
+{
+    return ntohs(hdr->th_sum);
+}
+
+static inline uint16_t tcp_hdr_get_urg_ptr(const struct tcphdr *hdr)
+{
+    return ntohs(hdr->th_urp);
+}
+
+static inline uint16_t tcp_hdr_get_opt_len(const struct tcphdr *hdr)
+{
+    return tcp_hdr_get_doff(hdr) - sizeof(struct tcphdr);
+}
+
+static inline const uint8_t *tcp_hdr_get_opt_ptr(const struct tcphdr *hdr)
+{
+    return ((const uint8_t *)hdr) + sizeof(struct tcphdr);
+}
+
 #ifdef __cpluscplus
 }
 #endif
diff --git a/src/packet/test/CMakeLists.txt b/src/packet/test/CMakeLists.txt
index 4ad5f90..2f5ca4e 100644
--- a/src/packet/test/CMakeLists.txt
+++ b/src/packet/test/CMakeLists.txt
@@ -3,18 +3,26 @@
 ###############################################################################
 
 add_executable(gtest_packet gtest_packet.cpp)
-target_include_directories(gtest_packet PUBLIC ${CMAKE_CURRENT_LIST_DIR})
 target_link_libraries(gtest_packet packet gtest)
 
-add_executable(gtest_packet_helpers gtest_packet_helpers.cpp)
-target_include_directories(gtest_packet_helpers PUBLIC ${CMAKE_CURRENT_LIST_DIR})
-target_link_libraries(gtest_packet_helpers packet gtest)
+add_executable(gtest_udp_helpers gtest_udp_helpers.cpp)
+target_include_directories(gtest_udp_helpers PUBLIC ${CMAKE_SOURCE_DIR}/src/packet)
+target_link_libraries(gtest_udp_helpers gtest)
+
+add_executable(gtest_tcp_helpers gtest_tcp_helpers.cpp)
+target_include_directories(gtest_tcp_helpers PUBLIC ${CMAKE_SOURCE_DIR}/src/packet)
+target_link_libraries(gtest_tcp_helpers gtest)
 
 add_executable(gtest_ipv4_helpers gtest_ipv4_helpers.cpp)
-target_include_directories(gtest_ipv4_helpers PUBLIC ${CMAKE_CURRENT_LIST_DIR})
-target_link_libraries(gtest_ipv4_helpers packet gtest)
+target_include_directories(gtest_ipv4_helpers PUBLIC ${CMAKE_SOURCE_DIR}/src/packet)
+target_link_libraries(gtest_ipv4_helpers gtest)
+
+add_executable(gtest_packet_helpers gtest_packet_helpers.cpp)
+target_link_libraries(gtest_packet_helpers packet gtest)
 
 include(GoogleTest)
 gtest_discover_tests(gtest_packet)
-gtest_discover_tests(gtest_packet_helpers)
-gtest_discover_tests(gtest_ipv4_helpers)
\ No newline at end of file
+gtest_discover_tests(gtest_udp_helpers)
+gtest_discover_tests(gtest_tcp_helpers)
+gtest_discover_tests(gtest_ipv4_helpers)
+gtest_discover_tests(gtest_packet_helpers)
\ No newline at end of file
diff --git a/src/packet/test/gtest_ipv4_helpers.cpp b/src/packet/test/gtest_ipv4_helpers.cpp
index 6f80f94..7bd918c 100644
--- a/src/packet/test/gtest_ipv4_helpers.cpp
+++ b/src/packet/test/gtest_ipv4_helpers.cpp
@@ -27,21 +27,28 @@
  * Data (24 bytes)
  */
 
-unsigned char hdr[] = {0x45, 0x00, 0x00, 0x2c, 0xff, 0xff, 0x20, 0x00, 0x7f, 0x06, 0x4d, 0x8b, 0xc0, 0xa8, 0x24, 0x67, 0xc0, 0xa8, 0x28, 0x89};
+unsigned char data[] = {0x45, 0x00, 0x00, 0x2c, 0xff, 0xff, 0x20, 0x00, 0x7f, 0x06, 0x4d, 0x8b, 0xc0, 0xa8, 0x24, 0x67, 0xc0, 0xa8, 0x28, 0x89};
 
 TEST(IPV4_HELPERS, GET)
 {
-    EXPECT_TRUE(ipv4_hdr_get_ipid((struct ip *)hdr) == 65535);
-    EXPECT_TRUE(ipv4_hdr_get_flags((struct ip *)hdr) == 1);
-    EXPECT_TRUE(ipv4_hdr_get_frag_offset((struct ip *)hdr) == 0);
-    EXPECT_TRUE(ipv4_hdr_get_ttl((struct ip *)hdr) == 127);
-    EXPECT_TRUE(ipv4_hdr_get_protocol((struct ip *)hdr) == 6);
-    EXPECT_TRUE(ipv4_hdr_get_checksum((struct ip *)hdr) == 0x4d8b);
-    EXPECT_TRUE(ipv4_hdr_get_src((struct ip *)hdr) == 0xc0a82467);
-    EXPECT_TRUE(ipv4_hdr_get_dst((struct ip *)hdr) == 0xc0a82889);
-    EXPECT_TRUE(ipv4_hdr_has_flag_rf((struct ip *)hdr) == false);
-    EXPECT_TRUE(ipv4_hdr_has_flag_df((struct ip *)hdr) == false);
-    EXPECT_TRUE(ipv4_hdr_has_flag_mf((struct ip *)hdr) == true);
+    const struct ip *hdr = (struct ip *)data;
+    EXPECT_TRUE(ipv4_hdr_get_version(hdr) == 4);
+    EXPECT_TRUE(ipv4_hdr_get_hl(hdr) == 20);
+    EXPECT_TRUE(ipv4_hdr_get_tos(hdr) == 0);
+    EXPECT_TRUE(ipv4_hdr_get_len(hdr) == 44);
+    EXPECT_TRUE(ipv4_hdr_get_ipid(hdr) == 65535);
+    EXPECT_TRUE(ipv4_hdr_get_flags(hdr) == 1);
+    EXPECT_TRUE(ipv4_hdr_has_flag_rf(hdr) == false);
+    EXPECT_TRUE(ipv4_hdr_has_flag_df(hdr) == false);
+    EXPECT_TRUE(ipv4_hdr_has_flag_mf(hdr) == true);
+    EXPECT_TRUE(ipv4_hdr_get_frag_offset(hdr) == 0);
+    EXPECT_TRUE(ipv4_hdr_get_ttl(hdr) == 127);
+    EXPECT_TRUE(ipv4_hdr_get_protocol(hdr) == 6);
+    EXPECT_TRUE(ipv4_hdr_get_checksum(hdr) == 0x4d8b);
+    EXPECT_TRUE(ipv4_hdr_get_src(hdr) == 0xc0a82467);
+    EXPECT_TRUE(ipv4_hdr_get_dst(hdr) == 0xc0a82889);
+    EXPECT_TRUE(ipv4_hdr_get_opt_len(hdr) == 0);
+    EXPECT_TRUE(ipv4_hdr_get_opt_ptr(hdr) == data + 20);
 }
 
