TFE Packet IO支持带封装报文格式v4.8.20-20230602

14 files changed, 1569 insertions, 148 deletions

diff --git a/common/CMakeLists.txt b/common/CMakeLists.txt
index 4b4253d..4190122 100644
--- a/common/CMakeLists.txt
+++ b/common/CMakeLists.txt
@@ -16,15 +16,4 @@ if (SUPPORT_LIBURING)
     target_link_libraries(common PUBLIC uring)
 endif()
 
-### UNITTEST CASE
-add_executable(test-addr test/test_addr.cpp src/tfe_types.cpp src/tfe_utils.cpp)
-target_include_directories(test-addr PRIVATE include)
-target_link_libraries(test-addr PRIVATE gtest MESA_handle_logger)
-
-include(GoogleTest)
-gtest_discover_tests(test-addr)
-
-### test_cmsg
-add_executable(test_cmsg test/test_cmsg.cpp)
-target_include_directories(test_cmsg PRIVATE include)
-target_link_libraries(test_cmsg PRIVATE common)
+add_subdirectory(test)
diff --git a/common/include/tfe_ctrl_packet.h b/common/include/tfe_ctrl_packet.h
index c8a3777..9c6fb14 100644
--- a/common/include/tfe_ctrl_packet.h
+++ b/common/include/tfe_ctrl_packet.h
@@ -32,6 +32,13 @@ struct ctrl_pkt_parser
     struct route_ctx seq_route_ctx;
     struct sids ack_sids;
     struct route_ctx ack_route_ctx;
+    char *seq_header;
+    int seq_len;
+    char *ack_header;
+    int ack_len;
+    // 0x01 is_single
+    // 0x02 is_tunnel
+    uint8_t intercpet_data;
 };
 
 const char *session_state_to_string(enum session_state state);
diff --git a/common/include/tfe_fieldstat.h b/common/include/tfe_fieldstat.h
index 1126feb..33826ef 100644
--- a/common/include/tfe_fieldstat.h
+++ b/common/include/tfe_fieldstat.h
@@ -38,7 +38,7 @@ struct tfe_fieldstat_metric_t
     struct fieldstat_dynamic_instance *instance;
 };
 
-void tfe_set_intercept_metric(struct tfe_stream *stream, int hit_count, int downstream_rx_pkts, int downstream_rx_bytes, int upstream_rx_pkts, int upstream_rx_bytes);
+void tfe_set_intercept_metric(struct tfe_cmsg *cmsg, int hit_count, int downstream_rx_pkts, int downstream_rx_bytes, int upstream_rx_pkts, int upstream_rx_bytes, int thread_id);
 int tfe_fieldstat_metric_incrby(struct tfe_fieldstat_metric_t *fieldstat, unsigned int column_id, long long value, const struct fieldstat_tag tags[], int n_tags, int thread_id);
 struct tfe_fieldstat_metric_t *tfe_fieldstat_metric_create(char *telegraf_ip, int telegraf_port, char *app_name, int cycle, int max_thread, void *local_logger);
 void tfe_fieldstat_metric_destroy(struct tfe_fieldstat_metric_t *fieldstat);
diff --git a/common/include/tfe_packet_io.h b/common/include/tfe_packet_io.h
index 23c3bde..9edf481 100644
--- a/common/include/tfe_packet_io.h
+++ b/common/include/tfe_packet_io.h
@@ -7,6 +7,7 @@ extern "C"
 #endif
 
 #include "tfe_addr_tuple4.h"
+#include "tfe_packet_io_fs.h"
 
 struct tap_ctx
 {
@@ -50,12 +51,16 @@ struct packet_info
 
     char *header_data;
     int header_len;
+    int is_ipv4;
+
+    struct throughput_metrics rx;
 };
 
 struct session_ctx
 {
     int policy_ids;
     uint64_t session_id;
+    uint8_t is_passthrough;
     char *session_addr;
 
     char client_mac[6];
diff --git a/common/include/tfe_raw_packet.h b/common/include/tfe_raw_packet.h
index 91f75ff..f88684c 100644
--- a/common/include/tfe_raw_packet.h
+++ b/common/include/tfe_raw_packet.h
@@ -92,6 +92,9 @@ int raw_packet_parser_get_most_outer_address(struct raw_pkt_parser *handler, str
 
 uint64_t raw_packet_parser_get_hash_value(struct raw_pkt_parser *handler, enum ldbc_method method, int dir_is_internal, void *logger);
 
+
+int raw_traffic_decapsulate(struct raw_pkt_parser *handler, char *raw_data, int raw_len, char **output, int *out_len, int *is_ipv4);
+
 #ifdef __cpluscplus
 }
 #endif
diff --git a/common/src/io_uring.cpp b/common/src/io_uring.cpp
index e9af2f4..4066ce1 100644
--- a/common/src/io_uring.cpp
+++ b/common/src/io_uring.cpp
@@ -224,7 +224,7 @@ int io_uring_submit_write_entry(struct io_uring_instance *instance, const char *
 
     if (len > instance->config.buff_size)
     {
-        TFE_LOG_ERROR(g_default_logger, "IO_URING: the length of the sent data is greater than the capacity of the io_uring buffer");
+        TFE_LOG_ERROR(g_default_logger, "IO_URING: the length of the sent data [%d] is greater than the capacity of the io_uring buffer [%d]", len, instance->config.buff_size);
         return -1;
     }
 
diff --git a/common/src/tfe_ctrl_packet.cpp b/common/src/tfe_ctrl_packet.cpp
index c9bd977..b86d276 100644
--- a/common/src/tfe_ctrl_packet.cpp
+++ b/common/src/tfe_ctrl_packet.cpp
@@ -29,6 +29,8 @@ enum {
     MPACK_ARRAY_ACK_SIDS,
     MPACK_ARRAY_SEQ_ROUTE_CTX,
     MPACK_ARRAY_ACK_ROUTE_CTX,
+    MPACK_ARRAY_SEQ_PKG_HEADER,
+    MPACK_ARRAY_ACK_PKG_HEADER,
 };
 
 struct mpack_mmap_id2type
@@ -74,9 +76,14 @@ struct mpack_mmap_id2type
     {.id = 32, .type = TFE_CMSG_TLV_NR_MAX, .str_name = "TFE_SEQ_SIDS", .size = 2, .array_index = MPACK_ARRAY_SEQ_SIDS},
     {.id = 33, .type = TFE_CMSG_TLV_NR_MAX, .str_name = "TFE_ACK_SIDS", .size = 2, .array_index = MPACK_ARRAY_ACK_SIDS},
     {.id = 34, .type = TFE_CMSG_TLV_NR_MAX, .str_name = "TFE_SEQ_ROUTE_CTX", .size = 1, .array_index = MPACK_ARRAY_SEQ_ROUTE_CTX},
-    {.id = 35, .type = TFE_CMSG_TLV_NR_MAX, .str_name = "TFE_ACK_ROUTE_CTX", .size = 1, .array_index = MPACK_ARRAY_ACK_ROUTE_CTX}
+    {.id = 35, .type = TFE_CMSG_TLV_NR_MAX, .str_name = "TFE_ACK_ROUTE_CTX", .size = 1, .array_index = MPACK_ARRAY_ACK_ROUTE_CTX},
+    {.id = 36, .type = TFE_CMSG_TLV_NR_MAX, .str_name = "TFE_SEQ_PKG_HEADER", .size = 1, .array_index = MPACK_ARRAY_SEQ_PKG_HEADER},
+    {.id = 37, .type = TFE_CMSG_TLV_NR_MAX, .str_name = "TFE_ACK_PKG_HEADER", .size = 1, .array_index = MPACK_ARRAY_ACK_PKG_HEADER},
+    {.id = 38, .type = TFE_CMSG_TLV_NR_MAX, .str_name = "TFE_FLAG", .size = 1, .array_index = MPACK_ARRAY_INIT}
 };
 
+extern void * g_packet_io_logger;
+
 static int fqdn_id_set_cmsg(struct ctrl_pkt_parser *handler, mpack_node_t node, int table_index)
 {
     char empty_str[4] = {0};
@@ -114,15 +121,33 @@ static int sids_array_parse_mpack(struct ctrl_pkt_parser *handler, mpack_node_t
 static int route_ctx_parse_mpack(struct ctrl_pkt_parser *handler, mpack_node_t node, int table_index, int is_seq)
 {
     struct route_ctx *ctx = is_seq ? &handler->seq_route_ctx : &handler->ack_route_ctx;
-    if (mpack_node_array_length(node) > 64) {
+    size_t len = mpack_node_bin_size(node);
+    if (len < 0 || len > 64) {
+        TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (%s route len[%ld] is invalid)", LOG_TAG_CTRLPKT, handler->session_id, is_seq ? "seq" : "ack", len);
         return -1;
     }
 
-    ctx->len = mpack_node_array_length(node);
-    for (int i = 0; i < ctx->len; i++)
-    {
-        ctx->data[i] = mpack_node_u8(mpack_node_array_at(node, i));
+    ctx->len = len;
+    memcpy(ctx->data, mpack_node_bin_data(node), len);
+    return 0;
+}
+
+static int pkt_header_parse_mpack(struct ctrl_pkt_parser *handler, mpack_node_t node, int table_index, int is_seq)
+{
+    char **header = is_seq ? &handler->seq_header : &handler->ack_header;
+    int *header_len = is_seq ? &handler->seq_len : &handler->ack_len;
+    size_t len = mpack_node_bin_size(node);
+    if (len < 0) {
+        TFE_LOG_ERROR(g_packet_io_logger, "%s: session %lu unexpected control packet: (%s package header len[%ld] is invalid)", LOG_TAG_CTRLPKT, handler->session_id, is_seq ? "seq" : "ack", len);
+        return -1;
     }
+
+    if (len == 0)
+        return 0;
+
+    *header = (char *)calloc(len, sizeof(char));
+    memcpy(*header, mpack_node_bin_data(node), len);
+    *header_len = len;
     return 0;
 }
 
@@ -155,8 +180,13 @@ static int proxy_parse_messagepack(mpack_node_t node, void *ctx, void *logger)
         
         switch (mpack_node_type(ptr)) {
             case mpack_type_uint:
-                value = mpack_node_u64(ptr);
-                tfe_cmsg_set(handler->cmsg, mpack_table[i].type, (const unsigned char *)&value, mpack_table[i].size);
+                if (i == 38) {
+                    handler->intercpet_data = mpack_node_u8(ptr);
+                }
+                else {
+                    value = mpack_node_u64(ptr);
+                    tfe_cmsg_set(handler->cmsg, mpack_table[i].type, (const unsigned char *)&value, mpack_table[i].size);
+                }
                 break;
             case mpack_type_str:
                 mpack_node_copy_cstr(ptr, cmsg_str, sizeof(cmsg_str));
@@ -165,6 +195,33 @@ static int proxy_parse_messagepack(mpack_node_t node, void *ctx, void *logger)
             case mpack_type_nil:
                 tfe_cmsg_set(handler->cmsg, mpack_table[i].type, (const unsigned char *)empty_str, 0);
                 break;
+            case mpack_type_bin:
+                switch(mpack_table[i].array_index)
+                {
+                    case MPACK_ARRAY_SEQ_ROUTE_CTX:
+                        ret = route_ctx_parse_mpack(handler, ptr, i, 1);
+                        if (ret != 0)
+                            return -1;
+                        break;
+                    case MPACK_ARRAY_ACK_ROUTE_CTX:
+                        ret = route_ctx_parse_mpack(handler, ptr, i, 0);
+                        if (ret != 0)
+                            return -1;
+                        break;
+                    case MPACK_ARRAY_SEQ_PKG_HEADER:
+                        ret = pkt_header_parse_mpack(handler, ptr, i, 1);
+                        if (ret != 0)
+                            return -1;
+                        break;
+                    case MPACK_ARRAY_ACK_PKG_HEADER:
+                        ret = pkt_header_parse_mpack(handler, ptr, i, 0);
+                        if (ret != 0)
+                            return -1;
+                        break;
+                    default:
+                        break;
+                }
+                break;
             case mpack_type_array:
                 switch(mpack_table[i].array_index)
                 {
@@ -181,16 +238,6 @@ static int proxy_parse_messagepack(mpack_node_t node, void *ctx, void *logger)
                         if (ret != 0)
                             return -1;
                         break;
-                    case MPACK_ARRAY_SEQ_ROUTE_CTX:
-                        ret = route_ctx_parse_mpack(handler, ptr, i, 1);
-                        if (ret != 0)
-                            return -1;
-                        break;
-                    case MPACK_ARRAY_ACK_ROUTE_CTX:
-                        ret = route_ctx_parse_mpack(handler, ptr, i, 0);
-                        if (ret != 0)
-                            return -1;
-                        break;
                     default:
                         break;
                 }
@@ -306,7 +353,6 @@ int ctrl_packet_parser_parse(void *ctx, const char* data, size_t length, void *l
     }
 
     handler->cmsg = tfe_cmsg_init();
-    tfe_cmsg_dup(handler->cmsg);
     proxy_map = mpack_node_map_cstr(params, "proxy");
     ret = proxy_parse_messagepack(proxy_map, handler, logger);
     if (ret != 0)
@@ -318,7 +364,6 @@ succ:
 error:
     mpack_tree_destroy(&tree);
     tfe_cmsg_destroy(handler->cmsg);
-    tfe_cmsg_destroy(handler->cmsg);
     return -1;
 }
 
@@ -348,7 +393,16 @@ void ctrl_packet_cmsg_destroy(struct ctrl_pkt_parser *handler)
 {
     if (handler) {
         tfe_cmsg_destroy(handler->cmsg);
-        tfe_cmsg_destroy(handler->cmsg);
+
+        if (handler->seq_header) {
+            free(handler->seq_header);
+            handler->seq_header = NULL;
+        }
+
+        if (handler->ack_header) {
+            free(handler->ack_header);
+            handler->ack_header = NULL;
+        }
     }
 }
 
diff --git a/common/src/tfe_fieldstat.cpp b/common/src/tfe_fieldstat.cpp
index 6e37d58..b9ec2a6 100644
--- a/common/src/tfe_fieldstat.cpp
+++ b/common/src/tfe_fieldstat.cpp
@@ -4,13 +4,12 @@
 #include "tfe_stream.h"
 #include "tfe_resource.h"
 
-void tfe_set_intercept_metric(struct tfe_stream *stream, int hit_count, int downstream_rx_pkts, int downstream_rx_bytes, int upstream_rx_pkts, int upstream_rx_bytes)
+void tfe_set_intercept_metric(struct tfe_cmsg *cmsg, int hit_count, int downstream_rx_pkts, int downstream_rx_bytes, int upstream_rx_pkts, int upstream_rx_bytes, int thread_id)
 {
     int ret;
     uint16_t out_size;
     struct tfe_fieldstat_metric_t *fieldstat = (struct tfe_fieldstat_metric_t *)tfe_bussiness_resouce_get(DYNAMIC_FIELDSTAT);
 
-    struct tfe_cmsg *cmsg = tfe_stream_get0_cmsg(stream);
     if (cmsg == NULL)
     {
         return;
@@ -126,27 +125,27 @@ void tfe_set_intercept_metric(struct tfe_stream *stream, int hit_count, int down
 
     if (hit_count > 0)
     {
-        fieldstat_dynamic_table_metric_value_incrby(fieldstat->instance, fieldstat->table_id, fieldstat->column_array[COLUMN_HIT_COUNT], "proxy_rule_hits", hit_count, temp_tags, (size_t)nr_tags, stream->thread_id);
+        fieldstat_dynamic_table_metric_value_incrby(fieldstat->instance, fieldstat->table_id, fieldstat->column_array[COLUMN_HIT_COUNT], "proxy_rule_hits", hit_count, temp_tags, (size_t)nr_tags, thread_id);
     }
 
     if (in_pkts > 0)
     {
-        fieldstat_dynamic_table_metric_value_incrby(fieldstat->instance, fieldstat->table_id, fieldstat->column_array[COLUMN_IN_PKTS], "proxy_rule_hits", in_pkts, temp_tags, (size_t)nr_tags, stream->thread_id);
+        fieldstat_dynamic_table_metric_value_incrby(fieldstat->instance, fieldstat->table_id, fieldstat->column_array[COLUMN_IN_PKTS], "proxy_rule_hits", in_pkts, temp_tags, (size_t)nr_tags, thread_id);
     }
 
     if (in_bytes > 0)
     {
-        fieldstat_dynamic_table_metric_value_incrby(fieldstat->instance, fieldstat->table_id, fieldstat->column_array[COLUMN_IN_BYTES], "proxy_rule_hits", in_bytes, temp_tags, (size_t)nr_tags, stream->thread_id);
+        fieldstat_dynamic_table_metric_value_incrby(fieldstat->instance, fieldstat->table_id, fieldstat->column_array[COLUMN_IN_BYTES], "proxy_rule_hits", in_bytes, temp_tags, (size_t)nr_tags, thread_id);
     }
 
     if (out_pkts > 0)
     {
-        fieldstat_dynamic_table_metric_value_incrby(fieldstat->instance, fieldstat->table_id, fieldstat->column_array[COLUMN_OUT_PKTS], "proxy_rule_hits", out_pkts, temp_tags, (size_t)nr_tags, stream->thread_id);
+        fieldstat_dynamic_table_metric_value_incrby(fieldstat->instance, fieldstat->table_id, fieldstat->column_array[COLUMN_OUT_PKTS], "proxy_rule_hits", out_pkts, temp_tags, (size_t)nr_tags, thread_id);
     }
 
     if (out_bytes > 0)
     {
-        fieldstat_dynamic_table_metric_value_incrby(fieldstat->instance, fieldstat->table_id, fieldstat->column_array[COLUMN_OUT_BYTES], "proxy_rule_hits", out_bytes, temp_tags, (size_t)nr_tags, stream->thread_id);
+        fieldstat_dynamic_table_metric_value_incrby(fieldstat->instance, fieldstat->table_id, fieldstat->column_array[COLUMN_OUT_BYTES], "proxy_rule_hits", out_bytes, temp_tags, (size_t)nr_tags, thread_id);
     }
 }
 
diff --git a/common/src/tfe_packet_io.cpp b/common/src/tfe_packet_io.cpp
index e829e22..3eefc5b 100644
--- a/common/src/tfe_packet_io.cpp
+++ b/common/src/tfe_packet_io.cpp
@@ -31,7 +31,7 @@
 #include "bpf_obj.h"
 #include "tfe_session_table.h"
 #include "tfe_packet_io.h"
-
+#include "tfe_fieldstat.h"
 