 int main(int argc, char **argv)
diff --git a/src/packet/test/gtest_packet_helpers.cpp b/src/packet/test/gtest_packet_helpers.cpp
index 5007991..d3ba359 100644
--- a/src/packet/test/gtest_packet_helpers.cpp
+++ b/src/packet/test/gtest_packet_helpers.cpp
@@ -48,9 +48,12 @@ TEST(PACKET_UTILS, IPV4_FRAGMENT)
 {
     struct packet handler;
     packet_parse(&handler, (const char *)data1, sizeof(data1));
-
     EXPECT_TRUE(paket_is_fragment(&handler) == true);
-    EXPECT_TRUE(packet_get_layer_count(&handler) == 2);
+
+    struct packet *dup = packet_dup(&handler);
+    EXPECT_TRUE(dup != NULL);
+    EXPECT_TRUE(paket_is_fragment(dup) == true);
+    packet_free(dup);
 }
 #endif
 
@@ -153,9 +156,12 @@ TEST(PACKET_UTILS, IPV6_FRAGMENT)
 {
     struct packet handler;
     packet_parse(&handler, (const char *)data2, sizeof(data2));
-
     EXPECT_TRUE(paket_is_fragment(&handler) == true);
-    EXPECT_TRUE(packet_get_layer_count(&handler) == 2);
+
+    struct packet *dup = packet_dup(&handler);
+    EXPECT_TRUE(dup != NULL);
+    EXPECT_TRUE(paket_is_fragment(dup) == true);
+    packet_free(dup);
 }
 #endif
 
@@ -222,33 +228,16 @@ unsigned char data3[] = {
     0x04, 0x02};
 
 #if 1
-TEST(PACKET_UTILS, ONLY_TCP)
+TEST(PACKET_UTILS, IPV4_IPV6_NOT_FRAGMENT)
 {
     struct packet handler;
     packet_parse(&handler, (const char *)data3, sizeof(data3));
-
     EXPECT_TRUE(paket_is_fragment(&handler) == false);
 
-    // TCP
-    EXPECT_TRUE(packet_has_tcp(&handler));
-    EXPECT_TRUE(packet_get_tcp_sport(&handler) == 52556);
-    EXPECT_TRUE(packet_get_tcp_dport(&handler) == 80);
-    EXPECT_TRUE(packet_get_tcp_seq(&handler) == 2172673142);
-    EXPECT_TRUE(packet_get_tcp_ack(&handler) == 0);
-    EXPECT_TRUE(packet_get_tcp_flags(&handler) == 0x002);
-    EXPECT_TRUE(packet_has_tcp_flag_urg(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_ack(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_psh(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_rst(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_syn(&handler) == true);
-    EXPECT_TRUE(packet_has_tcp_flag_fin(&handler) == false);
-
-    // UDP
-    EXPECT_TRUE(packet_has_udp(&handler) == false);
-    EXPECT_TRUE(packet_get_inner_udp_sport(&handler) == 0);
-    EXPECT_TRUE(packet_get_inner_udp_dport(&handler) == 0);
-    EXPECT_TRUE(packet_get_outer_udp_sport(&handler) == 0);
-    EXPECT_TRUE(packet_get_outer_udp_dport(&handler) == 0);
+    struct packet *dup = packet_dup(&handler);
+    EXPECT_TRUE(dup != NULL);
+    EXPECT_TRUE(paket_is_fragment(dup) == false);
+    packet_free(dup);
 }
 #endif
 
@@ -301,248 +290,15 @@ unsigned char data4[] = {
     0x58, 0x58};
 
 #if 1
-TEST(PACKET_UTILS, ONLY_UDP)
+TEST(PACKET_UTILS, IPV6_IPV6_NOT_FRAGMENT)
 {
     struct packet handler;
     packet_parse(&handler, (const char *)data4, sizeof(data4));
-
-    EXPECT_TRUE(paket_is_fragment(&handler) == false);
-
-    // TCP
-    EXPECT_TRUE(packet_has_tcp(&handler) == false);
-    EXPECT_TRUE(packet_get_tcp_sport(&handler) == 0);
-    EXPECT_TRUE(packet_get_tcp_dport(&handler) == 0);
-    EXPECT_TRUE(packet_get_tcp_seq(&handler) == 0);
-    EXPECT_TRUE(packet_get_tcp_ack(&handler) == 0);
-    EXPECT_TRUE(packet_get_tcp_flags(&handler) == 0);
-    EXPECT_TRUE(packet_has_tcp_flag_urg(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_ack(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_psh(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_rst(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_syn(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_fin(&handler) == false);
-
-    // UDP
-    EXPECT_TRUE(packet_has_udp(&handler));
-    EXPECT_TRUE(packet_get_inner_udp_sport(&handler) == 30000);
-    EXPECT_TRUE(packet_get_inner_udp_dport(&handler) == 13000);
-    EXPECT_TRUE(packet_get_outer_udp_sport(&handler) == 30000);
-    EXPECT_TRUE(packet_get_outer_udp_dport(&handler) == 13000);
-}
-#endif
-
-/******************************************************************************
- * [Protocols in frame: eth:ethertype:ipv6:udp:gtp:ipv6:tcp:ja3:tls]
- ******************************************************************************
- *
- * Frame 1: 1442 bytes on wire (11536 bits), 1442 bytes captured (11536 bits)
- * Ethernet II, Src: zte_0e:f5:40 (74:4a:a4:0e:f5:40), Dst: HuaweiTe_40:e9:c2 (ac:b3:b5:40:e9:c2)
- * 	Destination: HuaweiTe_40:e9:c2 (ac:b3:b5:40:e9:c2)
- * 	Source: zte_0e:f5:40 (74:4a:a4:0e:f5:40)
- * 	Type: IPv6 (0x86dd)
- * Internet Protocol Version 6, Src: 2409:8034:4040:5300::105, Dst: 2409:8034:4025::60:61
- * 	0110 .... = Version: 6
- * 	.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
- * 	.... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
- * 	Payload Length: 1388
- * 	Next Header: UDP (17)
- * 	Hop Limit: 127
- * 	Source Address: 2409:8034:4040:5300::105
- * 	Destination Address: 2409:8034:4025::60:61
- * User Datagram Protocol, Src Port: 2152, Dst Port: 2152
- * 	Source Port: 2152
- * 	Destination Port: 2152
- * 	Length: 1388
- * 	Checksum: 0xeb00 [unverified]
- * 	[Checksum Status: Unverified]
- * 	[Stream index: 0]
- * 	[Timestamps]
- * 	UDP payload (1380 bytes)
- * GPRS Tunneling Protocol
- * 	Flags: 0x30
- * 	Message Type: T-PDU (0xff)
- * 	Length: 1372
- * 	TEID: 0x024c3cbd (38550717)
- * Internet Protocol Version 6, Src: 2409:8c34:4400:700:0:4:0:3, Dst: 2409:8934:5082:2100:ecad:e0e4:530a:c269
- * 	0110 .... = Version: 6
- * 	.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
- * 	.... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
- * 	Payload Length: 1332
- * 	Next Header: TCP (6)
- * 	Hop Limit: 56
- * 	Source Address: 2409:8c34:4400:700:0:4:0:3
- * 	Destination Address: 2409:8934:5082:2100:ecad:e0e4:530a:c269
- * Transmission Control Protocol, Src Port: 443, Dst Port: 46582, Seq: 1, Ack: 1, Len: 1312
- * 	Source Port: 443
- * 	Destination Port: 46582
- * 	[Stream index: 0]
- * 	[Conversation completeness: Incomplete (8)]
- * 	[TCP Segment Len: 1312]
- * 	Sequence Number: 1    (relative sequence number)
- * 	Sequence Number (raw): 2198097831
- * 	[Next Sequence Number: 1313    (relative sequence number)]
- * 	Acknowledgment Number: 1    (relative ack number)
- * 	Acknowledgment number (raw): 2264498872
- * 	0101 .... = Header Length: 20 bytes (5)
- * 	Flags: 0x010 (ACK)
- * 	Window: 529
- * 	[Calculated window size: 529]
- * 	[Window size scaling factor: -1 (unknown)]
- * 	Checksum: 0x2c4b [unverified]
- * 	[Checksum Status: Unverified]
- * 	Urgent Pointer: 0
- * 	[Timestamps]
- * 	[SEQ/ACK analysis]
- * 	TCP payload (1312 bytes)
- * Transport Layer Security
- */
-
-unsigned char data5[] = {
-    0xac, 0xb3, 0xb5, 0x40, 0xe9, 0xc2, 0x74, 0x4a, 0xa4, 0x0e, 0xf5, 0x40, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x05, 0x6c, 0x11, 0x7f, 0x24, 0x09, 0x80, 0x34,
-    0x40, 0x40, 0x53, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x05, 0x24, 0x09, 0x80, 0x34, 0x40, 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x60,
-    0x00, 0x61, 0x08, 0x68, 0x08, 0x68, 0x05, 0x6c, 0xeb, 0x00, 0x30, 0xff, 0x05, 0x5c, 0x02, 0x4c, 0x3c, 0xbd, 0x60, 0x00, 0x00, 0x00, 0x05, 0x34, 0x06, 0x38,
-    0x24, 0x09, 0x8c, 0x34, 0x44, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x24, 0x09, 0x89, 0x34, 0x50, 0x82, 0x21, 0x00, 0xec, 0xad,
-    0xe0, 0xe4, 0x53, 0x0a, 0xc2, 0x69, 0x01, 0xbb, 0xb5, 0xf6, 0x83, 0x04, 0x4f, 0xa7, 0x86, 0xf9, 0x82, 0xb8, 0x50, 0x10, 0x02, 0x11, 0x2c, 0x4b, 0x00, 0x00,