 
 /******************************************************************************
@@ -40,6 +40,10 @@
 
 #define RX_BURST_MAX 128
 
+
+#define IS_SINGLE 0x01
+#define IS_TUNNEL 0x02
+
 #define TRAFFIC_IS_DECRYPTED        (1 << 0)
 #define SET_TRAFFIC_IS_DECRYPTED(field)    (field | TRAFFIC_IS_DECRYPTED)
 #define CLEAR_TRAFFIC_IS_DECRYPTED(field)  (field & ~TRAFFIC_IS_DECRYPTED)
@@ -198,7 +202,6 @@ static int tap_write(int tap_fd, const char *data, int data_len, void *logger)
 static struct metadata *metadata_new()
 {
     struct metadata *meta = (struct metadata *)calloc(1, sizeof(struct metadata));
-
     return meta;
 }
 
@@ -275,6 +278,16 @@ static void session_ctx_free(struct session_ctx *ctx)
             ctx->ctrl_meta = NULL;
         }
 
+        if (ctx->c2s_info.header_data) {
+            free(ctx->c2s_info.header_data);
+            ctx->c2s_info.header_data = NULL;
+        }
+
+        if (ctx->s2c_info.header_data) {
+            free(ctx->s2c_info.header_data);
+            ctx->s2c_info.header_data = NULL;
+        }
+
         free(ctx);
         ctx = NULL;
     }
@@ -293,6 +306,12 @@ static int add_ether_header(void *raw_data, char *src_mac, char *dst_mac){
 	return 0;
 }
 
+static int add_ether_proto(void *raw_data, uint16_t proto){
+	struct ethhdr *ether_hdr = (struct ethhdr*)raw_data;
+	ether_hdr->h_proto = htons(proto); // ETH_P_IP
+	return 0;
+}
+
 static int fake_tcp_handshake(struct tfe_proxy *proxy, struct tcp_restore_info *restore_info)
 {
     char buffer[1500] = {0};
@@ -962,9 +981,9 @@ static int packet_io_set_metadata(marsio_buff_t *tx_buff, struct metadata *meta,
     return 0;
 }
 
-static void packet_io_dump_metadata(marsio_buff_t *tx_buff, struct metadata *meta, void *logger)
+static void packet_io_dump_metadata(struct metadata *meta, void *logger)
 {
-    TFE_LOG_DEBUG(logger, "%s: META={session_id: %lu, raw_len: %d, is_e2i_dir: %d, is_ctrl_pkt: %d, l7offset: %d, is_decrypted: %u, sids_num: %d}", LOG_TAG_PKTIO, meta->session_id, meta->raw_len, meta->is_e2i_dir, meta->is_ctrl_pkt, meta->l7offset, meta->is_decrypted, meta->sids.num);
+    TFE_LOG_ERROR(logger, "%s: META={session_id: %lu, raw_len: %d, is_e2i_dir: %d, is_ctrl_pkt: %d, l7offset: %d, is_decrypted: %u, sids_num: %d}", LOG_TAG_PKTIO, meta->session_id, meta->raw_len, meta->is_e2i_dir, meta->is_ctrl_pkt, meta->l7offset, meta->is_decrypted, meta->sids.num);
 }
 
 /*
@@ -1154,15 +1173,32 @@ static void tcp_restore_info_dump(struct tcp_restore_info *info, uint64_t sessio
 	}
 }
 
+static void set_passthrough_reason(struct tfe_cmsg *cmsg, char *reason)
+{
+    uint8_t ssl_intercept_status = SSL_ACTION_PASSTHROUGH;
+
+    tfe_cmsg_set(cmsg, TFE_CMSG_SSL_PASSTHROUGH_REASON, (const unsigned char *)&reason, strlen(reason));
+    tfe_cmsg_set(cmsg, TFE_CMSG_SSL_INTERCEPT_STATE, (const unsigned char *)&ssl_intercept_status, (uint16_t)sizeof(ssl_intercept_status));
+    tfe_cmsg_set_flag(cmsg, TFE_CMSG_FLAG_USER0);
+}
+
 // return  0 : success
 // return -1 : error
 static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser *parser, int thread_seq, void *ctx)
 {
+    int ret = 0;
     int fd_downstream = 0;
     int fd_upstream = 0;
     int fd_fake_c = 0;
     int fd_fake_s = 0;
     uint16_t size = 0;
+    uint8_t is_passthrough = 0;
+    uint8_t hit_no_intercept = 0;
+    uint16_t out_size = 0;
+    char reason_hit_no_intercept[] = "Hit No Intercept";
+    char reason_invalid_intercept_param[] = "Invalid Intercept Param";
+    char reason_invalid_tcp_policy_param[] = "Invalid tcp policy Param";
+    char reason_underlying_stream_error[] = "Underlying Stream Error";
 
     unsigned int stream_common_direction;
     uint8_t stream_protocol_in_char = 0;
@@ -1187,81 +1223,118 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
         uint16_t offset = (char *)payload - meta->raw_data;
         TFE_LOG_ERROR(logger, "%s: incorrect dataoffset in the control zone of session %lu, offset:%u, l7offset:%u, payload:%p, raw_data:%p", LOG_TAG_PKTIO, meta->session_id, offset, meta->l7offset, payload, meta->raw_data);
     }
-
     raw_packet_parser_get_most_inner_tuple4(&raw_parser, &inner_tuple4, logger);
 
-    intercept_policy_enforce(thread->ref_proxy->int_ply_enforcer, parser->cmsg);
-	tcp_policy_enforce(thread->ref_proxy->tcp_ply_enforcer, parser->cmsg);
-    for (int i = 0; i < parser->sce_policy_id_num; i++) {
-	    chaining_policy_enforce(thread->ref_proxy->chain_ply_enforcer, parser->cmsg, parser->sce_policy_ids[i]);
-    }
+    if (parser->intercpet_data == 0) {
+        ret = intercept_policy_enforce(thread->ref_proxy->int_ply_enforcer, parser->cmsg);
+        if (ret != 0) {
+            is_passthrough = 1;
+            set_passthrough_reason(parser->cmsg, reason_invalid_intercept_param);
+            goto passthrough;
+        }
 
-    tcp_restore_set_from_cmsg(parser->cmsg, &restore_info);
-    tcp_restore_set_from_pkg(&inner_tuple4, &restore_info);
+        tfe_cmsg_get_value(parser->cmsg, TFE_CMSG_HIT_NO_INTERCEPT, (unsigned char *)&hit_no_intercept, sizeof(hit_no_intercept), &out_size);
+        if (hit_no_intercept == 1) {
+            is_passthrough = 1;
+            set_passthrough_reason(parser->cmsg, reason_hit_no_intercept);
+            goto passthrough;
+        }
 
-    if (overwrite_tcp_mss(parser->cmsg, &restore_info, meta->session_id, logger))
-	{
-		goto end;
-	}
-    tcp_restore_info_dump(&restore_info, meta->session_id, logger);
+        ret = tcp_policy_enforce(thread->ref_proxy->tcp_ply_enforcer, parser->cmsg);
+        if (ret != 0) {
+            is_passthrough = 1;
+            set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
+            goto passthrough;
+        }
 
-	// tcp repair C2S
-	fd_upstream = tfe_tcp_restore_fd_create(&(restore_info.client), &(restore_info.server), packet_io->config.dev_tap,  0x65);
-	if (fd_upstream < 0)
-	{
-		TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(UPSTREAM)", LOG_TAG_PKTIO, meta->session_id);
-		goto end;
-	}
+        for (int i = 0; i < parser->sce_policy_id_num; i++) {
+            chaining_policy_enforce(thread->ref_proxy->chain_ply_enforcer, parser->cmsg, parser->sce_policy_ids[i]);
+        }
 
-	// tcp repair S2C
-	fd_downstream = tfe_tcp_restore_fd_create(&(restore_info.server), &(restore_info.client), packet_io->config.dev_tap, 0x65);
-	if (fd_downstream < 0)
-	{
-		TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(DOWNSTREAM)", LOG_TAG_PKTIO, meta->session_id);
-		goto end;
-	}
+        tcp_restore_set_from_cmsg(parser->cmsg, &restore_info);
+        tcp_restore_set_from_pkg(&inner_tuple4, &restore_info);
 
-    tfe_cmsg_get_value(parser->cmsg, TFE_CMSG_TCP_RESTORE_PROTOCOL, (unsigned char *)&stream_protocol_in_char, sizeof(stream_protocol_in_char), &size);
-    tfe_cmsg_get_value(parser->cmsg, TFE_CMSG_TCP_DECRYPTED_TRAFFIC_STEERING, (unsigned char *)&enable_decrypted_traffic_steering, sizeof(enable_decrypted_traffic_steering), &size);
-    if ((STREAM_PROTO_PLAIN == (enum tfe_stream_proto)stream_protocol_in_char && thread->ref_proxy->traffic_steering_options.enable_steering_http) || 
-            (STREAM_PROTO_SSL == (enum tfe_stream_proto)stream_protocol_in_char && thread->ref_proxy->traffic_steering_options.enable_steering_ssl) || 
-            enable_decrypted_traffic_steering == 1)
-	{
-		if (fake_tcp_handshake(thread->ref_proxy, &restore_info) == -1)
-		{
-			TFE_LOG_ERROR(logger, "%s: session %lu Failed at fake_tcp_handshake()", LOG_TAG_PKTIO, meta->session_id);
-			goto end;
-		}
+        if (overwrite_tcp_mss(parser->cmsg, &restore_info, meta->session_id, logger)) {
+            is_passthrough = 1;
+            set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
+            goto passthrough;
+        }
+        tcp_restore_info_dump(&restore_info, meta->session_id, logger);
+
+        // tcp repair C2S
+        fd_upstream = tfe_tcp_restore_fd_create(&(restore_info.client), &(restore_info.server), packet_io->config.dev_tap,  0x65);
+        if (fd_upstream < 0) {
+            TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(UPSTREAM)", LOG_TAG_PKTIO, meta->session_id);
+            is_passthrough = 1;
+            set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
+            goto passthrough;
+        }
 
-		fd_fake_c = tfe_tcp_restore_fd_create(&(restore_info.client), &(restore_info.server), thread->ref_proxy->traffic_steering_options.device_client, thread->ref_proxy->traffic_steering_options.so_mask_client);
-		if (fd_fake_c < 0)
-		{
-			TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(fd_fake_c)", LOG_TAG_PKTIO, meta->session_id);
-			goto end;
-		}
+        // tcp repair S2C
+        fd_downstream = tfe_tcp_restore_fd_create(&(restore_info.server), &(restore_info.client), packet_io->config.dev_tap, 0x65);
+        if (fd_downstream < 0)
+        {
+            TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(DOWNSTREAM)", LOG_TAG_PKTIO, meta->session_id);
+            is_passthrough = 1;
+            set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
+            goto passthrough;
+        }
 
-		fd_fake_s = tfe_tcp_restore_fd_create(&(restore_info.server), &(restore_info.client), thread->ref_proxy->traffic_steering_options.device_server, thread->ref_proxy->traffic_steering_options.so_mask_server);
-		if (fd_fake_s < 0)
-		{
-			TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(fd_fake_s)", LOG_TAG_PKTIO, meta->session_id);
-			goto end;
-		}
-	}
+        tfe_cmsg_get_value(parser->cmsg, TFE_CMSG_TCP_RESTORE_PROTOCOL, (unsigned char *)&stream_protocol_in_char, sizeof(stream_protocol_in_char), &size);
+        tfe_cmsg_get_value(parser->cmsg, TFE_CMSG_TCP_DECRYPTED_TRAFFIC_STEERING, (unsigned char *)&enable_decrypted_traffic_steering, sizeof(enable_decrypted_traffic_steering), &size);
+        if ((STREAM_PROTO_PLAIN == (enum tfe_stream_proto)stream_protocol_in_char && thread->ref_proxy->traffic_steering_options.enable_steering_http) || 
+                (STREAM_PROTO_SSL == (enum tfe_stream_proto)stream_protocol_in_char && thread->ref_proxy->traffic_steering_options.enable_steering_ssl) || 
+                enable_decrypted_traffic_steering == 1)
+        {
+            if (fake_tcp_handshake(thread->ref_proxy, &restore_info) == -1)
+            {
+                TFE_LOG_ERROR(logger, "%s: session %lu Failed at fake_tcp_handshake()", LOG_TAG_PKTIO, meta->session_id);
+                is_passthrough = 1;
+                set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
+                goto passthrough;
+            }
 
-    if (tfe_proxy_fds_accept(thread->ref_proxy, fd_downstream, fd_upstream, fd_fake_c, fd_fake_s, parser->cmsg) < 0)
-	{
-		TFE_LOG_ERROR(logger, "%s: session %lu Failed at tfe_proxy_fds_accept()", LOG_TAG_PKTIO, meta->session_id);
-		goto end;
-	}
+            fd_fake_c = tfe_tcp_restore_fd_create(&(restore_info.client), &(restore_info.server), thread->ref_proxy->traffic_steering_options.device_client, thread->ref_proxy->traffic_steering_options.so_mask_client);
+            if (fd_fake_c < 0)
+            {
+                TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(fd_fake_c)", LOG_TAG_PKTIO, meta->session_id);
+                is_passthrough = 1;
+                set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
+                goto passthrough;
+            }
 
-    // E -> I
-    if (meta->is_e2i_dir)
-        stream_common_direction = 'I';
-    // I -> E
-    else
-        stream_common_direction = 'E';
-    tfe_cmsg_set(parser->cmsg, TFE_CMSG_COMMON_DIRECTION, (const unsigned char *)&stream_common_direction, sizeof(stream_common_direction));
+            fd_fake_s = tfe_tcp_restore_fd_create(&(restore_info.server), &(restore_info.client), thread->ref_proxy->traffic_steering_options.device_server, thread->ref_proxy->traffic_steering_options.so_mask_server);
+            if (fd_fake_s < 0)
+            {
+                TFE_LOG_ERROR(logger, "%s: session %lu Failed at tcp_restore_fd_create(fd_fake_s)", LOG_TAG_PKTIO, meta->session_id);
+                is_passthrough = 1;
+                set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
+                goto passthrough;
+            }
+        }
+
+        if (tfe_proxy_fds_accept(thread->ref_proxy, fd_downstream, fd_upstream, fd_fake_c, fd_fake_s, parser->cmsg) < 0)
+        {
+            TFE_LOG_ERROR(logger, "%s: session %lu Failed at tfe_proxy_fds_accept()", LOG_TAG_PKTIO, meta->session_id);
+            is_passthrough = 1;
+            set_passthrough_reason(parser->cmsg, reason_invalid_tcp_policy_param);
+            goto passthrough;
+        }
+
+        // E -> I
+        if (meta->is_e2i_dir)
+            stream_common_direction = 'I';
+        // I -> E
+        else
+            stream_common_direction = 'E';
+        tfe_cmsg_set(parser->cmsg, TFE_CMSG_COMMON_DIRECTION, (const unsigned char *)&stream_common_direction, sizeof(stream_common_direction));
+    }
+    else if (parser->intercpet_data & (IS_SINGLE | IS_TUNNEL)) {
+        is_passthrough = 1;
+        set_passthrough_reason(parser->cmsg, reason_underlying_stream_error);
+    }
 
+passthrough:
     s_ctx = session_ctx_new();
     s_ctx->raw_meta_i2e = metadata_new();
     s_ctx->raw_meta_e2i = metadata_new();
@@ -1271,6 +1344,7 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
     s_ctx->session_id = meta->session_id;
     s_ctx->session_addr = addr_tuple4_to_str(&inner_tuple4);
     s_ctx->cmsg = parser->cmsg;
+    s_ctx->is_passthrough = is_passthrough;
     metadata_deep_copy(s_ctx->ctrl_meta, meta);
 
     ether_hdr = (struct ethhdr *)(s_ctx->ctrl_meta->raw_data);
@@ -1289,6 +1363,12 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
     
     sids_copy(&s_ctx->ctrl_meta->sids, &meta->sids);
     route_ctx_copy(&s_ctx->ctrl_meta->route_ctx, &meta->route_ctx);
+
+    if (parser->seq_len > 0)
+        raw_traffic_decapsulate(&raw_parser, parser->seq_header, parser->seq_len, &s_ctx->c2s_info.header_data, &s_ctx->c2s_info.header_len, &s_ctx->c2s_info.is_ipv4);
+    if (parser->ack_len > 0)
+        raw_traffic_decapsulate(&raw_parser, parser->ack_header, parser->ack_len, &s_ctx->s2c_info.header_data, &s_ctx->s2c_info.header_len, &s_ctx->s2c_info.is_ipv4);
+
     if (s_ctx->c2s_info.is_e2i_dir) {
         sids_copy(&s_ctx->raw_meta_e2i->sids, &parser->seq_sids);
         route_ctx_copy(&s_ctx->raw_meta_e2i->route_ctx, &parser->seq_route_ctx);
@@ -1307,10 +1387,12 @@ static int handle_session_opening(struct metadata *meta, struct ctrl_pkt_parser
 
     session_table_insert(thread->session_table, s_ctx->session_id, &(s_ctx->c2s_info.tuple4), s_ctx, session_value_free_cb);
     ATOMIC_INC(&(packet_io_fs->session_num));
+    tfe_cmsg_dup(parser->cmsg);
+    if (parser->seq_header)
+        FREE(&parser->seq_header);
+    if (parser->ack_header)
+        FREE(&parser->ack_header);
     return 0;
-end:
-    ctrl_packet_cmsg_destroy(parser);
-    return -1;
 }
 