-    0x17, 0x03, 0x03, 0x3c, 0x8c, 0x87, 0xa0, 0x99, 0x23, 0x5b, 0x53, 0x4a, 0x12, 0x1b, 0xf8, 0xba, 0xe8, 0x83, 0xc2, 0x95, 0xda, 0xb8, 0xea, 0x5b, 0xdc, 0x84,
-    0x61, 0xa9, 0x86, 0x7e, 0x43, 0xc7, 0x31, 0x44, 0x6e, 0x11, 0xc1, 0x30, 0x21, 0x03, 0xb4, 0x21, 0x4a, 0xee, 0xc9, 0x2e, 0x14, 0xd2, 0x98, 0x63, 0x12, 0xfe,
-    0x79, 0x58, 0xb3, 0x18, 0xa6, 0x8d, 0x0c, 0x62, 0x67, 0x51, 0xef, 0x02, 0x5a, 0xa8, 0xb3, 0x82, 0x1f, 0xe4, 0x51, 0xba, 0xde, 0xee, 0x83, 0x9c, 0x4e, 0xac,
-    0x4d, 0xa2, 0xb7, 0x6a, 0x82, 0xe7, 0xbb, 0x00, 0xf7, 0x5a, 0xe7, 0x02, 0x71, 0x7e, 0x7d, 0x6f, 0xf2, 0xe5, 0x47, 0xd0, 0xba, 0x3c, 0x51, 0x09, 0x95, 0xcd,
-    0xf6, 0xc9, 0x8b, 0x6f, 0xb0, 0x39, 0x11, 0x0d, 0xe9, 0x0d, 0x4d, 0x29, 0xd4, 0xcb, 0x87, 0xba, 0x11, 0xfa, 0x0d, 0x0b, 0x82, 0x95, 0xa5, 0x84, 0x94, 0x48,
-    0xa2, 0xee, 0xa4, 0xb7, 0xb6, 0x76, 0x13, 0x4d, 0x18, 0x42, 0x91, 0x77, 0xad, 0x82, 0x38, 0xee, 0x34, 0x1c, 0xb7, 0xf6, 0x39, 0xdc, 0xa4, 0x23, 0xa1, 0x7c,
-    0xa5, 0x0b, 0x7e, 0x4c, 0x8b, 0x81, 0x31, 0x48, 0xea, 0xf4, 0x18, 0x37, 0x09, 0x0a, 0x53, 0x13, 0x05, 0x90, 0x26, 0x10, 0x69, 0xb2, 0xa3, 0x36, 0xbc, 0xa5,
-    0x83, 0xd8, 0x16, 0x77, 0x98, 0xc8, 0x21, 0x38, 0xd9, 0x88, 0x0c, 0xa7, 0x16, 0x97, 0x4e, 0x20, 0x6d, 0x68, 0xda, 0x1b, 0x3b, 0x4a, 0x62, 0xe0, 0x36, 0x0d,
-    0xbf, 0x30, 0x71, 0xb1, 0xe9, 0xbe, 0x47, 0x77, 0x99, 0xb9, 0xe6, 0x26, 0xab, 0x81, 0x2e, 0x46, 0xf1, 0x1b, 0x1e, 0xfb, 0xd7, 0x81, 0x60, 0x21, 0x4a, 0x71,
-    0x85, 0xf7, 0x9c, 0x9c, 0xd4, 0x1c, 0x52, 0xc4, 0x3d, 0x8d, 0x72, 0xf6, 0x7c, 0xd3, 0x58, 0x79, 0x0d, 0x78, 0xd7, 0x7c, 0x29, 0x2b, 0xc3, 0x96, 0x1d, 0xc7,
-    0x96, 0x50, 0x42, 0xd7, 0xda, 0xeb, 0x29, 0x8e, 0x2a, 0x72, 0x23, 0x57, 0x0f, 0x6f, 0x37, 0x35, 0xb2, 0x42, 0x76, 0x78, 0xbf, 0xbf, 0x8c, 0x3f, 0x31, 0xa2,
-    0x51, 0xec, 0x9e, 0x0d, 0xfd, 0xf2, 0xaf, 0x71, 0xa0, 0x4f, 0xa9, 0xf6, 0x19, 0xcf, 0x3e, 0x4b, 0xc8, 0xaa, 0x38, 0x06, 0xa1, 0x15, 0xde, 0xde, 0xef, 0x9b,
-    0x25, 0xa3, 0xcc, 0x47, 0xca, 0x29, 0x30, 0x65, 0x5f, 0xc1, 0x8b, 0x12, 0x63, 0x79, 0xcd, 0x57, 0x4d, 0x99, 0xc0, 0xcd, 0xbe, 0x62, 0xcb, 0xc3, 0xf2, 0x6b,
-    0x0b, 0x40, 0xc5, 0xee, 0x79, 0x0a, 0xa4, 0x75, 0x56, 0xe7, 0xe7, 0xf2, 0xfd, 0xe0, 0x72, 0x78, 0x04, 0xa2, 0x50, 0x31, 0x09, 0x8b, 0x57, 0xc3, 0x85, 0x4e,
-    0xc4, 0xae, 0xde, 0x8a, 0xfa, 0xf6, 0x31, 0x06, 0xd2, 0x07, 0x25, 0x40, 0xce, 0x0d, 0xfd, 0x26, 0x98, 0x41, 0xa3, 0xa9, 0xa2, 0x8d, 0x8b, 0x7f, 0x6d, 0x63,
-    0x87, 0x7e, 0x75, 0x2f, 0x78, 0xc9, 0xd5, 0x04, 0xb2, 0x4f, 0xc9, 0x94, 0xa7, 0x7f, 0xbc, 0x75, 0x7b, 0xb6, 0xfb, 0x2c, 0x46, 0xf6, 0xde, 0x36, 0x31, 0x2a,
-    0x32, 0x1d, 0x7f, 0x30, 0x9e, 0x4a, 0x84, 0x69, 0x66, 0xac, 0xef, 0xbe, 0xb3, 0x83, 0x8c, 0xb8, 0x30, 0xd2, 0x3f, 0xcf, 0xb5, 0xbb, 0x65, 0xaa, 0xe7, 0x6b,
-    0x74, 0x48, 0x2c, 0xb2, 0x72, 0x2b, 0x78, 0xaf, 0xd0, 0x71, 0x04, 0xa9, 0xb4, 0x65, 0xd9, 0xfc, 0x74, 0x23, 0xff, 0x89, 0xc1, 0x16, 0x23, 0xac, 0x59, 0x16,
-    0x89, 0x41, 0xc3, 0xdb, 0xdb, 0x5b, 0x9a, 0x3d, 0x08, 0xc4, 0x12, 0x28, 0xf8, 0x10, 0xa5, 0xad, 0xc6, 0x81, 0xc0, 0x61, 0x48, 0xba, 0x9d, 0xef, 0xc7, 0xf8,
-    0xad, 0x9a, 0xbd, 0x87, 0xfa, 0x7f, 0xa2, 0x4e, 0x4d, 0xe0, 0x19, 0xd5, 0x47, 0xc7, 0xd0, 0xfb, 0x00, 0x7b, 0xbf, 0x17, 0x80, 0xfe, 0xf5, 0x27, 0xec, 0x94,
-    0x44, 0x3d, 0x4a, 0x34, 0x49, 0x60, 0xb4, 0x8d, 0x71, 0x6d, 0x9c, 0xf4, 0x4c, 0x33, 0xa9, 0x49, 0x58, 0x58, 0x6f, 0xe1, 0xd1, 0x7d, 0x36, 0x51, 0xf4, 0xd8,
-    0x0d, 0x0b, 0xfc, 0xeb, 0xae, 0x58, 0x06, 0x08, 0xbf, 0x67, 0x07, 0x28, 0x7e, 0x68, 0x65, 0x79, 0x86, 0xfb, 0x43, 0x0f, 0x0a, 0xef, 0xd0, 0x97, 0x33, 0x10,
-    0x7a, 0x20, 0xe8, 0x22, 0xe5, 0xdc, 0x0c, 0xa2, 0xa5, 0x50, 0x1b, 0x08, 0x15, 0xc2, 0xec, 0xd2, 0x06, 0x25, 0xd0, 0x3b, 0xfd, 0xe3, 0xa2, 0x6f, 0x41, 0x15,
-    0x6d, 0x9f, 0x5f, 0xc4, 0x07, 0x5c, 0x99, 0x63, 0xd9, 0xd7, 0xdc, 0x90, 0xc9, 0x8f, 0x3a, 0x4b, 0x6a, 0x84, 0xe8, 0x3c, 0xc7, 0x71, 0x50, 0x71, 0x86, 0x71,
-    0x7d, 0x54, 0x84, 0x7b, 0xb7, 0xca, 0xd5, 0x42, 0xaf, 0x88, 0xa5, 0xae, 0xa4, 0x9c, 0xfd, 0x71, 0x71, 0x0f, 0x67, 0xaa, 0x1b, 0x61, 0xd7, 0xf4, 0x50, 0x21,
-    0x9d, 0x80, 0x6e, 0x54, 0xcd, 0xb6, 0xb9, 0x02, 0x3e, 0x59, 0x50, 0xff, 0xf2, 0xda, 0x21, 0x5c, 0x50, 0x6d, 0x64, 0x8c, 0x33, 0x75, 0x2a, 0xa4, 0x56, 0xb3,
-    0xa8, 0xdb, 0xba, 0xbe, 0x52, 0xd4, 0xe5, 0x29, 0x68, 0xe2, 0x6b, 0x94, 0x6b, 0xb3, 0x90, 0x63, 0x91, 0x1a, 0x95, 0xb5, 0xd7, 0x10, 0x1b, 0xd9, 0x93, 0x4f,
-    0x33, 0xb6, 0x6a, 0x4e, 0xcd, 0x40, 0x9d, 0x47, 0x76, 0x3e, 0x4b, 0xc7, 0x2f, 0x16, 0x96, 0x64, 0x9d, 0x4e, 0x8c, 0xfb, 0x0f, 0xd2, 0xec, 0x6c, 0xba, 0xf2,
-    0x9c, 0xca, 0xd2, 0x3e, 0x64, 0x37, 0x32, 0x20, 0xd7, 0x4c, 0xb0, 0xe7, 0xd3, 0x75, 0x51, 0x3a, 0x94, 0xc1, 0xdf, 0x1c, 0xb3, 0x10, 0xd5, 0x1e, 0xcf, 0x7c,
-    0xb7, 0xab, 0x4a, 0x93, 0xf0, 0x78, 0x58, 0x28, 0x63, 0x10, 0xee, 0xb0, 0xd6, 0x14, 0x81, 0x47, 0xeb, 0x2e, 0xc8, 0x6e, 0x33, 0x7e, 0xf3, 0x2d, 0xc8, 0xdb,
-    0x29, 0x0c, 0x80, 0xe4, 0x2f, 0x10, 0x07, 0x8e, 0x08, 0x86, 0x97, 0x1b, 0x39, 0x98, 0x39, 0x06, 0xb3, 0x85, 0x53, 0xb7, 0xbb, 0x65, 0x65, 0x85, 0x0e, 0x0a,
-    0x7d, 0x29, 0x3d, 0x3f, 0x52, 0xc2, 0x7b, 0x2b, 0x30, 0x94, 0x99, 0x6a, 0x4b, 0xad, 0xe9, 0xec, 0xcb, 0xcd, 0xae, 0x97, 0x45, 0x54, 0xd5, 0x00, 0x5e, 0xd8,
-    0xac, 0xeb, 0x99, 0xdc, 0x58, 0x0b, 0x01, 0xeb, 0x32, 0x22, 0xc4, 0xec, 0x4f, 0xd2, 0x15, 0x03, 0x30, 0x88, 0xc7, 0x28, 0xaf, 0x78, 0xf5, 0x38, 0x84, 0x3b,
-    0x3b, 0xe9, 0x29, 0x71, 0x50, 0xa3, 0x07, 0x49, 0x3b, 0xc6, 0x97, 0xc6, 0xf9, 0x53, 0x95, 0x51, 0x65, 0x7e, 0xd7, 0xd4, 0xe8, 0x76, 0x6a, 0x6d, 0x37, 0x6b,
-    0xa5, 0x59, 0xaa, 0x14, 0x18, 0x8c, 0x8d, 0x65, 0x78, 0x67, 0xfb, 0x60, 0x56, 0xab, 0x04, 0xa0, 0xc2, 0x93, 0x46, 0xf1, 0x2b, 0x0d, 0x3b, 0x38, 0x62, 0x62,
-    0x5e, 0xc8, 0x30, 0xf9, 0x45, 0x28, 0x6f, 0xa1, 0xb1, 0x88, 0xf1, 0x2b, 0x3b, 0xf8, 0xae, 0x91, 0x52, 0xc3, 0x72, 0x86, 0xe4, 0xec, 0xc3, 0x54, 0x86, 0xbf,
-    0x8f, 0x33, 0xb1, 0x0f, 0x42, 0xc5, 0x9c, 0xb8, 0xc2, 0x67, 0x8b, 0xac, 0x78, 0xd7, 0x63, 0xab, 0x05, 0xc6, 0x6c, 0x37, 0xa1, 0x28, 0xef, 0x95, 0xc9, 0xf5,
-    0x12, 0x38, 0x54, 0x34, 0x2e, 0x03, 0x6a, 0xaa, 0xa9, 0x97, 0x72, 0x22, 0x9f, 0x20, 0xec, 0x9e, 0x29, 0x09, 0xd8, 0x38, 0xd1, 0x86, 0x82, 0x99, 0xbd, 0x2a,
-    0x03, 0xe9, 0x3d, 0xbd, 0xea, 0xc5, 0x8b, 0xb0, 0x4c, 0x8b, 0x7e, 0x78, 0x08, 0xef, 0x39, 0xa8, 0xb4, 0x47, 0xce, 0x44, 0xc3, 0x3f, 0x52, 0xe4, 0xbd, 0x9e,
-    0xf6, 0xed, 0x6f, 0x6c, 0x05, 0x19, 0xa6, 0x0a, 0x1e, 0x48, 0xe3, 0x9b, 0x91, 0x61, 0xef, 0xf5, 0x91, 0x39, 0x70, 0x44, 0x1c, 0x08, 0x2e, 0x2c, 0x6c, 0x27,
-    0xb9, 0x0e, 0xcc, 0x74, 0x69, 0xa5, 0xf8, 0x19, 0xd6, 0xbf, 0x57, 0x6c, 0x9a, 0x91, 0x74, 0xfd, 0xc2, 0x31, 0x32, 0x12, 0x06, 0xa3, 0x69, 0x71, 0xda, 0x40,
-    0xa1, 0xf3, 0xb5, 0x9a, 0x43, 0xcc, 0xb4, 0x3c, 0x16, 0x40, 0x65, 0x2b, 0x02, 0xac, 0x5c, 0xae, 0xd6, 0x34, 0x34, 0xe3, 0x69, 0x76, 0x2c, 0xa8, 0xdd, 0x04,
-    0x92, 0xa6, 0x7a, 0xc0, 0x87, 0x70, 0x8b, 0x85, 0xba, 0x5d, 0xbb, 0x62, 0x70, 0xcc, 0x1f, 0x21, 0x2c, 0x7e, 0xc3, 0x77, 0xcf, 0x23, 0x22, 0xf4, 0x16, 0x8e,
-    0xf1, 0x3d, 0xdc, 0x33, 0x99, 0x5e, 0xaa, 0xa2, 0x50, 0x68, 0xde, 0x03, 0x44, 0xbb, 0xc7, 0x16, 0x2a, 0xf2, 0x08, 0xeb, 0x3d, 0x12, 0x6d, 0xcb, 0x2a, 0xaf,
-    0xb4, 0x79, 0xdb, 0x74, 0x5e, 0x54, 0x89, 0x73, 0x0c, 0x48, 0x9c, 0x03, 0x33, 0xd2, 0x92, 0x22, 0xdb, 0x3a, 0xa0, 0x8c, 0xe2, 0x30, 0x6f, 0x39, 0xe4, 0xa9,
-    0x24, 0x04, 0xbb, 0x85, 0x7d, 0x62, 0xc5, 0xa9, 0x98, 0x92, 0xef, 0xc6, 0xc8, 0xd1, 0x81, 0xad, 0x95, 0x40, 0x27, 0x09, 0xc7, 0x43, 0xcd, 0xb6, 0x94, 0xfc,
-    0x1c, 0x7d, 0x1c, 0xd3, 0x47, 0xfe, 0x62, 0x9c, 0xfa, 0xeb, 0xfc, 0x02, 0x2e, 0x48, 0x62, 0xcf, 0x63, 0xdb, 0x63, 0xd9, 0x21, 0x86, 0xe8, 0x96, 0x54, 0xeb,
-    0x6a, 0xa8, 0x78, 0x3c, 0x5b, 0xb6, 0xde, 0xa9, 0x04, 0x48, 0x63, 0xb2, 0x10, 0x02, 0x6a, 0x7f, 0x6d, 0xc8, 0x04, 0xdd, 0x99, 0x25, 0x08, 0xff, 0x80, 0x11,
-    0x53, 0xfb, 0x7a, 0x07, 0x39, 0xd9, 0x97, 0xca, 0xf0, 0xa7, 0x46, 0x9c, 0xc2, 0xae, 0x2e, 0x05, 0x62, 0xa0, 0xd5, 0x5d, 0x17, 0x0e, 0x5c, 0x7e, 0x9a, 0xb2,
-    0xb7, 0x9d, 0xd4, 0x4f, 0xe3, 0xac, 0x64, 0xdb, 0x6f, 0x1d, 0xdf, 0xd8, 0x41, 0xd7, 0xd9, 0x50, 0x55, 0x30, 0xeb, 0x4b, 0x19, 0xce, 0x78, 0x1f, 0xa8, 0x1e,
-    0x87, 0x9c, 0x8f, 0x93, 0x97, 0xd4, 0xa2, 0x28, 0x2c, 0x79, 0x22, 0xc8};
-
-#if 1
-TEST(PACKET_UTILS, UDP_AND_TCP)
-{
-    struct packet handler;
-    packet_parse(&handler, (const char *)data5, sizeof(data5));
-
-    // IP
-    EXPECT_TRUE(paket_is_fragment(&handler) == false);
-
-    // TCP
-    EXPECT_TRUE(packet_has_tcp(&handler) == true);
-    EXPECT_TRUE(packet_get_tcp_sport(&handler) == 443);
-    EXPECT_TRUE(packet_get_tcp_dport(&handler) == 46582);
-    EXPECT_TRUE(packet_get_tcp_seq(&handler) == 2198097831);
-    EXPECT_TRUE(packet_get_tcp_ack(&handler) == 2264498872);
-    EXPECT_TRUE(packet_get_tcp_flags(&handler) == 0x10);
-    EXPECT_TRUE(packet_has_tcp_flag_urg(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_ack(&handler) == true);
-    EXPECT_TRUE(packet_has_tcp_flag_psh(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_rst(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_syn(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_fin(&handler) == false);
-
-    // UDP
-    EXPECT_TRUE(packet_has_udp(&handler) == true);
-    EXPECT_TRUE(packet_get_inner_udp_sport(&handler) == 2152);
-    EXPECT_TRUE(packet_get_inner_udp_dport(&handler) == 2152);
-    EXPECT_TRUE(packet_get_outer_udp_sport(&handler) == 2152);
-    EXPECT_TRUE(packet_get_outer_udp_dport(&handler) == 2152);
-}
-#endif
-
-#if 1
-TEST(PACKET_UTILS, PACKET_DUP)
-{
-    struct packet handler;
-    packet_parse(&handler, (const char *)data5, sizeof(data5));
-
-    // IP
     EXPECT_TRUE(paket_is_fragment(&handler) == false);
 