 // return  0 : success
@@ -1343,6 +1425,7 @@ static int handle_session_closing(struct metadata *meta, struct ctrl_pkt_parser
         TFE_LOG_INFO(logger, "%s: session %lu closing", LOG_TAG_PKTIO, s_ctx->session_id);
         session_table_delete_by_id(thread->session_table, meta->session_id);
         ATOMIC_DEC(&(packet_io_fs->session_num));
+        tfe_set_intercept_metric(s_ctx->cmsg, 1, s_ctx->c2s_info.rx.n_pkts, s_ctx->c2s_info.rx.n_bytes, s_ctx->s2c_info.rx.n_pkts, s_ctx->s2c_info.rx.n_bytes, thread_seq);
         return 0;
     }
 
@@ -1429,14 +1512,16 @@ static int handle_raw_packet_from_nf(struct packet_io *handle, marsio_buff_t *rx
     struct packet_io_thread_ctx *thread = (struct packet_io_thread_ctx *)ctx;
     struct packet_io *packet_io = thread->ref_io;
     struct packet_io_fs *packet_io_fs = thread->ret_fs_state;
+    int is_ipv4 = 0;
+    char *header = NULL;
+    int header_len = 0;
     void * logger = thread->logger;
 
     int raw_len = marsio_buff_datalen(rx_buff);
     char *raw_data = marsio_buff_mtod(rx_buff);
 
     struct metadata meta;
-    if (packet_io_get_metadata(rx_buff, &meta, logger) == -1)
-    {
+    if (packet_io_get_metadata(rx_buff, &meta, logger) == -1) {
         TFE_LOG_ERROR(logger, "%s: unexpected control packet, unable to get metadata\n\tMETA={session_id: %lu, raw_len: %d, is_e2i_dir: %d, is_ctrl_pkt: %d, l7offset: %d, is_decrypted: %u, sids_num: %d}", 
                                 LOG_TAG_PKTIO, meta.session_id, meta.raw_len, meta.is_e2i_dir, meta.is_ctrl_pkt, meta.l7offset, meta.is_decrypted, meta.sids.num);
         throughput_metrics_inc(&packet_io_fs->raw_pkt_rx, 1, raw_len);
@@ -1446,8 +1531,7 @@ static int handle_raw_packet_from_nf(struct packet_io *handle, marsio_buff_t *rx
     }
 
     struct session_node *node = session_table_search_by_id(thread->session_table, meta.session_id);
-    if (node == NULL)
-    {
+    if (node == NULL) {
         throughput_metrics_inc(&packet_io_fs->raw_pkt_rx, 1, raw_len);
         throughput_metrics_inc(&packet_io_fs->raw_bypass, 1, raw_len);
         marsio_send_burst(handle->dev_nf_interface.mr_path, thread_seq, &rx_buff, 1);
@@ -1456,6 +1540,17 @@ static int handle_raw_packet_from_nf(struct packet_io *handle, marsio_buff_t *rx
 
     struct session_ctx *s_ctx = (struct session_ctx *)node->val_data;
 
+    if (s_ctx->is_passthrough > 0) {
+        throughput_metrics_inc(&packet_io_fs->raw_pkt_rx, 1, raw_len);
+        throughput_metrics_inc(&packet_io_fs->raw_bypass, 1, raw_len);
+        if (meta.is_e2i_dir == s_ctx->c2s_info.is_e2i_dir)
+            throughput_metrics_inc(&s_ctx->c2s_info.rx, 1, raw_len);
+        else
+            throughput_metrics_inc(&s_ctx->s2c_info.rx, 1, raw_len);
+        marsio_send_burst(handle->dev_nf_interface.mr_path, thread_seq, &rx_buff, 1);
+        return 0;
+    }
+
     if (meta.is_decrypted)
     {
         throughput_metrics_inc(&packet_io_fs->decrypt_rx, 1, raw_len);
@@ -1485,31 +1580,64 @@ static int handle_raw_packet_from_nf(struct packet_io *handle, marsio_buff_t *rx
     else
     {
         throughput_metrics_inc(&packet_io_fs->raw_pkt_rx, 1, raw_len);
-        if (meta.is_e2i_dir)
-        {
-            if (metadata_is_empty(s_ctx->raw_meta_e2i))
-            {
+        if (meta.is_e2i_dir) {
+            if (metadata_is_empty(s_ctx->raw_meta_e2i)) {
                 metadata_deep_copy(s_ctx->raw_meta_e2i, &meta);
             }
             s_ctx->raw_meta_e2i->sids = meta.sids;
         }
-        else
-        {
-            if (metadata_is_empty(s_ctx->raw_meta_i2e))
-            {
+        else {
+            if (metadata_is_empty(s_ctx->raw_meta_i2e)) {
                 metadata_deep_copy(s_ctx->raw_meta_i2e, &meta);
             }
             s_ctx->raw_meta_i2e->sids = meta.sids;
         }
-        // send to tap0
-        add_ether_header(raw_data, packet_io->config.src_mac, packet_io->config.tap_mac);
-        if (packet_io->config.enable_iouring) {
-            io_uring_submit_write_entry(thread->tap_ctx->io_uring_fd, raw_data, raw_len);
+
+        if (meta.is_e2i_dir == s_ctx->c2s_info.is_e2i_dir) {
+            header = s_ctx->c2s_info.header_data;
+            header_len = s_ctx->c2s_info.header_len;
+            is_ipv4 = s_ctx->c2s_info.is_ipv4;
+            throughput_metrics_inc(&s_ctx->c2s_info.rx, 1, raw_len);
+        }
+        else {
+            header = s_ctx->s2c_info.header_data;
+            header_len = s_ctx->s2c_info.header_len;
+            is_ipv4 = s_ctx->s2c_info.is_ipv4;
+            throughput_metrics_inc(&s_ctx->s2c_info.rx, 1, raw_len);
+        }
+
+        if (header != NULL) {
+            char *packet_buff = NULL;
+            int packet_len = sizeof(struct ethhdr) + raw_len - header_len;
+            packet_buff = (char *)calloc(packet_len, sizeof(char));
+            memcpy(packet_buff + sizeof(struct ethhdr), raw_data + header_len, raw_len - header_len);
+            add_ether_header(packet_buff, packet_io->config.src_mac, packet_io->config.tap_mac);
+            if (is_ipv4)
+                add_ether_proto(packet_buff, ETH_P_IP);
+            else
+                add_ether_proto(packet_buff, ETH_P_IPV6);
+
+            if (packet_io->config.enable_iouring) {
+                io_uring_submit_write_entry(thread->tap_ctx->io_uring_fd, packet_buff, packet_len);
+            }
+            else {
+                tap_write(thread->tap_ctx->tap_fd, packet_buff, packet_len, logger);
+            }
+            throughput_metrics_inc(&packet_io_fs->tap_pkt_tx, 1, packet_len);
+            if (packet_buff)
+                free(packet_buff);
         }
         else {
-            tap_write(thread->tap_ctx->tap_fd, raw_data, raw_len, logger);
+            // send to tap0
+            add_ether_header(raw_data, packet_io->config.src_mac, packet_io->config.tap_mac);
+            if (packet_io->config.enable_iouring) {
+                io_uring_submit_write_entry(thread->tap_ctx->io_uring_fd, raw_data, raw_len);
+            }
+            else {
+                tap_write(thread->tap_ctx->tap_fd, raw_data, raw_len, logger);
+            }
+            throughput_metrics_inc(&packet_io_fs->tap_pkt_tx, 1, raw_len);
         }
-        throughput_metrics_inc(&packet_io_fs->tap_pkt_tx, 1, raw_len);
 
         uint8_t flag = tfe_cmsg_get_flag(s_ctx->cmsg);
         if (flag & TFE_CMSG_FLAG_USER0) {
@@ -1881,7 +2009,12 @@ void handle_raw_packet_from_tap(const char *data, int len, void *args)
     struct packet_io_fs *packet_io_fs = thread->ret_fs_state;
     struct addr_tuple4 inner_addr;
     struct raw_pkt_parser raw_parser;
+    struct metadata meta = {0};
     void * logger = thread->logger;
+    char *dst = NULL;
+    char *header = NULL;
+    int header_len = 0;
+    int packet_len = 0;
     
     memset(&inner_addr, 0, sizeof(struct addr_tuple4));
     raw_packet_parser_init(&raw_parser, 0, LAYER_TYPE_ALL, 8);
@@ -1906,28 +2039,21 @@ void handle_raw_packet_from_tap(const char *data, int len, void *args)
 		return;
 	}
 
-    char *dst = marsio_buff_append(tx_buffs[0], len);
-    memcpy(dst, data, len);
-
-    struct metadata meta = {0};
-    meta.session_id = s_ctx->session_id;
-    meta.raw_data = dst;
-    meta.raw_len = len;
-    meta.is_decrypted = 0;
-    meta.is_ctrl_pkt = 0;
-    meta.l7offset = 0;
-
     if (memcmp(&inner_addr, &s_ctx->c2s_info.tuple4, sizeof(struct addr_tuple4)) == 0)
     {
         meta.is_e2i_dir = s_ctx->c2s_info.is_e2i_dir;
         src_mac = s_ctx->client_mac;
         dst_mac = s_ctx->server_mac;
+        header = s_ctx->c2s_info.header_data;
+        header_len = s_ctx->c2s_info.header_len;
     }
     else
     {
         meta.is_e2i_dir = s_ctx->s2c_info.is_e2i_dir;
         src_mac = s_ctx->server_mac;
         dst_mac = s_ctx->client_mac;
+        header = s_ctx->s2c_info.header_data;
+        header_len = s_ctx->s2c_info.header_len;
     }
 
     if (meta.is_e2i_dir)
@@ -1941,8 +2067,27 @@ void handle_raw_packet_from_tap(const char *data, int len, void *args)
         route_ctx_copy(&meta.route_ctx, &s_ctx->raw_meta_i2e->route_ctx);
     }
 
+    if (header != NULL) {
+        packet_len = len + header_len - sizeof(struct ethhdr);
+        dst = marsio_buff_append(tx_buffs[0], packet_len);
+        memcpy(dst, header, header_len);
+        memcpy(dst + header_len, data + sizeof(struct ethhdr), len - sizeof(struct ethhdr));
+    }
+    else {
+        packet_len = len;
+        dst = marsio_buff_append(tx_buffs[0], len);
+        memcpy(dst, data, len);
+    }
+
+    meta.session_id = s_ctx->session_id;
+    meta.raw_data = dst;
+    meta.raw_len = packet_len;
+    meta.is_decrypted = 0;
+    meta.is_ctrl_pkt = 0;
+    meta.l7offset = 0;
+
     packet_io_set_metadata(tx_buffs[0], &meta, logger);
     add_ether_header(dst, src_mac, dst_mac);
-    throughput_metrics_inc(&packet_io_fs->raw_pkt_tx, 1, len);
+    throughput_metrics_inc(&packet_io_fs->raw_pkt_tx, 1, packet_len);
     marsio_send_burst(packet_io->dev_nf_interface.mr_path, thread->thread_index, tx_buffs, 1);
 }
diff --git a/common/src/tfe_raw_packet.cpp b/common/src/tfe_raw_packet.cpp
index 97d67a6..838cd73 100644
--- a/common/src/tfe_raw_packet.cpp
+++ b/common/src/tfe_raw_packet.cpp
@@ -399,6 +399,82 @@ uint64_t raw_packet_parser_get_hash_value(struct raw_pkt_parser *handler, enum l
     return hash_value;
 }
 
+static const struct layer_result *raw_packet_parser_get_most_inner_layer(struct raw_pkt_parser *handler, enum layer_type layer_type)
+{
+    const struct layer_result *layer_result = NULL;
+    struct layer_results *results = &handler->results;
+
+    for (int8_t i = results->layers_used - 1; i >= 0; i--)
+    {
+        const struct layer_result *layer = &results->layers[i];
+        enum layer_type type = layer->type;
+
+        // first get L4 layer
+        if (type & layer_type)
+        {
+            layer_result = layer;
+            break;
+        }
+    }
+
+    if (layer_result == NULL)
+        return NULL;
+
+    return layer_result;
+}
+
+static const struct layer_result *raw_packet_parser_get_most_outer_layer(struct raw_pkt_parser *handler, enum layer_type layer_type)
+{
+    const struct layer_result *layer_result = NULL;
+    struct layer_results *results = &handler->results;
+
+    for (int8_t i = 0; i <= results->layers_used - 1; i++)
+    {
+        const struct layer_result *layer = &results->layers[i];
+        enum layer_type type = layer->type;
+
+        // first get L4 layer
+        if (type & layer_type)
+        {
+            layer_result = layer;
+            break;
+        }
+    }
+
+    if (layer_result == NULL)
+        return NULL;
+
+    return layer_result;
+}
+
+int raw_traffic_decapsulate(struct raw_pkt_parser *handler, char *raw_data, int raw_len, char **header, int *header_len, int *is_ipv4)
+{
+    const struct layer_result *l2_tun_layer_result = NULL;
+    const struct layer_result *l3_layer_result = NULL;
+    const struct layer_result *l4_layer_result = NULL;
+
+    l4_layer_result = raw_packet_parser_get_most_inner_layer(handler, LAYER_TYPE_L4);
+    if (l4_layer_result == NULL)
+        return -1;
+
+    if (l4_layer_result->type != LAYER_TYPE_TCP)
+        return -1;
+
+    l3_layer_result = raw_packet_parser_get_most_inner_layer(handler, LAYER_TYPE_L3);
+    if (l3_layer_result == NULL)
+        return -1;
+
+    *is_ipv4 = l3_layer_result->type == LAYER_TYPE_IPV4 ? 1 : 0;
+    l2_tun_layer_result = raw_packet_parser_get_most_outer_layer(handler, LAYER_TYPE_L2_TUN);
+    if (l2_tun_layer_result == NULL)
+        return -1;
+
+    *header_len = l3_layer_result->offset;
+    *header = (char *)calloc(*header_len, sizeof(char));
+    memcpy(*header, raw_data, *header_len);
+    return 0;
+}
+
 /******************************************************************************
  * Private API
  ******************************************************************************/
diff --git a/common/test/CMakeLists.txt b/common/test/CMakeLists.txt
new file mode 100644
index 0000000..121fc3d
--- /dev/null
+++ b/common/test/CMakeLists.txt
@@ -0,0 +1,41 @@
+###############################################################################
+# gtest_addr
+###############################################################################
+
+add_executable(gtest_addr test_addr.cpp)
+target_include_directories(gtest_addr PUBLIC ${CMAKE_SOURCE_DIR}/common/include)
+target_link_libraries(gtest_addr common gtest)
+
+###############################################################################
+# gtest_cmsg
+###############################################################################
+
+add_executable(gtest_cmsg test_cmsg.cpp)
+target_include_directories(gtest_cmsg PUBLIC ${CMAKE_SOURCE_DIR}/common/include)
+target_link_libraries(gtest_cmsg common gtest)
+
+###############################################################################
+# gtest_session_table
+###############################################################################
+
+add_executable(gtest_session_table test_session_table.cpp)
+target_include_directories(gtest_session_table PUBLIC ${CMAKE_SOURCE_DIR}/common/include)
+target_link_libraries(gtest_session_table common gtest)
+
+###############################################################################
+# gtest_raw_packet
+###############################################################################
+
+add_executable(gtest_raw_packet test_raw_packet.cpp)
+target_include_directories(gtest_raw_packet PUBLIC ${CMAKE_SOURCE_DIR}/common/include)
+target_link_libraries(gtest_raw_packet common gtest)
+
+###############################################################################
+# gtest_discover_tests
+###############################################################################
+
+include(GoogleTest)
+gtest_discover_tests(gtest_addr)
+gtest_discover_tests(gtest_cmsg)
+gtest_discover_tests(gtest_session_table)
+gtest_discover_tests(gtest_raw_packet)
diff --git a/common/test/test_cmsg.cpp b/common/test/test_cmsg.cpp
index dde3da4..0686564 100644
--- a/common/test/test_cmsg.cpp
+++ b/common/test/test_cmsg.cpp
@@ -75,5 +75,6 @@ int main()
 
 	tfe_cmsg_destroy(cmsg_decode);
 
+	free(temp_buff);
 	return 0;
 }
\ No newline at end of file
diff --git a/common/test/test_raw_packet.cpp b/common/test/test_raw_packet.cpp
new file mode 100644
index 0000000..be57a76
--- /dev/null
+++ b/common/test/test_raw_packet.cpp
@@ -0,0 +1,1098 @@
+#include <gtest/gtest.h>
+#include <arpa/inet.h>
+
+#include "tfe_raw_packet.h"
+
+bool g_print_to_stderr = true;
+void * g_packet_io_logger = NULL;
+
+/******************************************************************************
+ * Pcap file: 1-ETH_VLAN_VLAN_IP4_IP4_UDP.pcap
+ * [Protocols in frame: eth:ethertype:vlan:ethertype:vlan:ethertype:ip:ip:udp:data]
+ ******************************************************************************
+ *
+ * Frame 1: 170 bytes on wire (1360 bits), 170 bytes captured (1360 bits)
+ * Ethernet II, Src: HuaweiTe_3b:b3:9a (a4:c6:4f:3b:b3:9a), Dst: 00:00:00_00:00:04 (00:00:00:00:00:04)
+ * 	Destination: 00:00:00_00:00:04 (00:00:00:00:00:04)
+ * 	Source: HuaweiTe_3b:b3:9a (a4:c6:4f:3b:b3:9a)
+ * 	Type: 802.1Q Virtual LAN (0x8100)
+ * 802.1Q Virtual LAN, PRI: 3, DEI: 0, ID: 1624
+ * 	011. .... .... .... = Priority: Critical Applications (3)
+ * 	...0 .... .... .... = DEI: Ineligible
+ * 	.... 0110 0101 1000 = ID: 1624
+ * 	Type: 802.1Q Virtual LAN (0x8100)
+ * 802.1Q Virtual LAN, PRI: 3, DEI: 0, ID: 505
+ * 	011. .... .... .... = Priority: Critical Applications (3)
+ * 	...0 .... .... .... = DEI: Ineligible
+ * 	.... 0001 1111 1001 = ID: 505
+ * 	Type: IPv4 (0x0800)
+ * Internet Protocol Version 4, Src: 69.67.35.146, Dst: 41.202.46.110
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0xb8 (DSCP: EF PHB, ECN: Not-ECT)
+ * 	Total Length: 148
+ * 	Identification: 0xe858 (59480)
+ * 	000. .... = Flags: 0x0
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 255
+ * 	Protocol: IPIP (4)
+ * 	Header Checksum: 0x1148 [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 69.67.35.146
+ * 	Destination Address: 41.202.46.110
+ * Internet Protocol Version 4, Src: 10.10.100.25, Dst: 10.10.101.2
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0xb8 (DSCP: EF PHB, ECN: Not-ECT)
+ * 	Total Length: 128
+ * 	Identification: 0x0001 (1)
+ * 	000. .... = Flags: 0x0
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 254
+ * 	Protocol: UDP (17)
+ * 	Header Checksum: 0xde84 [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 10.10.100.25
+ * 	Destination Address: 10.10.101.2
+ * User Datagram Protocol, Src Port: 62367, Dst Port: 17000
+ * 	Source Port: 62367
+ * 	Destination Port: 17000
+ * 	Length: 108
+ * 	Checksum: 0x4b9a [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	[Stream index: 0]
+ * 	[Timestamps]
+ * 		[Time since first frame: 0.000000000 seconds]
+ * 		[Time since previous frame: 0.000000000 seconds]
+ * 	UDP payload (100 bytes)
+ * Data (100 bytes)
+ */
+
+unsigned char data1[] = {
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0xa4, 0xc6, 0x4f, 0x3b, 0xb3, 0x9a, 0x81, 0x00, 0x66, 0x58, 0x81, 0x00, 0x61, 0xf9, 0x08, 0x00, 0x45, 0xb8, 0x00, 0x94,
+	0xe8, 0x58, 0x00, 0x00, 0xff, 0x04, 0x11, 0x48, 0x45, 0x43, 0x23, 0x92, 0x29, 0xca, 0x2e, 0x6e, 0x45, 0xb8, 0x00, 0x80, 0x00, 0x01, 0x00, 0x00, 0xfe, 0x11,
+	0xde, 0x84, 0x0a, 0x0a, 0x64, 0x19, 0x0a, 0x0a, 0x65, 0x02, 0xf3, 0x9f, 0x42, 0x68, 0x00, 0x6c, 0x4b, 0x9a, 0x00, 0x02, 0x00, 0x00, 0x04, 0x73, 0x6c, 0x10,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
+	0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
+	0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
+	0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd};
+
+TEST(RAW_PACKET, ETH_VLAN_VLAN_IP4_IP4_UDP)
+{
+    char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser,0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data1, sizeof(data1), g_packet_io_logger);
+    raw_traffic_decapsulate(&raw_parser, (char *)data1, sizeof(data1), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header == nullptr);
+    EXPECT_TRUE(header_len == 0);
+
+}
+
+/******************************************************************************
+ * Pcap file: 2-ETH_IP6_IP4_TCP_SSH.pcap
+ * [Protocols in frame: eth:ethertype:ipv6:ip:tcp:ssh]
+ ******************************************************************************
+ *
+ * Frame 1: 726 bytes on wire (5808 bits), 726 bytes captured (5808 bits)
+ * Ethernet II, Src: EvocInte_36:51:3c (00:22:46:36:51:3c), Dst: EvocInte_36:51:38 (00:22:46:36:51:38)
+ * 	Destination: EvocInte_36:51:38 (00:22:46:36:51:38)
+ * 	Source: EvocInte_36:51:3c (00:22:46:36:51:3c)
+ * 	Type: IPv6 (0x86dd)
+ * Internet Protocol Version 6, Src: 2001::192:168:40:134, Dst: 2001::192:168:40:133
+ * 	0110 .... = Version: 6
+ * 	.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	.... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
+ * 	Payload Length: 672
+ * 	Next Header: IPIP (4)
+ * 	Hop Limit: 64
+ * 	Source Address: 2001::192:168:40:134
+ * 	Destination Address: 2001::192:168:40:133
+ * 	[Source Teredo Server IPv4: 0.0.0.0]
+ * 	[Source Teredo Port: 65175]
+ * 	[Source Teredo Client IPv4: 255.191.254.203]
+ * 	[Destination Teredo Server IPv4: 0.0.0.0]
+ * 	[Destination Teredo Port: 65175]
+ * 	[Destination Teredo Client IPv4: 255.191.254.204]
+ * Internet Protocol Version 4, Src: 1.1.1.1, Dst: 2.2.2.2
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	Total Length: 672
+ * 	Identification: 0x0968 (2408)
+ * 	000. .... = Flags: 0x0
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 212
+ * 	Protocol: TCP (6)
+ * 	Header Checksum: 0xd4ea [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 1.1.1.1
+ * 	Destination Address: 2.2.2.2
+ * Transmission Control Protocol, Src Port: 57639, Dst Port: 22, Seq: 1, Ack: 1, Len: 632
+ * 	Source Port: 57639
+ * 	Destination Port: 22
+ * 	[Stream index: 0]
+ * 	[Conversation completeness: Incomplete (8)]
+ * 	[TCP Segment Len: 632]
+ * 	Sequence Number: 1    (relative sequence number)
+ * 	Sequence Number (raw): 1508621024
+ * 	[Next Sequence Number: 633    (relative sequence number)]
+ * 	Acknowledgment Number: 1    (relative ack number)
+ * 	Acknowledgment number (raw): 2828957019
+ * 	0101 .... = Header Length: 20 bytes (5)
+ * 	Flags: 0x018 (PSH, ACK)
+ * 	Window: 28584
+ * 	[Calculated window size: 28584]
+ * 	[Window size scaling factor: -1 (unknown)]
+ * 	Checksum: 0xc51f [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	Urgent Pointer: 0
+ * 	[Timestamps]
+ * 	[SEQ/ACK analysis]
+ * 	TCP payload (632 bytes)
+ * SSH Protocol
+ */
+
+unsigned char data2[] = {
+	0x00, 0x22, 0x46, 0x36, 0x51, 0x38, 0x00, 0x22, 0x46, 0x36, 0x51, 0x3c, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x02, 0xa0, 0x04, 0x40, 0x20, 0x01, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x01, 0x92, 0x01, 0x68, 0x00, 0x40, 0x01, 0x34, 0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x92, 0x01, 0x68, 0x00, 0x40,
+	0x01, 0x33, 0x45, 0x00, 0x02, 0xa0, 0x09, 0x68, 0x00, 0x00, 0xd4, 0x06, 0xd4, 0xea, 0x01, 0x01, 0x01, 0x01, 0x02, 0x02, 0x02, 0x02, 0xe1, 0x27, 0x00, 0x16,
+	0x59, 0xeb, 0xba, 0xe0, 0xa8, 0x9e, 0x75, 0x5b, 0x50, 0x18, 0x6f, 0xa8, 0xc5, 0x1f, 0x00, 0x00, 0x4f, 0xe3, 0xa9, 0x48, 0x9b, 0xbe, 0xa8, 0x07, 0x0e, 0xbb,
+	0x5b, 0xf1, 0x15, 0x1d, 0xc9, 0xbe, 0xdf, 0x78, 0x89, 0xa2, 0x8f, 0x12, 0x5f, 0xad, 0x51, 0xd5, 0xfa, 0xa7, 0x0b, 0xf2, 0x34, 0x00, 0x5b, 0x77, 0xae, 0xab,
+	0xe4, 0x49, 0xa7, 0xa5, 0xa7, 0x1f, 0xda, 0x90, 0xcc, 0xe1, 0x8e, 0x9f, 0xe9, 0xee, 0x53, 0x59, 0xa4, 0x17, 0xf8, 0x0d, 0x40, 0xe5, 0x75, 0x97, 0xf0, 0x29,
+	0xfa, 0x7c, 0xb8, 0x12, 0x7e, 0x93, 0xbc, 0x7e, 0x0a, 0x69, 0x8f, 0x1d, 0x7b, 0x1a, 0x2e, 0xf6, 0xa6, 0x78, 0x67, 0x26, 0xfe, 0x8f, 0xcf, 0x5a, 0x02, 0x7d,
+	0xbb, 0x1b, 0xdb, 0xc7, 0x71, 0xee, 0xe9, 0xd9, 0xc1, 0x48, 0xbf, 0xc7, 0xcc, 0x00, 0x82, 0x7f, 0x69, 0x52, 0xa7, 0xe1, 0x12, 0xec, 0xf1, 0x93, 0xa8, 0x55,
+	0x5b, 0x33, 0xd3, 0x35, 0x11, 0x5d, 0xf8, 0x3d, 0x5b, 0x94, 0xc9, 0x67, 0xae, 0xba, 0xc0, 0x4a, 0x8b, 0x25, 0x8d, 0xbf, 0xd4, 0xcc, 0x24, 0xb7, 0x3d, 0x0f,
+	0x1a, 0x57, 0x20, 0x5c, 0x64, 0x62, 0xf7, 0x3c, 0xff, 0xaf, 0x6b, 0xf2, 0xf3, 0xca, 0xd1, 0xcb, 0x7b, 0x9f, 0xc1, 0x31, 0x25, 0x01, 0xd1, 0x18, 0x78, 0x81,
+	0xf8, 0xae, 0x61, 0x4b, 0x59, 0xa1, 0xbe, 0x4a, 0x94, 0x12, 0xa3, 0x05, 0x4a, 0x26, 0x85, 0xbd, 0x5e, 0x59, 0xb2, 0xc2, 0x24, 0xec, 0xd6, 0x94, 0x6e, 0xc5,
+	0x7a, 0xdf, 0x21, 0x21, 0xe4, 0x06, 0x67, 0x89, 0xe0, 0x76, 0x85, 0xa9, 0x00, 0x43, 0xfe, 0x72, 0x8c, 0x10, 0xe4, 0x96, 0x63, 0x1a, 0xe8, 0x84, 0xe1, 0x86,
+	0xa2, 0xa5, 0x67, 0x31, 0x67, 0x44, 0xca, 0xec, 0xe8, 0xa1, 0x3e, 0x5f, 0x4e, 0x71, 0x5d, 0xd4, 0x34, 0xa9, 0x3d, 0xfa, 0x6a, 0xdb, 0xfb, 0x28, 0x2b, 0x70,
+	0xcc, 0xf1, 0x3c, 0x7c, 0xf5, 0x39, 0xb5, 0xd0, 0xa2, 0x56, 0x22, 0x96, 0x7e, 0xc5, 0x0e, 0x66, 0x2d, 0xcd, 0x5c, 0x33, 0x43, 0x1c, 0xca, 0x17, 0x77, 0x46,
+	0xb2, 0x41, 0x06, 0x8a, 0x7c, 0x7c, 0x66, 0x06, 0x18, 0x33, 0x21, 0x16, 0x8f, 0x5a, 0xb7, 0xdd, 0x10, 0xa1, 0xab, 0xe9, 0x66, 0xf7, 0x90, 0x22, 0x2c, 0xbe,
+	0xdd, 0xad, 0xe1, 0x40, 0xe9, 0x21, 0x53, 0x97, 0x07, 0x97, 0x6b, 0xd6, 0x91, 0x11, 0x44, 0x4e, 0x9d, 0x1f, 0x57, 0x07, 0xed, 0xa2, 0xac, 0x77, 0xc0, 0x84,
+	0xb7, 0xc5, 0x2b, 0xaa, 0x17, 0xd2, 0xdb, 0x2a, 0x15, 0x47, 0x2b, 0x69, 0xf1, 0xb4, 0xb5, 0x8f, 0x98, 0xcf, 0x26, 0x03, 0xf0, 0x4b, 0x1a, 0xba, 0x94, 0xc4,
+	0x12, 0xe3, 0xd1, 0x38, 0x0c, 0x2e, 0x87, 0x33, 0x0f, 0xe1, 0xa6, 0xba, 0x75, 0xd0, 0xa4, 0x94, 0x80, 0x49, 0x67, 0xa8, 0x90, 0x31, 0x19, 0xaa, 0xf9, 0x78,
+	0x0d, 0xdd, 0x64, 0xe3, 0xc7, 0x0e, 0x81, 0xa7, 0x6b, 0x44, 0x0c, 0xb5, 0xa0, 0x25, 0x8a, 0xa2, 0xdc, 0x5e, 0xbc, 0xcd, 0xb4, 0x87, 0x1b, 0x6c, 0x08, 0x38,
+	0x63, 0xa8, 0xc1, 0xde, 0xe2, 0xa1, 0xa4, 0x19, 0x1e, 0x3c, 0x67, 0x3b, 0xf7, 0x7f, 0x67, 0xfb, 0x50, 0x9a, 0x06, 0x5c, 0xdd, 0xf2, 0x26, 0x2c, 0xb9, 0xd2,
+	0xbd, 0x80, 0xd5, 0xfc, 0xc5, 0x54, 0x6c, 0xc1, 0xea, 0x76, 0x3e, 0xd4, 0xbb, 0x57, 0x65, 0x6a, 0xf8, 0x8e, 0x3e, 0x93, 0xe5, 0x03, 0xfc, 0xce, 0xf1, 0x1c,
+	0xf3, 0x10, 0xae, 0x87, 0x78, 0x46, 0x02, 0x63, 0xc5, 0xc0, 0x41, 0xbd, 0xae, 0x46, 0x68, 0x0c, 0x92, 0x22, 0xa4, 0xc0, 0xce, 0xf3, 0xc4, 0xf7, 0x83, 0xa9,
+	0x22, 0x78, 0x74, 0x7f, 0x2e, 0xc1, 0xc6, 0x3b, 0x72, 0x26, 0x4b, 0x45, 0xbd, 0x1b, 0x9f, 0x66, 0x61, 0x46, 0xbb, 0x0f, 0xf3, 0xc5, 0x65, 0x95, 0xbc, 0xae,
+	0x8f, 0x37, 0xfd, 0xa3, 0x20, 0xb6, 0xe4, 0xa8, 0xff, 0x45, 0xa1, 0x01, 0xa1, 0x76, 0xb3, 0xad, 0x16, 0x07, 0x39, 0x58, 0x3b, 0x34, 0xe9, 0xe6, 0xc0, 0xee,
+	0x7f, 0x65, 0x6f, 0x68, 0xf4, 0x45, 0xa4, 0x85, 0xa7, 0x50, 0x63, 0xce, 0x0b, 0x0d, 0xbd, 0xd1, 0x20, 0xc8, 0x41, 0x37, 0x05, 0x1f, 0x81, 0xf3, 0x7c, 0xe7,
+	0x67, 0x15, 0xce, 0xad, 0x76, 0x95, 0x1a, 0x93, 0x4a, 0xab, 0xc4, 0xea, 0x30, 0x44, 0x13, 0x47, 0xec, 0x79, 0xa2, 0x41, 0x0c, 0xdd, 0x42, 0xdf, 0xbf, 0x02,
+	0xef, 0x9e, 0x67, 0x7e, 0x1e, 0xb0, 0x2a, 0x7f, 0x97, 0xf3, 0x5a, 0xbc, 0x21, 0x8d, 0xf9, 0xc3, 0x30, 0x45, 0xfe, 0x72, 0x74, 0x04, 0x53, 0x99, 0xe7, 0xd1,
+	0x2b, 0xb6, 0x3a, 0x9c, 0x84, 0x0e, 0x15, 0x5e, 0x75, 0x3b, 0xc9, 0x0e, 0x94, 0xe6, 0x48, 0x0e, 0x37, 0x07, 0xf8, 0xd9, 0x59, 0x4b, 0x04, 0x50};
+
+TEST(RAW_PACKET, ETH_IP6_IP4_TCP_SSH)
+{
+    char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser, 0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data2, sizeof(data2), g_packet_io_logger);
+	raw_traffic_decapsulate(&raw_parser, (char *)data2, sizeof(data2), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header == nullptr);
+    EXPECT_TRUE(header_len == 0);
+
+}
+