-    // TCP
-    EXPECT_TRUE(packet_has_tcp(&handler) == true);
-    EXPECT_TRUE(packet_get_tcp_sport(&handler) == 443);
-    EXPECT_TRUE(packet_get_tcp_dport(&handler) == 46582);
-    EXPECT_TRUE(packet_get_tcp_seq(&handler) == 2198097831);
-    EXPECT_TRUE(packet_get_tcp_ack(&handler) == 2264498872);
-    EXPECT_TRUE(packet_get_tcp_flags(&handler) == 0x10);
-    EXPECT_TRUE(packet_has_tcp_flag_urg(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_ack(&handler) == true);
-    EXPECT_TRUE(packet_has_tcp_flag_psh(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_rst(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_syn(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_fin(&handler) == false);
-
-    // UDP
-    EXPECT_TRUE(packet_has_udp(&handler) == true);
-    EXPECT_TRUE(packet_get_inner_udp_sport(&handler) == 2152);
-    EXPECT_TRUE(packet_get_inner_udp_dport(&handler) == 2152);
-    EXPECT_TRUE(packet_get_outer_udp_sport(&handler) == 2152);
-    EXPECT_TRUE(packet_get_outer_udp_dport(&handler) == 2152);
-
     struct packet *dup = packet_dup(&handler);
-
-    // IP
-    EXPECT_TRUE(paket_is_fragment(&handler) == false);
-
-    // TCP
-    EXPECT_TRUE(packet_has_tcp(&handler) == true);
-    EXPECT_TRUE(packet_get_tcp_sport(&handler) == 443);
-    EXPECT_TRUE(packet_get_tcp_dport(&handler) == 46582);
-    EXPECT_TRUE(packet_get_tcp_seq(&handler) == 2198097831);
-    EXPECT_TRUE(packet_get_tcp_ack(&handler) == 2264498872);
-    EXPECT_TRUE(packet_get_tcp_flags(&handler) == 0x10);
-    EXPECT_TRUE(packet_has_tcp_flag_urg(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_ack(&handler) == true);
-    EXPECT_TRUE(packet_has_tcp_flag_psh(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_rst(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_syn(&handler) == false);
-    EXPECT_TRUE(packet_has_tcp_flag_fin(&handler) == false);
-
-    // UDP
-    EXPECT_TRUE(packet_has_udp(&handler) == true);
-    EXPECT_TRUE(packet_get_inner_udp_sport(&handler) == 2152);
-    EXPECT_TRUE(packet_get_inner_udp_dport(&handler) == 2152);
-    EXPECT_TRUE(packet_get_outer_udp_sport(&handler) == 2152);
-    EXPECT_TRUE(packet_get_outer_udp_dport(&handler) == 2152);
-
+    EXPECT_TRUE(dup != NULL);
+    EXPECT_TRUE(paket_is_fragment(dup) == false);
     packet_free(dup);
 }
 #endif
diff --git a/src/packet/test/gtest_tcp_helpers.cpp b/src/packet/test/gtest_tcp_helpers.cpp
new file mode 100644
index 0000000..bd49a56
--- /dev/null
+++ b/src/packet/test/gtest_tcp_helpers.cpp
@@ -0,0 +1,103 @@
+#include <gtest/gtest.h>
+
+#include "tcp_helpers.h"
+
+/*
+ * Transmission Control Protocol, Src Port: 55555, Dst Port: 40856, Seq: 0, Ack: 1, Len: 0
+ *     Source Port: 55555
+ *     Destination Port: 40856
+ *     [Stream index: 0]
+ *     [Conversation completeness: Complete, WITH_DATA (31)]
+ *     [TCP Segment Len: 0]
+ *     Sequence Number: 0    (relative sequence number)
+ *     Sequence Number (raw): 3965699644
+ *     [Next Sequence Number: 1    (relative sequence number)]
+ *     Acknowledgment Number: 1    (relative ack number)
+ *     Acknowledgment number (raw): 991053714
+ *     1010 .... = Header Length: 40 bytes (10)
+ *     Flags: 0x012 (SYN, ACK)
+ *         000. .... .... = Reserved: Not set
+ *         ...0 .... .... = Accurate ECN: Not set
+ *         .... 0... .... = Congestion Window Reduced: Not set
+ *         .... .0.. .... = ECN-Echo: Not set
+ *         .... ..0. .... = Urgent: Not set
+ *         .... ...1 .... = Acknowledgment: Set
+ *         .... .... 0... = Push: Not set
+ *         .... .... .0.. = Reset: Not set
+ *         .... .... ..1. = Syn: Set
+ *             [Expert Info (Chat/Sequence): Connection establish acknowledge (SYN+ACK): server port 55555]
+ *                 [Connection establish acknowledge (SYN+ACK): server port 55555]
+ *                 [Severity level: Chat]
+ *                 [Group: Sequence]
+ *         .... .... ...0 = Fin: Not set
+ *         [TCP Flags: ·······A··S·]
+ *     Window: 43690
+ *     [Calculated window size: 43690]
+ *     Checksum: 0xfe30 incorrect, should be 0x65c9(maybe caused by "TCP checksum offload"?)
+ *         [Expert Info (Error/Checksum): Bad checksum [should be 0x65c9]]
+ *             [Bad checksum [should be 0x65c9]]
+ *             [Severity level: Error]
+ *             [Group: Checksum]
+ *     [Checksum Status: Bad]
+ *     [Calculated Checksum: 0x65c9]
+ *     Urgent Pointer: 0
+ *     Options: (20 bytes), Maximum segment size, SACK permitted, Timestamps, No-Operation (NOP), Window scale
+ *         TCP Option - Maximum segment size: 65495 bytes
+ *             Kind: Maximum Segment Size (2)
+ *             Length: 4
+ *             MSS Value: 65495
+ *         TCP Option - SACK permitted
+ *             Kind: SACK Permitted (4)
+ *             Length: 2
+ *         TCP Option - Timestamps
+ *             Kind: Time Stamp Option (8)
+ *             Length: 10
+ *             Timestamp value: 2767168460: TSval 2767168460, TSecr 2767168460
+ *             Timestamp echo reply: 2767168460
+ *         TCP Option - No-Operation (NOP)
+ *             Kind: No-Operation (1)
+ *         TCP Option - Window scale: 7 (multiply by 128)
+ *             Kind: Window Scale (3)
+ *             Length: 3
+ *             Shift count: 7
+ *             [Multiplier: 128]
+ *     [Timestamps]
+ *         [Time since first frame in this TCP stream: 475471172.552028000 seconds]
+ *         [Time since previous frame in this TCP stream: 475471172.552028000 seconds]
+ *     [SEQ/ACK analysis]
+ *         [This is an ACK to the segment in frame: 1]
+ *         [The RTT to ACK the segment was: 475471172.552028000 seconds]
+ *         [iRTT: 0.000039000 seconds]
+ */
+
+unsigned char data[] = {
+    0xd9, 0x03, 0x9f, 0x98, 0xec, 0x5f, 0xc6, 0x3c, 0x3b, 0x12, 0x47, 0x92, 0xa0, 0x12, 0xaa, 0xaa, 0xfe, 0x30, 0x00, 0x00, 0x02, 0x04, 0xff, 0xd7, 0x04, 0x02,
+    0x08, 0x0a, 0xa4, 0xef, 0xa3, 0xcc, 0xa4, 0xef, 0xa3, 0xcc, 0x01, 0x03, 0x03, 0x07};
+
+TEST(TCP_HELPERS, GET)
+{
+    const struct tcphdr *hdr = (struct tcphdr *)data;
+    EXPECT_TRUE(tcp_hdr_get_sport(hdr) == 55555);
+    EXPECT_TRUE(tcp_hdr_get_dport(hdr) == 40856);
+    EXPECT_TRUE(tcp_hdr_get_seq(hdr) == 3965699644);
+    EXPECT_TRUE(tcp_hdr_get_ack(hdr) == 991053714);
+    EXPECT_TRUE(tcp_hdr_get_doff(hdr) == 40);
+    EXPECT_TRUE(tcp_hdr_get_flags(hdr) == 0x012);
+    EXPECT_TRUE(tcp_hdr_has_flag_urg(hdr) == false);
+    EXPECT_TRUE(tcp_hdr_has_flag_ack(hdr) == true);
+    EXPECT_TRUE(tcp_hdr_has_flag_psh(hdr) == false);
+    EXPECT_TRUE(tcp_hdr_has_flag_rst(hdr) == false);
+    EXPECT_TRUE(tcp_hdr_has_flag_syn(hdr) == true);
+    EXPECT_TRUE(tcp_hdr_has_flag_fin(hdr) == false);
+    EXPECT_TRUE(tcp_hdr_get_window(hdr) == 43690);
+    EXPECT_TRUE(tcp_hdr_get_checksum(hdr) == 0xfe30);
+    EXPECT_TRUE(tcp_hdr_get_urg_ptr(hdr) == 0);
+    EXPECT_TRUE(tcp_hdr_get_opt_len(hdr) == 20);
+    EXPECT_TRUE(tcp_hdr_get_opt_ptr(hdr) == data + 20);
+}
+
+int main(int argc, char **argv)
+{
+    ::testing::InitGoogleTest(&argc, argv);
+    return RUN_ALL_TESTS();
+}
diff --git a/src/packet/test/gtest_udp_helpers.cpp b/src/packet/test/gtest_udp_helpers.cpp
new file mode 100644
index 0000000..3be02b0
--- /dev/null
+++ b/src/packet/test/gtest_udp_helpers.cpp
@@ -0,0 +1,30 @@
+#include <gtest/gtest.h>
+
+#include "udp_helpers.h"
+
+/*
+ * User Datagram Protocol, Src Port: 4001, Dst Port: 8000
+ *     Source Port: 4001
+ *     Destination Port: 8000
+ *     Length: 155
+ *     Checksum: 0x1e1e [correct]
+ *         [Calculated Checksum: 0x1e1e]
+ *     [Checksum Status: Good]
+ */
+
+unsigned char data[] = {0x0f, 0xa1, 0x1f, 0x40, 0x00, 0x9b, 0x1e, 0x1e};
+
+TEST(UDP_HELPERS, GET)
+{
+    const struct udphdr *hdr = (struct udphdr *)data;
+    EXPECT_TRUE(udp_hdr_get_sport(hdr) == 4001);
+    EXPECT_TRUE(udp_hdr_get_dport(hdr) == 8000);
+    EXPECT_TRUE(udp_hdr_get_len(hdr) == 155);
+    EXPECT_TRUE(udp_hdr_get_checksum(hdr) == 0x1e1e);
+}
+
+int main(int argc, char **argv)
+{
+    ::testing::InitGoogleTest(&argc, argv);
+    return RUN_ALL_TESTS();
+}
diff --git a/src/packet/udp_helpers.h b/src/packet/udp_helpers.h
index 80f03e2..88b9d35 100644
--- a/src/packet/udp_helpers.h
+++ b/src/packet/udp_helpers.h
@@ -10,6 +10,20 @@ extern "C"
 #define __FAVOR_BSD 1
 #include <netinet/udp.h>
 