+/******************************************************************************
+ * Pcap file: 3-ETH_VLAN_IP6_IP4_GRE_PPP_IP4_UDP_DNS.pcap
+ * [Protocols in frame: eth:ethertype:vlan:ethertype:ipv6:ip:gre:ppp:ip:udp:dns]
+ ******************************************************************************
+ *
+ * Frame 1: 272 bytes on wire (2176 bits), 272 bytes captured (2176 bits)
+ * Ethernet II, Src: Cisco_e6:82:c4 (00:19:06:e6:82:c4), Dst: 10:01:00:00:61:3d (10:01:00:00:61:3d)
+ * 	Destination: 10:01:00:00:61:3d (10:01:00:00:61:3d)
+ * 	Source: Cisco_e6:82:c4 (00:19:06:e6:82:c4)
+ * 	Type: 802.1Q Virtual LAN (0x8100)
+ * 802.1Q Virtual LAN, PRI: 0, DEI: 0, ID: 100
+ * 	000. .... .... .... = Priority: Best Effort (default) (0)
+ * 	...0 .... .... .... = DEI: Ineligible
+ * 	.... 0000 0110 0100 = ID: 100
+ * 	Type: IPv6 (0x86dd)
+ * Internet Protocol Version 6, Src: 2607:fcd0:100:2300::b108:2a6b, Dst: 2402:f000:1:8e01::5555
+ * 	0110 .... = Version: 6
+ * 	.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	.... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
+ * 	Payload Length: 214
+ * 	Next Header: IPIP (4)
+ * 	Hop Limit: 57
+ * 	Source Address: 2607:fcd0:100:2300::b108:2a6b
+ * 	Destination Address: 2402:f000:1:8e01::5555
+ * Internet Protocol Version 4, Src: 192.52.166.154, Dst: 16.0.0.200
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	Total Length: 214
+ * 	Identification: 0x842f (33839)
+ * 	010. .... = Flags: 0x2, Don't fragment
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 64
+ * 	Protocol: Generic Routing Encapsulation (47)
+ * 	Header Checksum: 0x3e33 [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 192.52.166.154
+ * 	Destination Address: 16.0.0.200
+ * Generic Routing Encapsulation (PPP)
+ * 	Flags and Version: 0x3081
+ * 	Protocol Type: PPP (0x880b)
+ * 	Payload Length: 178
+ * 	Call ID: 17
+ * 	Sequence Number: 538640
+ * 	Acknowledgment Number: 429725
+ * Point-to-Point Protocol
+ * 	Address: 0xff
+ * 	Control: 0x03
+ * 	Protocol: Internet Protocol version 4 (0x0021)
+ * Internet Protocol Version 4, Src: 8.8.8.8, Dst: 172.16.44.3
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	Total Length: 174
+ * 	Identification: 0x2f9c (12188)
+ * 	000. .... = Flags: 0x0
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 50
+ * 	Protocol: UDP (17)
+ * 	Header Checksum: 0x7080 [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 8.8.8.8
+ * 	Destination Address: 172.16.44.3
+ * User Datagram Protocol, Src Port: 53, Dst Port: 9879
+ * 	Source Port: 53
+ * 	Destination Port: 9879
+ * 	Length: 154
+ * 	Checksum: 0x45d9 [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	[Stream index: 0]
+ * 	[Timestamps]
+ * 	UDP payload (146 bytes)
+ * Domain Name System (response)
+ */
+
+unsigned char data3[] = {
+	0x10, 0x01, 0x00, 0x00, 0x61, 0x3d, 0x00, 0x19, 0x06, 0xe6, 0x82, 0xc4, 0x81, 0x00, 0x00, 0x64, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0xd6, 0x04, 0x39,
+	0x26, 0x07, 0xfc, 0xd0, 0x01, 0x00, 0x23, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb1, 0x08, 0x2a, 0x6b, 0x24, 0x02, 0xf0, 0x00, 0x00, 0x01, 0x8e, 0x01, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x55, 0x55, 0x45, 0x00, 0x00, 0xd6, 0x84, 0x2f, 0x40, 0x00, 0x40, 0x2f, 0x3e, 0x33, 0xc0, 0x34, 0xa6, 0x9a, 0x10, 0x00, 0x00, 0xc8,
+	0x30, 0x81, 0x88, 0x0b, 0x00, 0xb2, 0x00, 0x11, 0x00, 0x08, 0x38, 0x10, 0x00, 0x06, 0x8e, 0x9d, 0xff, 0x03, 0x00, 0x21, 0x45, 0x00, 0x00, 0xae, 0x2f, 0x9c,
+	0x00, 0x00, 0x32, 0x11, 0x70, 0x80, 0x08, 0x08, 0x08, 0x08, 0xac, 0x10, 0x2c, 0x03, 0x00, 0x35, 0x26, 0x97, 0x00, 0x9a, 0x45, 0xd9, 0xb4, 0xe2, 0x81, 0x83,
+	0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x35, 0x78, 0x71, 0x74, 0x2d, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x2d, 0x6d, 0x6f, 0x64, 0x65, 0x32, 0x2d,
+	0x37, 0x38, 0x63, 0x30, 0x36, 0x64, 0x63, 0x37, 0x2d, 0x30, 0x34, 0x61, 0x37, 0x2d, 0x34, 0x38, 0x35, 0x33, 0x2d, 0x38, 0x34, 0x38, 0x33, 0x2d, 0x61, 0x35,
+	0x36, 0x32, 0x38, 0x39, 0x37, 0x36, 0x65, 0x32, 0x33, 0x33, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x06, 0x00, 0x01, 0x00, 0x00, 0x02, 0xf0, 0x00, 0x40,
+	0x01, 0x61, 0x0c, 0x72, 0x6f, 0x6f, 0x74, 0x2d, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x03, 0x6e, 0x65, 0x74, 0x00, 0x05, 0x6e, 0x73, 0x74, 0x6c, 0x64,
+	0x0c, 0x76, 0x65, 0x72, 0x69, 0x73, 0x69, 0x67, 0x6e, 0x2d, 0x67, 0x72, 0x73, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x78, 0x0d, 0x09, 0x09, 0x00, 0x00, 0x07, 0x08,
+	0x00, 0x00, 0x03, 0x84, 0x00, 0x09, 0x3a, 0x80, 0x00, 0x01, 0x51, 0x80};
+
+TEST(RAW_PACKET, ETH_VLAN_IP6_IP4_GRE_PPP_IP4_UDP_DNS)
+{
+	char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser,0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data3, sizeof(data3), g_packet_io_logger);
+    raw_traffic_decapsulate(&raw_parser, (char *)data3, sizeof(data3), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header == nullptr);
+    EXPECT_TRUE(header_len == 0);
+}
+
+/******************************************************************************
+ * Pcap file: 4-ETH_IP4_IP6_TCP.pcap
+ * [Protocols in frame: eth:ethertype:ip:ipv6:tcp]
+ ******************************************************************************
+ *
+ * Frame 1: 106 bytes on wire (848 bits), 106 bytes captured (848 bits)
+ * Ethernet II, Src: JuniperN_45:88:29 (2c:6b:f5:45:88:29), Dst: JuniperN_2a:a2:00 (5c:5e:ab:2a:a2:00)
+ * 	Destination: JuniperN_2a:a2:00 (5c:5e:ab:2a:a2:00)
+ * 	Source: JuniperN_45:88:29 (2c:6b:f5:45:88:29)
+ * 	Type: IPv4 (0x0800)
+ * Internet Protocol Version 4, Src: 210.77.88.163, Dst: 59.66.4.50
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	Total Length: 92
+ * 	Identification: 0x0b4d (2893)
+ * 	000. .... = Flags: 0x0
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 59
+ * 	Protocol: IPv6 (41)
+ * 	Header Checksum: 0x09c8 [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 210.77.88.163
+ * 	Destination Address: 59.66.4.50
+ * Internet Protocol Version 6, Src: 2001:da8:200:900e:200:5efe:d24d:58a3, Dst: 2600:140e:6::1702:1058
+ * 	0110 .... = Version: 6
+ * 	.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	.... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
+ * 	Payload Length: 32
+ * 	Next Header: TCP (6)
+ * 	Hop Limit: 64
+ * 	Source Address: 2001:da8:200:900e:200:5efe:d24d:58a3
+ * 	Destination Address: 2600:140e:6::1702:1058
+ * 	[Source ISATAP IPv4: 210.77.88.163]
+ * Transmission Control Protocol, Src Port: 52556, Dst Port: 80, Seq: 0, Len: 0
+ * 	Source Port: 52556
+ * 	Destination Port: 80
+ * 	[Stream index: 0]
+ * 	[Conversation completeness: Complete, WITH_DATA (31)]
+ * 	[TCP Segment Len: 0]
+ * 	Sequence Number: 0    (relative sequence number)
+ * 	Sequence Number (raw): 2172673142
+ * 	[Next Sequence Number: 1    (relative sequence number)]
+ * 	Acknowledgment Number: 0
+ * 	Acknowledgment number (raw): 0
+ * 	1000 .... = Header Length: 32 bytes (8)
+ * 	Flags: 0x002 (SYN)
+ * 	Window: 8192
+ * 	[Calculated window size: 8192]
+ * 	Checksum: 0xf757 [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	Urgent Pointer: 0
+ * 	Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted
+ * 	[Timestamps]
+ */
+
+unsigned char data4[] = {
+	0x5c, 0x5e, 0xab, 0x2a, 0xa2, 0x00, 0x2c, 0x6b, 0xf5, 0x45, 0x88, 0x29, 0x08, 0x00, 0x45, 0x00, 0x00, 0x5c, 0x0b, 0x4d, 0x00, 0x00, 0x3b, 0x29, 0x09, 0xc8,
+	0xd2, 0x4d, 0x58, 0xa3, 0x3b, 0x42, 0x04, 0x32, 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x06, 0x40, 0x20, 0x01, 0x0d, 0xa8, 0x02, 0x00, 0x90, 0x0e, 0x02, 0x00,
+	0x5e, 0xfe, 0xd2, 0x4d, 0x58, 0xa3, 0x26, 0x00, 0x14, 0x0e, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, 0x02, 0x10, 0x58, 0xcd, 0x4c, 0x00, 0x50,
+	0x81, 0x80, 0x5c, 0x76, 0x00, 0x00, 0x00, 0x00, 0x80, 0x02, 0x20, 0x00, 0xf7, 0x57, 0x00, 0x00, 0x02, 0x04, 0x04, 0xc4, 0x01, 0x03, 0x03, 0x08, 0x01, 0x01,
+	0x04, 0x02};
+
+TEST(RAW_PACKET, ETH_IP4_IP6_TCP)
+{
+	char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser,0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data4, sizeof(data4), g_packet_io_logger);
+    raw_traffic_decapsulate(&raw_parser, (char *)data4, sizeof(data4), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header == nullptr);
+    EXPECT_TRUE(header_len == 0);
+}
+
+/******************************************************************************
+ * Pcap file: 5-ETH_IP6_IP6_UDP.pcap
+ * [Protocols in frame: eth:ethertype:ipv6:ipv6:udp:data]
+ ******************************************************************************
+ *
+ * Frame 1: 106 bytes on wire (848 bits), 106 bytes captured (848 bits)
+ * Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
+ *     Destination: Broadcast (ff:ff:ff:ff:ff:ff)
+ *     Source: 00:00:00_00:00:00 (00:00:00:00:00:00)
+ *     Type: IPv6 (0x86dd)
+ * Internet Protocol Version 6, Src: 2001:4f8:4:7:2e0:81ff:fe52:ffff, Dst: 2001:4f8:4:7:2e0:81ff:fe52:9a6b
+ *     0110 .... = Version: 6
+ *     .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ *     .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
+ *     Payload Length: 52
+ *     Next Header: IPv6 (41)
+ *     Hop Limit: 64
+ *     Source Address: 2001:4f8:4:7:2e0:81ff:fe52:ffff
+ *     Destination Address: 2001:4f8:4:7:2e0:81ff:fe52:9a6b
+ *     [Source SLAAC MAC: TyanComp_52:ff:ff (00:e0:81:52:ff:ff)]
+ *     [Destination SLAAC MAC: TyanComp_52:9a:6b (00:e0:81:52:9a:6b)]
+ * Internet Protocol Version 6, Src: dead::beef, Dst: cafe::babe
+ *     0110 .... = Version: 6
+ *     .... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ *     .... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
+ *     Payload Length: 12
+ *     Next Header: UDP (17)
+ *     Hop Limit: 64
+ *     Source Address: dead::beef
+ *     Destination Address: cafe::babe
+ * User Datagram Protocol, Src Port: 30000, Dst Port: 13000
+ *     Source Port: 30000
+ *     Destination Port: 13000
+ *     Length: 12
+ *     Checksum: 0x83d2 [unverified]
+ *     [Checksum Status: Unverified]
+ *     [Stream index: 0]
+ *     [Timestamps]
+ *     UDP payload (4 bytes)
+ * Data (4 bytes)
+ */
+
+unsigned char data5[] = {
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x00, 0x34, 0x29, 0x40, 0x20, 0x01, 0x04, 0xf8,
+	0x00, 0x04, 0x00, 0x07, 0x02, 0xe0, 0x81, 0xff, 0xfe, 0x52, 0xff, 0xff, 0x20, 0x01, 0x04, 0xf8, 0x00, 0x04, 0x00, 0x07, 0x02, 0xe0, 0x81, 0xff, 0xfe, 0x52,
+	0x9a, 0x6b, 0x60, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x11, 0x40, 0xde, 0xad, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xbe, 0xef,
+	0xca, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xba, 0xbe, 0x75, 0x30, 0x32, 0xc8, 0x00, 0x0c, 0x83, 0xd2, 0x58, 0x58,
+	0x58, 0x58};
+
+TEST(RAW_PACKET, ETH_IP6_IP6_UDP)
+{
+	char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser,0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data5, sizeof(data5), g_packet_io_logger);
+    raw_traffic_decapsulate(&raw_parser, (char *)data5, sizeof(data5), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header == nullptr);
+    EXPECT_TRUE(header_len == 0);
+}
+
+/******************************************************************************
+ * Pcap file: 6-ETH_MPLS_IP4_TCP.pcap
+ * [Protocols in frame: eth:ethertype:mpls:ip:tcp]
+ ******************************************************************************
+ *
+ * Frame 1: 70 bytes on wire (560 bits), 70 bytes captured (560 bits)
+ * Ethernet II, Src: Hangzhou_d9:28:cc (00:23:89:d9:28:cc), Dst: HuaweiTe_7f:eb:f7 (d4:6a:a8:7f:eb:f7)
+ * 	Destination: HuaweiTe_7f:eb:f7 (d4:6a:a8:7f:eb:f7)
+ * 	Source: Hangzhou_d9:28:cc (00:23:89:d9:28:cc)
+ * 	Type: MPLS label switched packet (0x8847)
+ * MultiProtocol Label Switching Header, Label: 18, Exp: 6, S: 1, TTL: 254
+ * 	0000 0000 0000 0001 0010 .... .... .... = MPLS Label: 18 (0x00012)
+ * 	.... .... .... .... .... 110. .... .... = MPLS Experimental Bits: 6
+ * 	.... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1
+ * 	.... .... .... .... .... .... 1111 1110 = MPLS TTL: 254
+ * Internet Protocol Version 4, Src: 119.40.37.65, Dst: 123.125.29.250
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	Total Length: 52
+ * 	Identification: 0x02a1 (673)
+ * 	010. .... = Flags: 0x2, Don't fragment
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 126
+ * 	Protocol: TCP (6)
+ * 	Header Checksum: 0xc442 [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 119.40.37.65
+ * 	Destination Address: 123.125.29.250
+ * Transmission Control Protocol, Src Port: 61853, Dst Port: 80, Seq: 0, Len: 0
+ * 	Source Port: 61853
+ * 	Destination Port: 80
+ * 	[Stream index: 0]
+ * 	[Conversation completeness: Complete, WITH_DATA (31)]
+ * 	[TCP Segment Len: 0]
+ * 	Sequence Number: 0    (relative sequence number)
+ * 	Sequence Number (raw): 1710561749
+ * 	[Next Sequence Number: 1    (relative sequence number)]
+ * 	Acknowledgment Number: 0
+ * 	Acknowledgment number (raw): 0
+ * 	1000 .... = Header Length: 32 bytes (8)
+ * 	Flags: 0x002 (SYN)
+ * 	Window: 8192
+ * 	[Calculated window size: 8192]
+ * 	Checksum: 0xa777 [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	Urgent Pointer: 0
+ * 	Options: (12 bytes), Maximum segment size, No-Operation (NOP), Window scale, No-Operation (NOP), No-Operation (NOP), SACK permitted
+ * 	[Timestamps]
+ */
+
+unsigned char data6[] = {
+	0xd4, 0x6a, 0xa8, 0x7f, 0xeb, 0xf7, 0x00, 0x23, 0x89, 0xd9, 0x28, 0xcc, 0x88, 0x47, 0x00, 0x01, 0x2d, 0xfe, 0x45, 0x00, 0x00, 0x34, 0x02, 0xa1, 0x40, 0x00,
+	0x7e, 0x06, 0xc4, 0x42, 0x77, 0x28, 0x25, 0x41, 0x7b, 0x7d, 0x1d, 0xfa, 0xf1, 0x9d, 0x00, 0x50, 0x65, 0xf5, 0x19, 0xd5, 0x00, 0x00, 0x00, 0x00, 0x80, 0x02,
+	0x20, 0x00, 0xa7, 0x77, 0x00, 0x00, 0x02, 0x04, 0x05, 0xb4, 0x01, 0x03, 0x03, 0x08, 0x01, 0x01, 0x04, 0x02};
+
+TEST(RAW_PACKET, ETH_MPLS_IP4_TCP)
+{
+	char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser,0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data6, sizeof(data6), g_packet_io_logger);
+    raw_traffic_decapsulate(&raw_parser, (char *)data6, sizeof(data6), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header != nullptr);
+    EXPECT_TRUE(header_len == 18);
+}
+
+/******************************************************************************
+ * Pcap file: 7-ETH_MPLS_MPLS_IP4_TCP.pcap
+ * [Protocols in frame: eth:ethertype:mpls:ip:tcp]
+ ******************************************************************************
+ *
+ * Frame 1: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
+ * Ethernet II, Src: Cisco_05:28:38 (00:30:96:05:28:38), Dst: Cisco_e6:fc:39 (00:30:96:e6:fc:39)
+ * 	Destination: Cisco_e6:fc:39 (00:30:96:e6:fc:39)
+ * 	Source: Cisco_05:28:38 (00:30:96:05:28:38)
+ * 	Type: MPLS label switched packet (0x8847)
+ * MultiProtocol Label Switching Header, Label: 18, Exp: 5, S: 0, TTL: 255
+ * 	0000 0000 0000 0001 0010 .... .... .... = MPLS Label: 18 (0x00012)
+ * 	.... .... .... .... .... 101. .... .... = MPLS Experimental Bits: 5
+ * 	.... .... .... .... .... ...0 .... .... = MPLS Bottom Of Label Stack: 0
+ * 	.... .... .... .... .... .... 1111 1111 = MPLS TTL: 255
+ * MultiProtocol Label Switching Header, Label: 16, Exp: 5, S: 1, TTL: 255
+ * 	0000 0000 0000 0001 0000 .... .... .... = MPLS Label: 16 (0x00010)
+ * 	.... .... .... .... .... 101. .... .... = MPLS Experimental Bits: 5
+ * 	.... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1
+ * 	.... .... .... .... .... .... 1111 1111 = MPLS TTL: 255
+ * Internet Protocol Version 4, Src: 10.31.0.1, Dst: 10.34.0.1
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0xb0 (DSCP: Unknown, ECN: Not-ECT)
+ * 	Total Length: 44
+ * 	Identification: 0x0000 (0)
+ * 	000. .... = Flags: 0x0
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 255
+ * 	Protocol: TCP (6)
+ * 	Header Checksum: 0xa6d9 [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 10.31.0.1
+ * 	Destination Address: 10.34.0.1
+ * Transmission Control Protocol, Src Port: 11001, Dst Port: 23, Seq: 0, Len: 0
+ * 	Source Port: 11001
+ * 	Destination Port: 23
+ * 	[Stream index: 0]
+ * 	[Conversation completeness: Incomplete (29)]
+ * 	[TCP Segment Len: 0]
+ * 	Sequence Number: 0    (relative sequence number)
+ * 	Sequence Number (raw): 3481568569
+ * 	[Next Sequence Number: 1    (relative sequence number)]
+ * 	Acknowledgment Number: 0
+ * 	Acknowledgment number (raw): 0
+ * 	0110 .... = Header Length: 24 bytes (6)
+ * 	Flags: 0x002 (SYN)
+ * 	Window: 4128
+ * 	[Calculated window size: 4128]
+ * 	Checksum: 0xf791 [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	Urgent Pointer: 0
+ * 	Options: (4 bytes), Maximum segment size
+ * 	[Timestamps]
+ */
+
+unsigned char data7[] = {
+	0x00, 0x30, 0x96, 0xe6, 0xfc, 0x39, 0x00, 0x30, 0x96, 0x05, 0x28, 0x38, 0x88, 0x47, 0x00, 0x01, 0x2a, 0xff, 0x00, 0x01, 0x0b, 0xff, 0x45, 0xb0, 0x00, 0x2c,
+	0x00, 0x00, 0x00, 0x00, 0xff, 0x06, 0xa6, 0xd9, 0x0a, 0x1f, 0x00, 0x01, 0x0a, 0x22, 0x00, 0x01, 0x2a, 0xf9, 0x00, 0x17, 0xcf, 0x84, 0x85, 0x39, 0x00, 0x00,
+	0x00, 0x00, 0x60, 0x02, 0x10, 0x20, 0xf7, 0x91, 0x00, 0x00, 0x02, 0x04, 0x02, 0x18};
+
+TEST(RAW_PACKET, ETH_MPLS_MPLS_IP4_TCP)
+{
+	char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser,0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data7, sizeof(data7), g_packet_io_logger);
+    raw_traffic_decapsulate(&raw_parser, (char *)data7, sizeof(data7), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header != nullptr);
+    EXPECT_TRUE(header_len == 22);
+}
+
+/******************************************************************************
+ * Pcap file: 8-ETH_VLAN_PPPOE_IP4_TCP.pcap
+ * [Protocols in frame: eth:ethertype:vlan:ethertype:pppoes:ppp:ip:tcp]
+ ******************************************************************************
+ *
+ * Frame 55: 78 bytes on wire (624 bits), 78 bytes captured (624 bits)
+ * Ethernet II, Src: 00:00:00_00:04:46 (00:00:00:00:04:46), Dst: 18:10:04:00:02:27 (18:10:04:00:02:27)
+ * 	Destination: 18:10:04:00:02:27 (18:10:04:00:02:27)
+ * 	Source: 00:00:00_00:04:46 (00:00:00:00:04:46)
+ * 	Type: 802.1Q Virtual LAN (0x8100)
+ * 802.1Q Virtual LAN, PRI: 3, DEI: 0, ID: 1476
+ * 	011. .... .... .... = Priority: Critical Applications (3)
+ * 	...0 .... .... .... = DEI: Ineligible
+ * 	.... 0101 1100 0100 = ID: 1476
+ * 	Type: PPPoE Session (0x8864)
+ * PPP-over-Ethernet Session
+ * 	0001 .... = Version: 1
+ * 	.... 0001 = Type: 1
+ * 	Code: Session Data (0x00)
+ * 	Session ID: 0xb4bc
+ * 	Payload Length: 54
+ * Point-to-Point Protocol
+ * 	Protocol: Internet Protocol version 4 (0x0021)
+ * Internet Protocol Version 4, Src: 100.65.55.0, Dst: 91.185.14.33
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	Total Length: 52
+ * 	Identification: 0x4ba7 (19367)
+ * 	010. .... = Flags: 0x2, Don't fragment
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 63
+ * 	Protocol: TCP (6)
+ * 	Header Checksum: 0xeb01 [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 100.65.55.0
+ * 	Destination Address: 91.185.14.33
+ * Transmission Control Protocol, Src Port: 34532, Dst Port: 443, Seq: 491, Ack: 54523, Len: 0
+ * 	Source Port: 34532
+ * 	Destination Port: 443
+ * 	[Stream index: 0]
+ * 	[Conversation completeness: Incomplete (12)]
+ * 	[TCP Segment Len: 0]
+ * 	Sequence Number: 491    (relative sequence number)
+ * 	Sequence Number (raw): 3064322674
+ * 	[Next Sequence Number: 491    (relative sequence number)]
+ * 	Acknowledgment Number: 54523    (relative ack number)
+ * 	Acknowledgment number (raw): 2083649568
+ * 	1000 .... = Header Length: 32 bytes (8)
+ * 	Flags: 0x010 (ACK)
+ * 	Window: 4032
+ * 	[Calculated window size: 4032]
+ * 	[Window size scaling factor: -1 (unknown)]
+ * 	Checksum: 0xc361 [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	Urgent Pointer: 0
+ * 	Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
+ * 	[Timestamps]
+ * 	[SEQ/ACK analysis]
+ */
+
+unsigned char data8[] = {
+	0x18, 0x10, 0x04, 0x00, 0x02, 0x27, 0x00, 0x00, 0x00, 0x00, 0x04, 0x46, 0x81, 0x00, 0x65, 0xc4, 0x88, 0x64, 0x11, 0x00, 0xb4, 0xbc, 0x00, 0x36, 0x00, 0x21,
+	0x45, 0x00, 0x00, 0x34, 0x4b, 0xa7, 0x40, 0x00, 0x3f, 0x06, 0xeb, 0x01, 0x64, 0x41, 0x37, 0x00, 0x5b, 0xb9, 0x0e, 0x21, 0x86, 0xe4, 0x01, 0xbb, 0xb6, 0xa5,
+	0xda, 0x72, 0x7c, 0x31, 0xf8, 0x20, 0x80, 0x10, 0x0f, 0xc0, 0xc3, 0x61, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x00, 0x6f, 0xab, 0xdf, 0x9c, 0x61, 0xc7, 0xc5};
+
+TEST(RAW_PACKET, ETH_VLAN_PPPOE_IP4_TCP)
+{
+	char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser,0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data8, sizeof(data8), g_packet_io_logger);
+    raw_traffic_decapsulate(&raw_parser, (char *)data8, sizeof(data8), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header != nullptr);
+    EXPECT_TRUE(header_len == 26);
+}
+
+/******************************************************************************
+ * Pcap file: 9-ETH_IP6_UDP_GTP_IP6_TCP_TLS.pcap
+ * [Protocols in frame: eth:ethertype:ipv6:udp:gtp:ipv6:tcp:ja3:tls]
+ ******************************************************************************
+ *
+ * Frame 1: 1442 bytes on wire (11536 bits), 1442 bytes captured (11536 bits)
+ * Ethernet II, Src: zte_0e:f5:40 (74:4a:a4:0e:f5:40), Dst: HuaweiTe_40:e9:c2 (ac:b3:b5:40:e9:c2)
+ * 	Destination: HuaweiTe_40:e9:c2 (ac:b3:b5:40:e9:c2)
+ * 	Source: zte_0e:f5:40 (74:4a:a4:0e:f5:40)
+ * 	Type: IPv6 (0x86dd)
+ * Internet Protocol Version 6, Src: 2409:8034:4040:5300::105, Dst: 2409:8034:4025::60:61
+ * 	0110 .... = Version: 6
+ * 	.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	.... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
+ * 	Payload Length: 1388
+ * 	Next Header: UDP (17)
+ * 	Hop Limit: 127
+ * 	Source Address: 2409:8034:4040:5300::105
+ * 	Destination Address: 2409:8034:4025::60:61
+ * User Datagram Protocol, Src Port: 2152, Dst Port: 2152
+ * 	Source Port: 2152
+ * 	Destination Port: 2152
+ * 	Length: 1388
+ * 	Checksum: 0xeb00 [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	[Stream index: 0]
+ * 	[Timestamps]
+ * 	UDP payload (1380 bytes)
+ * GPRS Tunneling Protocol
+ * 	Flags: 0x30
+ * 	Message Type: T-PDU (0xff)
+ * 	Length: 1372
+ * 	TEID: 0x024c3cbd (38550717)
+ * Internet Protocol Version 6, Src: 2409:8c34:4400:700:0:4:0:3, Dst: 2409:8934:5082:2100:ecad:e0e4:530a:c269
+ * 	0110 .... = Version: 6
+ * 	.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	.... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
+ * 	Payload Length: 1332
+ * 	Next Header: TCP (6)
+ * 	Hop Limit: 56
+ * 	Source Address: 2409:8c34:4400:700:0:4:0:3
+ * 	Destination Address: 2409:8934:5082:2100:ecad:e0e4:530a:c269
+ * Transmission Control Protocol, Src Port: 443, Dst Port: 46582, Seq: 1, Ack: 1, Len: 1312
+ * 	Source Port: 443
+ * 	Destination Port: 46582
+ * 	[Stream index: 0]