+/*
+ * User Datagram Header Format
+ *
+ *   0                   1                   2                   3
+ *   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |          Source Port          |       Destination Port        |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |           Length              |         Checksum              |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ *  |                             Data                              |
+ *  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ */
+
 static inline uint16_t udp_hdr_get_sport(const struct udphdr *hdr)
 {
     return ntohs(hdr->uh_sport);
@@ -20,6 +34,16 @@ static inline uint16_t udp_hdr_get_dport(const struct udphdr *hdr)
     return ntohs(hdr->uh_dport);
 }
 
+static inline uint16_t udp_hdr_get_len(const struct udphdr *hdr)
+{
+    return ntohs(hdr->uh_ulen);
+}
+
+static inline uint16_t udp_hdr_get_checksum(const struct udphdr *hdr)
+{
+    return ntohs(hdr->uh_sum);
+}
+
 #ifdef __cpluscplus
 }
 #endif
diff --git a/src/session/session_manager.cpp b/src/session/session_manager.cpp
index e663ac5..7ac2fac 100644
--- a/src/session/session_manager.cpp
+++ b/src/session/session_manager.cpp
@@ -386,7 +386,13 @@ static void update_udp_ex_data(struct session *sess, const struct packet *pkt, e
 // return -1: tcp not syn packet, discard
 static int handle_tcp_new_session(struct session_manager *mgr, struct tuple6 *key, struct session *sess, const struct packet *pkt)
 {
-     const struct tcphdr *hdr = (const struct tcphdr *)packet_get_tcp_hdr_ptr(pkt);
+     const struct layer_record *tcp_layer = packet_get_innermost_layer(pkt, LAYER_TYPE_TCP);
+     if (tcp_layer == NULL)
+     {
+          // not tcp packet, discard
+          return -1;
+     }
+     const struct tcphdr *hdr = (const struct tcphdr *)tcp_layer->hdr_ptr;
      if (!tcp_hdr_has_flag_syn(hdr))
      {
           // not syn packet, discard
diff --git a/src/session/test/CMakeLists.txt b/src/session/test/CMakeLists.txt
index b8ec5b6..1438b24 100644
--- a/src/session/test/CMakeLists.txt
+++ b/src/session/test/CMakeLists.txt
@@ -3,27 +3,21 @@
 ###############################################################################
 