+ * 	[Conversation completeness: Incomplete (8)]
+ * 	[TCP Segment Len: 1312]
+ * 	Sequence Number: 1    (relative sequence number)
+ * 	Sequence Number (raw): 2198097831
+ * 	[Next Sequence Number: 1313    (relative sequence number)]
+ * 	Acknowledgment Number: 1    (relative ack number)
+ * 	Acknowledgment number (raw): 2264498872
+ * 	0101 .... = Header Length: 20 bytes (5)
+ * 	Flags: 0x010 (ACK)
+ * 	Window: 529
+ * 	[Calculated window size: 529]
+ * 	[Window size scaling factor: -1 (unknown)]
+ * 	Checksum: 0x2c4b [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	Urgent Pointer: 0
+ * 	[Timestamps]
+ * 	[SEQ/ACK analysis]
+ * 	TCP payload (1312 bytes)
+ * Transport Layer Security
+ */
+
+unsigned char data9[] = {
+	0xac, 0xb3, 0xb5, 0x40, 0xe9, 0xc2, 0x74, 0x4a, 0xa4, 0x0e, 0xf5, 0x40, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x05, 0x6c, 0x11, 0x7f, 0x24, 0x09, 0x80, 0x34,
+	0x40, 0x40, 0x53, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x05, 0x24, 0x09, 0x80, 0x34, 0x40, 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x60,
+	0x00, 0x61, 0x08, 0x68, 0x08, 0x68, 0x05, 0x6c, 0xeb, 0x00, 0x30, 0xff, 0x05, 0x5c, 0x02, 0x4c, 0x3c, 0xbd, 0x60, 0x00, 0x00, 0x00, 0x05, 0x34, 0x06, 0x38,
+	0x24, 0x09, 0x8c, 0x34, 0x44, 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x03, 0x24, 0x09, 0x89, 0x34, 0x50, 0x82, 0x21, 0x00, 0xec, 0xad,
+	0xe0, 0xe4, 0x53, 0x0a, 0xc2, 0x69, 0x01, 0xbb, 0xb5, 0xf6, 0x83, 0x04, 0x4f, 0xa7, 0x86, 0xf9, 0x82, 0xb8, 0x50, 0x10, 0x02, 0x11, 0x2c, 0x4b, 0x00, 0x00,
+	0x17, 0x03, 0x03, 0x3c, 0x8c, 0x87, 0xa0, 0x99, 0x23, 0x5b, 0x53, 0x4a, 0x12, 0x1b, 0xf8, 0xba, 0xe8, 0x83, 0xc2, 0x95, 0xda, 0xb8, 0xea, 0x5b, 0xdc, 0x84,
+	0x61, 0xa9, 0x86, 0x7e, 0x43, 0xc7, 0x31, 0x44, 0x6e, 0x11, 0xc1, 0x30, 0x21, 0x03, 0xb4, 0x21, 0x4a, 0xee, 0xc9, 0x2e, 0x14, 0xd2, 0x98, 0x63, 0x12, 0xfe,
+	0x79, 0x58, 0xb3, 0x18, 0xa6, 0x8d, 0x0c, 0x62, 0x67, 0x51, 0xef, 0x02, 0x5a, 0xa8, 0xb3, 0x82, 0x1f, 0xe4, 0x51, 0xba, 0xde, 0xee, 0x83, 0x9c, 0x4e, 0xac,
+	0x4d, 0xa2, 0xb7, 0x6a, 0x82, 0xe7, 0xbb, 0x00, 0xf7, 0x5a, 0xe7, 0x02, 0x71, 0x7e, 0x7d, 0x6f, 0xf2, 0xe5, 0x47, 0xd0, 0xba, 0x3c, 0x51, 0x09, 0x95, 0xcd,
+	0xf6, 0xc9, 0x8b, 0x6f, 0xb0, 0x39, 0x11, 0x0d, 0xe9, 0x0d, 0x4d, 0x29, 0xd4, 0xcb, 0x87, 0xba, 0x11, 0xfa, 0x0d, 0x0b, 0x82, 0x95, 0xa5, 0x84, 0x94, 0x48,
+	0xa2, 0xee, 0xa4, 0xb7, 0xb6, 0x76, 0x13, 0x4d, 0x18, 0x42, 0x91, 0x77, 0xad, 0x82, 0x38, 0xee, 0x34, 0x1c, 0xb7, 0xf6, 0x39, 0xdc, 0xa4, 0x23, 0xa1, 0x7c,
+	0xa5, 0x0b, 0x7e, 0x4c, 0x8b, 0x81, 0x31, 0x48, 0xea, 0xf4, 0x18, 0x37, 0x09, 0x0a, 0x53, 0x13, 0x05, 0x90, 0x26, 0x10, 0x69, 0xb2, 0xa3, 0x36, 0xbc, 0xa5,
+	0x83, 0xd8, 0x16, 0x77, 0x98, 0xc8, 0x21, 0x38, 0xd9, 0x88, 0x0c, 0xa7, 0x16, 0x97, 0x4e, 0x20, 0x6d, 0x68, 0xda, 0x1b, 0x3b, 0x4a, 0x62, 0xe0, 0x36, 0x0d,
+	0xbf, 0x30, 0x71, 0xb1, 0xe9, 0xbe, 0x47, 0x77, 0x99, 0xb9, 0xe6, 0x26, 0xab, 0x81, 0x2e, 0x46, 0xf1, 0x1b, 0x1e, 0xfb, 0xd7, 0x81, 0x60, 0x21, 0x4a, 0x71,
+	0x85, 0xf7, 0x9c, 0x9c, 0xd4, 0x1c, 0x52, 0xc4, 0x3d, 0x8d, 0x72, 0xf6, 0x7c, 0xd3, 0x58, 0x79, 0x0d, 0x78, 0xd7, 0x7c, 0x29, 0x2b, 0xc3, 0x96, 0x1d, 0xc7,
+	0x96, 0x50, 0x42, 0xd7, 0xda, 0xeb, 0x29, 0x8e, 0x2a, 0x72, 0x23, 0x57, 0x0f, 0x6f, 0x37, 0x35, 0xb2, 0x42, 0x76, 0x78, 0xbf, 0xbf, 0x8c, 0x3f, 0x31, 0xa2,
+	0x51, 0xec, 0x9e, 0x0d, 0xfd, 0xf2, 0xaf, 0x71, 0xa0, 0x4f, 0xa9, 0xf6, 0x19, 0xcf, 0x3e, 0x4b, 0xc8, 0xaa, 0x38, 0x06, 0xa1, 0x15, 0xde, 0xde, 0xef, 0x9b,
+	0x25, 0xa3, 0xcc, 0x47, 0xca, 0x29, 0x30, 0x65, 0x5f, 0xc1, 0x8b, 0x12, 0x63, 0x79, 0xcd, 0x57, 0x4d, 0x99, 0xc0, 0xcd, 0xbe, 0x62, 0xcb, 0xc3, 0xf2, 0x6b,
+	0x0b, 0x40, 0xc5, 0xee, 0x79, 0x0a, 0xa4, 0x75, 0x56, 0xe7, 0xe7, 0xf2, 0xfd, 0xe0, 0x72, 0x78, 0x04, 0xa2, 0x50, 0x31, 0x09, 0x8b, 0x57, 0xc3, 0x85, 0x4e,
+	0xc4, 0xae, 0xde, 0x8a, 0xfa, 0xf6, 0x31, 0x06, 0xd2, 0x07, 0x25, 0x40, 0xce, 0x0d, 0xfd, 0x26, 0x98, 0x41, 0xa3, 0xa9, 0xa2, 0x8d, 0x8b, 0x7f, 0x6d, 0x63,
+	0x87, 0x7e, 0x75, 0x2f, 0x78, 0xc9, 0xd5, 0x04, 0xb2, 0x4f, 0xc9, 0x94, 0xa7, 0x7f, 0xbc, 0x75, 0x7b, 0xb6, 0xfb, 0x2c, 0x46, 0xf6, 0xde, 0x36, 0x31, 0x2a,
+	0x32, 0x1d, 0x7f, 0x30, 0x9e, 0x4a, 0x84, 0x69, 0x66, 0xac, 0xef, 0xbe, 0xb3, 0x83, 0x8c, 0xb8, 0x30, 0xd2, 0x3f, 0xcf, 0xb5, 0xbb, 0x65, 0xaa, 0xe7, 0x6b,
+	0x74, 0x48, 0x2c, 0xb2, 0x72, 0x2b, 0x78, 0xaf, 0xd0, 0x71, 0x04, 0xa9, 0xb4, 0x65, 0xd9, 0xfc, 0x74, 0x23, 0xff, 0x89, 0xc1, 0x16, 0x23, 0xac, 0x59, 0x16,
+	0x89, 0x41, 0xc3, 0xdb, 0xdb, 0x5b, 0x9a, 0x3d, 0x08, 0xc4, 0x12, 0x28, 0xf8, 0x10, 0xa5, 0xad, 0xc6, 0x81, 0xc0, 0x61, 0x48, 0xba, 0x9d, 0xef, 0xc7, 0xf8,
+	0xad, 0x9a, 0xbd, 0x87, 0xfa, 0x7f, 0xa2, 0x4e, 0x4d, 0xe0, 0x19, 0xd5, 0x47, 0xc7, 0xd0, 0xfb, 0x00, 0x7b, 0xbf, 0x17, 0x80, 0xfe, 0xf5, 0x27, 0xec, 0x94,
+	0x44, 0x3d, 0x4a, 0x34, 0x49, 0x60, 0xb4, 0x8d, 0x71, 0x6d, 0x9c, 0xf4, 0x4c, 0x33, 0xa9, 0x49, 0x58, 0x58, 0x6f, 0xe1, 0xd1, 0x7d, 0x36, 0x51, 0xf4, 0xd8,
+	0x0d, 0x0b, 0xfc, 0xeb, 0xae, 0x58, 0x06, 0x08, 0xbf, 0x67, 0x07, 0x28, 0x7e, 0x68, 0x65, 0x79, 0x86, 0xfb, 0x43, 0x0f, 0x0a, 0xef, 0xd0, 0x97, 0x33, 0x10,
+	0x7a, 0x20, 0xe8, 0x22, 0xe5, 0xdc, 0x0c, 0xa2, 0xa5, 0x50, 0x1b, 0x08, 0x15, 0xc2, 0xec, 0xd2, 0x06, 0x25, 0xd0, 0x3b, 0xfd, 0xe3, 0xa2, 0x6f, 0x41, 0x15,
+	0x6d, 0x9f, 0x5f, 0xc4, 0x07, 0x5c, 0x99, 0x63, 0xd9, 0xd7, 0xdc, 0x90, 0xc9, 0x8f, 0x3a, 0x4b, 0x6a, 0x84, 0xe8, 0x3c, 0xc7, 0x71, 0x50, 0x71, 0x86, 0x71,
+	0x7d, 0x54, 0x84, 0x7b, 0xb7, 0xca, 0xd5, 0x42, 0xaf, 0x88, 0xa5, 0xae, 0xa4, 0x9c, 0xfd, 0x71, 0x71, 0x0f, 0x67, 0xaa, 0x1b, 0x61, 0xd7, 0xf4, 0x50, 0x21,
+	0x9d, 0x80, 0x6e, 0x54, 0xcd, 0xb6, 0xb9, 0x02, 0x3e, 0x59, 0x50, 0xff, 0xf2, 0xda, 0x21, 0x5c, 0x50, 0x6d, 0x64, 0x8c, 0x33, 0x75, 0x2a, 0xa4, 0x56, 0xb3,
+	0xa8, 0xdb, 0xba, 0xbe, 0x52, 0xd4, 0xe5, 0x29, 0x68, 0xe2, 0x6b, 0x94, 0x6b, 0xb3, 0x90, 0x63, 0x91, 0x1a, 0x95, 0xb5, 0xd7, 0x10, 0x1b, 0xd9, 0x93, 0x4f,
+	0x33, 0xb6, 0x6a, 0x4e, 0xcd, 0x40, 0x9d, 0x47, 0x76, 0x3e, 0x4b, 0xc7, 0x2f, 0x16, 0x96, 0x64, 0x9d, 0x4e, 0x8c, 0xfb, 0x0f, 0xd2, 0xec, 0x6c, 0xba, 0xf2,
+	0x9c, 0xca, 0xd2, 0x3e, 0x64, 0x37, 0x32, 0x20, 0xd7, 0x4c, 0xb0, 0xe7, 0xd3, 0x75, 0x51, 0x3a, 0x94, 0xc1, 0xdf, 0x1c, 0xb3, 0x10, 0xd5, 0x1e, 0xcf, 0x7c,
+	0xb7, 0xab, 0x4a, 0x93, 0xf0, 0x78, 0x58, 0x28, 0x63, 0x10, 0xee, 0xb0, 0xd6, 0x14, 0x81, 0x47, 0xeb, 0x2e, 0xc8, 0x6e, 0x33, 0x7e, 0xf3, 0x2d, 0xc8, 0xdb,
+	0x29, 0x0c, 0x80, 0xe4, 0x2f, 0x10, 0x07, 0x8e, 0x08, 0x86, 0x97, 0x1b, 0x39, 0x98, 0x39, 0x06, 0xb3, 0x85, 0x53, 0xb7, 0xbb, 0x65, 0x65, 0x85, 0x0e, 0x0a,
+	0x7d, 0x29, 0x3d, 0x3f, 0x52, 0xc2, 0x7b, 0x2b, 0x30, 0x94, 0x99, 0x6a, 0x4b, 0xad, 0xe9, 0xec, 0xcb, 0xcd, 0xae, 0x97, 0x45, 0x54, 0xd5, 0x00, 0x5e, 0xd8,
+	0xac, 0xeb, 0x99, 0xdc, 0x58, 0x0b, 0x01, 0xeb, 0x32, 0x22, 0xc4, 0xec, 0x4f, 0xd2, 0x15, 0x03, 0x30, 0x88, 0xc7, 0x28, 0xaf, 0x78, 0xf5, 0x38, 0x84, 0x3b,
+	0x3b, 0xe9, 0x29, 0x71, 0x50, 0xa3, 0x07, 0x49, 0x3b, 0xc6, 0x97, 0xc6, 0xf9, 0x53, 0x95, 0x51, 0x65, 0x7e, 0xd7, 0xd4, 0xe8, 0x76, 0x6a, 0x6d, 0x37, 0x6b,
+	0xa5, 0x59, 0xaa, 0x14, 0x18, 0x8c, 0x8d, 0x65, 0x78, 0x67, 0xfb, 0x60, 0x56, 0xab, 0x04, 0xa0, 0xc2, 0x93, 0x46, 0xf1, 0x2b, 0x0d, 0x3b, 0x38, 0x62, 0x62,
+	0x5e, 0xc8, 0x30, 0xf9, 0x45, 0x28, 0x6f, 0xa1, 0xb1, 0x88, 0xf1, 0x2b, 0x3b, 0xf8, 0xae, 0x91, 0x52, 0xc3, 0x72, 0x86, 0xe4, 0xec, 0xc3, 0x54, 0x86, 0xbf,
+	0x8f, 0x33, 0xb1, 0x0f, 0x42, 0xc5, 0x9c, 0xb8, 0xc2, 0x67, 0x8b, 0xac, 0x78, 0xd7, 0x63, 0xab, 0x05, 0xc6, 0x6c, 0x37, 0xa1, 0x28, 0xef, 0x95, 0xc9, 0xf5,
+	0x12, 0x38, 0x54, 0x34, 0x2e, 0x03, 0x6a, 0xaa, 0xa9, 0x97, 0x72, 0x22, 0x9f, 0x20, 0xec, 0x9e, 0x29, 0x09, 0xd8, 0x38, 0xd1, 0x86, 0x82, 0x99, 0xbd, 0x2a,
+	0x03, 0xe9, 0x3d, 0xbd, 0xea, 0xc5, 0x8b, 0xb0, 0x4c, 0x8b, 0x7e, 0x78, 0x08, 0xef, 0x39, 0xa8, 0xb4, 0x47, 0xce, 0x44, 0xc3, 0x3f, 0x52, 0xe4, 0xbd, 0x9e,
+	0xf6, 0xed, 0x6f, 0x6c, 0x05, 0x19, 0xa6, 0x0a, 0x1e, 0x48, 0xe3, 0x9b, 0x91, 0x61, 0xef, 0xf5, 0x91, 0x39, 0x70, 0x44, 0x1c, 0x08, 0x2e, 0x2c, 0x6c, 0x27,
+	0xb9, 0x0e, 0xcc, 0x74, 0x69, 0xa5, 0xf8, 0x19, 0xd6, 0xbf, 0x57, 0x6c, 0x9a, 0x91, 0x74, 0xfd, 0xc2, 0x31, 0x32, 0x12, 0x06, 0xa3, 0x69, 0x71, 0xda, 0x40,
+	0xa1, 0xf3, 0xb5, 0x9a, 0x43, 0xcc, 0xb4, 0x3c, 0x16, 0x40, 0x65, 0x2b, 0x02, 0xac, 0x5c, 0xae, 0xd6, 0x34, 0x34, 0xe3, 0x69, 0x76, 0x2c, 0xa8, 0xdd, 0x04,
+	0x92, 0xa6, 0x7a, 0xc0, 0x87, 0x70, 0x8b, 0x85, 0xba, 0x5d, 0xbb, 0x62, 0x70, 0xcc, 0x1f, 0x21, 0x2c, 0x7e, 0xc3, 0x77, 0xcf, 0x23, 0x22, 0xf4, 0x16, 0x8e,
+	0xf1, 0x3d, 0xdc, 0x33, 0x99, 0x5e, 0xaa, 0xa2, 0x50, 0x68, 0xde, 0x03, 0x44, 0xbb, 0xc7, 0x16, 0x2a, 0xf2, 0x08, 0xeb, 0x3d, 0x12, 0x6d, 0xcb, 0x2a, 0xaf,
+	0xb4, 0x79, 0xdb, 0x74, 0x5e, 0x54, 0x89, 0x73, 0x0c, 0x48, 0x9c, 0x03, 0x33, 0xd2, 0x92, 0x22, 0xdb, 0x3a, 0xa0, 0x8c, 0xe2, 0x30, 0x6f, 0x39, 0xe4, 0xa9,
+	0x24, 0x04, 0xbb, 0x85, 0x7d, 0x62, 0xc5, 0xa9, 0x98, 0x92, 0xef, 0xc6, 0xc8, 0xd1, 0x81, 0xad, 0x95, 0x40, 0x27, 0x09, 0xc7, 0x43, 0xcd, 0xb6, 0x94, 0xfc,
+	0x1c, 0x7d, 0x1c, 0xd3, 0x47, 0xfe, 0x62, 0x9c, 0xfa, 0xeb, 0xfc, 0x02, 0x2e, 0x48, 0x62, 0xcf, 0x63, 0xdb, 0x63, 0xd9, 0x21, 0x86, 0xe8, 0x96, 0x54, 0xeb,
+	0x6a, 0xa8, 0x78, 0x3c, 0x5b, 0xb6, 0xde, 0xa9, 0x04, 0x48, 0x63, 0xb2, 0x10, 0x02, 0x6a, 0x7f, 0x6d, 0xc8, 0x04, 0xdd, 0x99, 0x25, 0x08, 0xff, 0x80, 0x11,
+	0x53, 0xfb, 0x7a, 0x07, 0x39, 0xd9, 0x97, 0xca, 0xf0, 0xa7, 0x46, 0x9c, 0xc2, 0xae, 0x2e, 0x05, 0x62, 0xa0, 0xd5, 0x5d, 0x17, 0x0e, 0x5c, 0x7e, 0x9a, 0xb2,
+	0xb7, 0x9d, 0xd4, 0x4f, 0xe3, 0xac, 0x64, 0xdb, 0x6f, 0x1d, 0xdf, 0xd8, 0x41, 0xd7, 0xd9, 0x50, 0x55, 0x30, 0xeb, 0x4b, 0x19, 0xce, 0x78, 0x1f, 0xa8, 0x1e,
+	0x87, 0x9c, 0x8f, 0x93, 0x97, 0xd4, 0xa2, 0x28, 0x2c, 0x79, 0x22, 0xc8};
+
+TEST(RAW_PACKET, ETH_IP6_UDP_GTP_IP6_TCP_TLS)
+{
+	char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser,0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data9, sizeof(data9), g_packet_io_logger);
+    raw_traffic_decapsulate(&raw_parser, (char *)data9, sizeof(data9), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header == nullptr);
+    EXPECT_TRUE(header_len == 0);
+}
+
+/******************************************************************************
+ * Pcap file: 10-ETH_IP6_UDP_GTP_IP4_TCP_TLS.pcap
+ * [Protocols in frame: eth:ethertype:ipv6:udp:gtp:ip:tcp:ja3:tls]
+ ******************************************************************************
+ *
+ * Frame 1: 1470 bytes on wire (11760 bits), 1470 bytes captured (11760 bits)
+ * Ethernet II, Src: HuaweiTe_62:ee:70 (60:d7:55:62:ee:70), Dst: zte_0e:f5:1c (74:4a:a4:0e:f5:1c)
+ * 	Destination: zte_0e:f5:1c (74:4a:a4:0e:f5:1c)
+ * 	Source: HuaweiTe_62:ee:70 (60:d7:55:62:ee:70)
+ * 	Type: IPv6 (0x86dd)
+ * Internet Protocol Version 6, Src: 2409:8034:4025::50:a31, Dst: 2409:8034:4040:5301::204
+ * 	0110 .... = Version: 6
+ * 	.... 0000 0000 .... .... .... .... .... = Traffic Class: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	.... 0000 0000 0000 0000 0000 = Flow Label: 0x00000
+ * 	Payload Length: 1416
+ * 	Next Header: UDP (17)
+ * 	Hop Limit: 252
+ * 	Source Address: 2409:8034:4025::50:a31
+ * 	Destination Address: 2409:8034:4040:5301::204
+ * User Datagram Protocol, Src Port: 2152, Dst Port: 2152
+ * 	Source Port: 2152
+ * 	Destination Port: 2152
+ * 	Length: 1416
+ * 	Checksum: 0xc8df [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	[Stream index: 0]
+ * 	[Timestamps]
+ * 	UDP payload (1408 bytes)
+ * GPRS Tunneling Protocol
+ * 	Flags: 0x30
+ * 	Message Type: T-PDU (0xff)
+ * 	Length: 1400