 add_executable(gtest_session gtest_session.cpp)
-target_include_directories(gtest_session PUBLIC ${CMAKE_CURRENT_LIST_DIR})
 target_link_libraries(gtest_session session_manager gtest)
 
 add_executable(gtest_session_pool gtest_session_pool.cpp)
-target_include_directories(gtest_session_pool PUBLIC ${CMAKE_CURRENT_LIST_DIR})
 target_link_libraries(gtest_session_pool session_manager gtest)
 
 add_executable(gtest_session_table gtest_session_table.cpp)
-target_include_directories(gtest_session_table PUBLIC ${CMAKE_CURRENT_LIST_DIR})
 target_link_libraries(gtest_session_table session_manager gtest)
 
 add_executable(gtest_session_timer gtest_session_timer.cpp)
-target_include_directories(gtest_session_timer PUBLIC ${CMAKE_CURRENT_LIST_DIR})
 target_link_libraries(gtest_session_timer session_manager gtest)
 
 add_executable(gtest_session_queue gtest_session_queue.cpp)
-target_include_directories(gtest_session_queue PUBLIC ${CMAKE_CURRENT_LIST_DIR})
 target_link_libraries(gtest_session_queue session_manager gtest)
 
 add_executable(gtest_session_manager gtest_session_manager.cpp)
-target_include_directories(gtest_session_manager PUBLIC ${CMAKE_CURRENT_LIST_DIR})
 target_link_libraries(gtest_session_manager session_manager gtest)
 
 include(GoogleTest)
diff --git a/src/timestamp/test/CMakeLists.txt b/src/timestamp/test/CMakeLists.txt
index 6e148b6..705ebe0 100644
--- a/src/timestamp/test/CMakeLists.txt
+++ b/src/timestamp/test/CMakeLists.txt
@@ -3,7 +3,6 @@
 ###############################################################################
 
 add_executable(gtest_timestamp gtest_timestamp.cpp)
-target_include_directories(gtest_timestamp PUBLIC ${CMAKE_CURRENT_LIST_DIR})
 target_link_libraries(gtest_timestamp timestamp gtest)
 
 include(GoogleTest)
diff --git a/src/tuple/test/CMakeLists.txt b/src/tuple/test/CMakeLists.txt
index 721d157..8042501 100644
--- a/src/tuple/test/CMakeLists.txt
+++ b/src/tuple/test/CMakeLists.txt
@@ -3,7 +3,6 @@
 ###############################################################################
 
 add_executable(gtest_tuple gtest_tuple.cpp)
-target_include_directories(gtest_tuple PUBLIC ${CMAKE_CURRENT_LIST_DIR})
 target_link_libraries(gtest_tuple tuple gtest)
 
 include(GoogleTest)