+ * 	TEID: 0x6c2a4753 (1814710099)
+ * Internet Protocol Version 4, Src: 10.49.115.138, Dst: 121.196.250.66
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	Total Length: 1400
+ * 	Identification: 0x0003 (3)
+ * 	010. .... = Flags: 0x2, Don't fragment
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 64
+ * 	Protocol: TCP (6)
+ * 	Header Checksum: 0x43bb [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 10.49.115.138
+ * 	Destination Address: 121.196.250.66
+ * Transmission Control Protocol, Src Port: 50081, Dst Port: 443, Seq: 1, Ack: 1, Len: 1348
+ * 	Source Port: 50081
+ * 	Destination Port: 443
+ * 	[Stream index: 0]
+ * 	[Conversation completeness: Incomplete (8)]
+ * 	[TCP Segment Len: 1348]
+ * 	Sequence Number: 1    (relative sequence number)
+ * 	Sequence Number (raw): 1522577104
+ * 	[Next Sequence Number: 1349    (relative sequence number)]
+ * 	Acknowledgment Number: 1    (relative ack number)
+ * 	Acknowledgment number (raw): 3419365570
+ * 	1000 .... = Header Length: 32 bytes (8)
+ * 	Flags: 0x010 (ACK)
+ * 	Window: 2038
+ * 	[Calculated window size: 2038]
+ * 	[Window size scaling factor: -1 (unknown)]
+ * 	Checksum: 0xd3c2 [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	Urgent Pointer: 0
+ * 	Options: (12 bytes), No-Operation (NOP), No-Operation (NOP), Timestamps
+ * 	[Timestamps]
+ * 	[SEQ/ACK analysis]
+ * 	TCP payload (1348 bytes)
+ * Transport Layer Security
+ */
+
+unsigned char data10[] = {
+	0x74, 0x4a, 0xa4, 0x0e, 0xf5, 0x1c, 0x60, 0xd7, 0x55, 0x62, 0xee, 0x70, 0x86, 0xdd, 0x60, 0x00, 0x00, 0x00, 0x05, 0x88, 0x11, 0xfc, 0x24, 0x09, 0x80, 0x34,
+	0x40, 0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x0a, 0x31, 0x24, 0x09, 0x80, 0x34, 0x40, 0x40, 0x53, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x02, 0x04, 0x08, 0x68, 0x08, 0x68, 0x05, 0x88, 0xc8, 0xdf, 0x30, 0xff, 0x05, 0x78, 0x6c, 0x2a, 0x47, 0x53, 0x45, 0x00, 0x05, 0x78, 0x00, 0x03, 0x40, 0x00,
+	0x40, 0x06, 0x43, 0xbb, 0x0a, 0x31, 0x73, 0x8a, 0x79, 0xc4, 0xfa, 0x42, 0xc3, 0xa1, 0x01, 0xbb, 0x5a, 0xc0, 0xae, 0xd0, 0xcb, 0xcf, 0x60, 0xc2, 0x80, 0x10,
+	0x07, 0xf6, 0xd3, 0xc2, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x85, 0x14, 0x0e, 0xb0, 0xcc, 0x45, 0xf8, 0x5f, 0xef, 0x49, 0x45, 0xa0, 0xbe, 0x21, 0xd6, 0x46,
+	0x9f, 0xb5, 0x17, 0xb2, 0xfe, 0x61, 0x2d, 0xed, 0x4f, 0x0c, 0x1e, 0xb5, 0xda, 0x91, 0x40, 0x87, 0xab, 0x02, 0x0d, 0x01, 0xc8, 0xf1, 0x24, 0x05, 0x8a, 0x9d,
+	0x8d, 0xfc, 0xbb, 0x82, 0x24, 0xf5, 0x7d, 0x2d, 0x10, 0x66, 0x30, 0x2a, 0xaa, 0x4a, 0x51, 0x8d, 0xe9, 0x9a, 0x65, 0xcf, 0x89, 0x0c, 0x9e, 0x0d, 0x82, 0xda,
+	0x5e, 0xd3, 0x98, 0xe3, 0x23, 0xf7, 0x5a, 0xd4, 0x88, 0x94, 0xd2, 0xdf, 0xbe, 0x44, 0x20, 0x2b, 0x21, 0x2d, 0x38, 0xca, 0x29, 0x5e, 0xa3, 0xb7, 0xbb, 0x34,
+	0x20, 0x42, 0x02, 0x71, 0x04, 0xda, 0xd2, 0xeb, 0xb8, 0x81, 0xa3, 0x48, 0xc8, 0x54, 0xad, 0x42, 0x35, 0xc4, 0x4f, 0x6b, 0x15, 0x50, 0x22, 0x3e, 0x26, 0xb3,
+	0xfc, 0x30, 0x49, 0x71, 0x6f, 0x41, 0x66, 0xa2, 0x2e, 0xe9, 0xd3, 0x1a, 0x69, 0xa8, 0x87, 0x71, 0x65, 0xa2, 0xc7, 0xc7, 0x2b, 0x25, 0x1d, 0x3f, 0xfb, 0xe6,
+	0x05, 0xe1, 0x09, 0xb9, 0x76, 0x1d, 0xb9, 0xf9, 0xaf, 0xb4, 0x79, 0xa1, 0x35, 0x05, 0x59, 0x88, 0xa0, 0x07, 0xb5, 0x2d, 0x02, 0x11, 0x0a, 0x89, 0xf1, 0x67,
+	0xdb, 0xe5, 0x5c, 0x5c, 0xaa, 0x0e, 0x21, 0xa6, 0xa4, 0x1a, 0x9f, 0x9e, 0xc8, 0x2a, 0x36, 0x6f, 0xcc, 0xa3, 0x13, 0x78, 0xf1, 0xbe, 0x34, 0xa0, 0x35, 0xef,
+	0x1f, 0xf4, 0x79, 0xcb, 0x37, 0x3e, 0x77, 0x14, 0xfb, 0x2e, 0x21, 0x4f, 0x6b, 0xe5, 0xe9, 0x3a, 0x90, 0x76, 0xa8, 0x55, 0x09, 0xb6, 0x68, 0xbf, 0x66, 0xae,
+	0xf1, 0x55, 0xc0, 0x76, 0x8f, 0x16, 0x86, 0x49, 0x9a, 0x88, 0x01, 0xdb, 0x78, 0x1f, 0xde, 0xc2, 0x33, 0x92, 0xe3, 0x22, 0xc6, 0x8c, 0x20, 0x17, 0xa0, 0xb2,
+	0x79, 0xf4, 0x60, 0x8e, 0x98, 0x53, 0xcd, 0x8f, 0xb2, 0x8f, 0x80, 0xda, 0x9f, 0xf6, 0x00, 0x0c, 0xf8, 0x6b, 0xdf, 0x7d, 0x93, 0x48, 0x5a, 0x23, 0x35, 0x0e,
+	0x1b, 0xf7, 0x50, 0x87, 0x93, 0x29, 0xaa, 0xa1, 0xb8, 0x98, 0x9f, 0x89, 0xb2, 0x0a, 0x02, 0x27, 0x95, 0x01, 0x84, 0x5a, 0x09, 0xb8, 0xff, 0x23, 0x02, 0x89,
+	0xef, 0x1b, 0x64, 0xb2, 0x38, 0x81, 0xc4, 0x36, 0xe3, 0xda, 0xb5, 0x3b, 0x80, 0x45, 0x52, 0x96, 0xab, 0x0e, 0xdb, 0xb6, 0x9c, 0xcb, 0xc4, 0xe5, 0xb9, 0x72,
+	0x67, 0x57, 0x4b, 0xb9, 0x55, 0xcb, 0x6b, 0xc4, 0xec, 0x46, 0x4d, 0xa3, 0xe0, 0xda, 0xba, 0x70, 0x3d, 0xa6, 0xa7, 0x3f, 0x58, 0xd2, 0x9f, 0xb0, 0x11, 0x66,
+	0xaf, 0x73, 0x09, 0x60, 0x6e, 0xe0, 0x71, 0xa5, 0x65, 0x41, 0x28, 0x3e, 0x70, 0x1d, 0x25, 0x77, 0x6a, 0x4e, 0xed, 0xb9, 0x27, 0x6c, 0xf0, 0xba, 0x54, 0x8d,
+	0x77, 0xfb, 0xb6, 0x4e, 0xe2, 0xab, 0x8f, 0xe3, 0xd4, 0x02, 0x65, 0x0a, 0x49, 0xf3, 0xf9, 0xc7, 0x09, 0x76, 0x81, 0xf4, 0xf8, 0x3e, 0x1f, 0x74, 0x30, 0xaf,
+	0x3b, 0x9e, 0x97, 0x00, 0xde, 0xd8, 0x9a, 0xaf, 0xcc, 0x72, 0xeb, 0x0a, 0xe7, 0xab, 0xc1, 0x53, 0x62, 0x3f, 0x08, 0xba, 0x43, 0x06, 0x13, 0x0a, 0x3b, 0x5c,
+	0xb4, 0xe0, 0xc8, 0xa6, 0x41, 0x45, 0xaa, 0x1a, 0xc9, 0x88, 0x86, 0x31, 0x25, 0x02, 0x4a, 0x76, 0x66, 0xb6, 0x6d, 0xff, 0x50, 0x1d, 0x3c, 0xf3, 0x2d, 0xfe,
+	0x7b, 0xb2, 0x75, 0x5d, 0x9a, 0x9a, 0xe5, 0x39, 0x31, 0x4f, 0x7b, 0xa5, 0x6f, 0x94, 0xed, 0x31, 0xd4, 0x61, 0xc7, 0x44, 0x1d, 0x37, 0x19, 0x76, 0x04, 0x0e,
+	0xbd, 0xc4, 0x9e, 0xe3, 0xdf, 0x94, 0x49, 0x32, 0x65, 0xd0, 0x37, 0x64, 0xb5, 0x2a, 0x61, 0x2d, 0x05, 0xc5, 0xe5, 0x79, 0x3e, 0xcf, 0x5f, 0x77, 0x0a, 0x7c,
+	0x29, 0x34, 0x1a, 0x45, 0x7e, 0x11, 0x68, 0xb4, 0x3a, 0xf6, 0x5b, 0x23, 0xe4, 0x32, 0xa4, 0x11, 0x1a, 0xba, 0xd6, 0x4a, 0x45, 0x42, 0x29, 0xac, 0xb0, 0x17,
+	0x05, 0x1b, 0xee, 0xf6, 0x52, 0x6d, 0x8b, 0xb4, 0x3b, 0x63, 0xe2, 0xca, 0xbf, 0x7e, 0xd3, 0xf7, 0x96, 0x75, 0x67, 0x9d, 0x27, 0x15, 0x39, 0xde, 0x5f, 0x66,
+	0x74, 0x7c, 0x46, 0x01, 0x48, 0xf7, 0x99, 0x33, 0x7d, 0xc6, 0x81, 0xc4, 0x82, 0x09, 0x00, 0x20, 0x3f, 0x5c, 0xe4, 0x51, 0x88, 0x5b, 0xac, 0x31, 0x17, 0x04,
+	0xa4, 0xac, 0xbf, 0x3d, 0xff, 0xad, 0x51, 0x07, 0x0b, 0xc7, 0x26, 0xa7, 0x9f, 0x83, 0x17, 0xd8, 0x2f, 0x6a, 0x47, 0x96, 0x14, 0x47, 0x68, 0xd4, 0xc0, 0xc0,
+	0x3b, 0x87, 0x51, 0x30, 0xe9, 0xfa, 0x21, 0x46, 0x80, 0x1a, 0x5a, 0xef, 0x78, 0xd0, 0x3a, 0xac, 0x73, 0x1e, 0x39, 0xba, 0x82, 0x43, 0x5d, 0xef, 0x15, 0x2c,
+	0x9a, 0xe5, 0xeb, 0x6a, 0xe7, 0x24, 0x12, 0xe6, 0x2a, 0xd2, 0x09, 0xc2, 0x85, 0x69, 0x9d, 0x73, 0x16, 0xb0, 0xad, 0x51, 0xf8, 0x3d, 0x94, 0x6b, 0xb7, 0xb3,
+	0x7f, 0xb4, 0x9e, 0xc1, 0xdc, 0x31, 0x27, 0xa1, 0x2d, 0xfe, 0x30, 0x15, 0x04, 0x20, 0x82, 0xdc, 0xbd, 0x8b, 0xc5, 0xb4, 0xcf, 0x91, 0x85, 0xae, 0x21, 0x5e,
+	0x00, 0x10, 0x04, 0x62, 0x8a, 0xe2, 0x66, 0x74, 0xf8, 0x8d, 0x8b, 0x52, 0x17, 0xd9, 0x1a, 0xbd, 0x06, 0x2d, 0x07, 0x6a, 0xf5, 0x8b, 0xdf, 0x85, 0x2e, 0x36,
+	0xec, 0x15, 0x6f, 0x7e, 0xd2, 0x04, 0x43, 0x6a, 0xd7, 0x60, 0xf5, 0x53, 0x0d, 0x2e, 0x2d, 0xf5, 0x52, 0x4c, 0xcc, 0xe5, 0xf4, 0x47, 0xdd, 0x34, 0xda, 0xc1,
+	0xfc, 0x60, 0x00, 0xaa, 0x68, 0x01, 0x5c, 0x82, 0x4b, 0xf9, 0x57, 0x54, 0x9d, 0xd5, 0x8b, 0xb6, 0x42, 0x77, 0xd4, 0x47, 0x70, 0x23, 0x4c, 0xad, 0xc5, 0x00,
+	0x73, 0x9b, 0xbb, 0x65, 0xa7, 0x46, 0x74, 0xcd, 0x2e, 0x61, 0x0f, 0xac, 0xeb, 0x53, 0x5a, 0x87, 0x70, 0xfc, 0x5d, 0x2e, 0xa1, 0xe3, 0x9a, 0x87, 0x01, 0x0f,
+	0x2e, 0xef, 0x10, 0xe2, 0x82, 0xd8, 0x12, 0xe7, 0xb8, 0x94, 0xa4, 0xdd, 0x5f, 0xea, 0x21, 0x63, 0x26, 0x43, 0xec, 0xc3, 0x54, 0x76, 0xb1, 0xb2, 0x1c, 0x03,
+	0x4c, 0x5c, 0x22, 0xb5, 0x00, 0x7d, 0x77, 0x3a, 0xb6, 0xbf, 0x50, 0xbd, 0xfd, 0x0a, 0x31, 0x2c, 0xdc, 0xab, 0xe2, 0xc0, 0x0b, 0xb6, 0x66, 0xad, 0x9c, 0xca,
+	0x94, 0xed, 0xd8, 0x77, 0x1b, 0xf1, 0x94, 0xdd, 0x65, 0x61, 0xda, 0x7b, 0x04, 0x3c, 0x93, 0xcf, 0x96, 0x74, 0x35, 0x8e, 0x41, 0xe1, 0xa4, 0xbc, 0xf2, 0x4f,
+	0xe9, 0xb8, 0x16, 0x55, 0x05, 0x5a, 0xac, 0x10, 0xd3, 0xdf, 0xea, 0x6a, 0xf8, 0xe0, 0xf3, 0xdf, 0x66, 0x00, 0xab, 0x3d, 0xb9, 0x44, 0x65, 0x34, 0x49, 0x89,
+	0xf2, 0x1d, 0x09, 0xc9, 0xfc, 0xa5, 0x84, 0xa1, 0x03, 0x5b, 0x7a, 0x5c, 0x7e, 0x21, 0xe9, 0xb4, 0x3a, 0x4c, 0x2b, 0x94, 0x64, 0x1d, 0x9b, 0xa5, 0xbf, 0x7e,
+	0x1c, 0x97, 0x7e, 0x3d, 0xbe, 0x84, 0xfc, 0xab, 0x6d, 0x2a, 0x50, 0x23, 0x9e, 0x11, 0x3f, 0xe2, 0xa0, 0x68, 0xe7, 0xd5, 0xba, 0x5e, 0x24, 0x8c, 0x4c, 0x46,
+	0xe6, 0x5b, 0x10, 0xc3, 0x82, 0x32, 0x17, 0x32, 0xdc, 0xec, 0xaa, 0x1e, 0x73, 0xe5, 0x7d, 0xb8, 0x1c, 0x6c, 0x4c, 0x9f, 0x60, 0x7b, 0x66, 0x4c, 0x90, 0x69,
+	0xc4, 0x23, 0x66, 0x67, 0xce, 0x6d, 0x24, 0x1d, 0xcc, 0x8e, 0x78, 0xa1, 0xa7, 0xde, 0x87, 0x81, 0xac, 0x62, 0x54, 0xbc, 0x47, 0x82, 0x3c, 0xad, 0x92, 0x29,
+	0xd9, 0xc0, 0xed, 0x0c, 0x11, 0x0e, 0xc5, 0x75, 0xa4, 0xbd, 0xbf, 0xcb, 0x3a, 0xaf, 0x2b, 0x9f, 0xbe, 0xbb, 0xbc, 0x31, 0x07, 0xa7, 0xbe, 0x6c, 0xa9, 0x4e,
+	0xff, 0x35, 0x80, 0x2f, 0x09, 0x77, 0xe0, 0xc0, 0xdc, 0x9c, 0xc6, 0xa6, 0x63, 0xab, 0x47, 0x74, 0x5f, 0x5c, 0xae, 0x75, 0xbf, 0x42, 0x67, 0x55, 0x89, 0xcf,
+	0xd3, 0x65, 0x8d, 0x5b, 0x6f, 0x5c, 0xf9, 0xd1, 0x78, 0xa2, 0xfd, 0x4f, 0x54, 0x6a, 0x71, 0x0c, 0x58, 0x13, 0xb0, 0x48, 0x0a, 0x7b, 0xcc, 0x84, 0x61, 0xa7,
+	0x7d, 0x39, 0xa2, 0xd1, 0xc0, 0xdb, 0x8e, 0x97, 0x20, 0x86, 0x97, 0x20, 0xda, 0xca, 0x56, 0x78, 0x61, 0xc2, 0x2f, 0x36, 0xdb, 0x95, 0xae, 0x7e, 0x8d, 0x97,
+	0xcb, 0x45, 0x6a, 0x6d, 0x27, 0xaa, 0xab, 0x4e, 0x88, 0x23, 0xb6, 0x6a, 0x8a, 0xca, 0x71, 0xca, 0x39, 0xa2, 0x98, 0x0d, 0x53, 0xa9, 0x38, 0xd5, 0x9c, 0x5d,
+	0x0e, 0x5e, 0xc9, 0xeb, 0x21, 0xab, 0x00, 0xca, 0xff, 0x92, 0x20, 0x9d, 0x65, 0x9d, 0x8d, 0x49, 0x46, 0xbe, 0x51, 0x97, 0xc1, 0x61, 0x02, 0x9e, 0xa8, 0xb9,
+	0x2c, 0x27, 0x7d, 0x73, 0xf9, 0x12, 0x16, 0x45, 0x25, 0xbb, 0xb0, 0x51, 0x14, 0x18, 0x07, 0xab, 0xc7, 0x06, 0xc0, 0xe9, 0x1c, 0xf8, 0x6d, 0xe1, 0x80, 0x21,
+	0x21, 0x68, 0x24, 0xf7, 0x28, 0xb9, 0x07, 0xd4, 0xd7, 0xdf, 0x3e, 0xff, 0xbc, 0xe3, 0xbc, 0x6e, 0x42, 0x76, 0x63, 0xbc, 0x82, 0x0a, 0xf5, 0x99, 0x65, 0x17,
+	0xd2, 0x38, 0xa9, 0xa8, 0x31, 0xce, 0x1f, 0xf7, 0xef, 0x8d, 0x94, 0xae, 0x99, 0x50, 0x30, 0x12, 0xbd, 0x4b, 0x65, 0x56, 0x59, 0xfb, 0x33, 0x7b, 0x99, 0xc7,
+	0xe5, 0x80, 0xe6, 0x92, 0x0e, 0x44, 0x1d, 0x17, 0xc2, 0xd0, 0x78, 0x76, 0x9d, 0x5b, 0x7d, 0x3c, 0xb4, 0xf8, 0xcb, 0x2f, 0x83, 0x23, 0x35, 0x49, 0xc0, 0x78,
+	0x2d, 0x44, 0x05, 0x64, 0x0f, 0xaa, 0x84, 0x9d, 0x3f, 0xac, 0xef, 0x5b, 0x46, 0x44, 0xb8, 0x15, 0xbe, 0x4f, 0xe7, 0x25, 0xb7, 0xa0, 0xc8, 0x0f, 0x70, 0x1a,
+	0xca, 0x7f, 0xce, 0x79, 0x7b, 0xf5, 0x7e, 0x21, 0x35, 0xc7, 0x0e, 0x99, 0xdc, 0x76, 0xe0, 0x36, 0x09, 0x6e, 0x6d, 0x5f, 0x98, 0x5e, 0xb8, 0xa4, 0x88, 0xea,
+	0x0b, 0x4b, 0x21, 0xa2, 0x52, 0x86, 0x95, 0x4e, 0x18, 0xac, 0xa2, 0xaf, 0x29, 0x5b, 0xe7, 0x05, 0xa1, 0xc8, 0xe1, 0x80, 0xfa, 0xb6, 0x5a, 0xed, 0x94, 0x32,
+	0x4f, 0xe9, 0xf5, 0xf0, 0x61, 0x5d, 0x7f, 0xc4, 0xc4, 0xd1, 0x05, 0x54, 0x13, 0xdb};
+
+TEST(RAW_PACKET, ETH_IP6_UDP_GTP_IP4_TCP_TLS)
+{
+	char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser,0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data10, sizeof(data10), g_packet_io_logger);
+    raw_traffic_decapsulate(&raw_parser, (char *)data10, sizeof(data10), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header == nullptr);
+    EXPECT_TRUE(header_len == 0);
+}
+
+/******************************************************************************
+ * Pcap file: 11-ETH_IP4_UDP_VXLAN_ETH_IP4_UDP_DNS.pcap
+ * [Protocols in frame: eth:ethertype:ip:udp:vxlan:eth:ethertype:ip:udp:dns]
+ ******************************************************************************
+ *
+ * Frame 1: 124 bytes on wire (992 bits), 124 bytes captured (992 bits)
+ * Ethernet II, Src: zte_6c:fa:43 (00:1e:73:6c:fa:43), Dst: Shanghai_0d:0a (e4:95:6e:20:0d:0a)
+ * 	Destination: Shanghai_0d:0a (e4:95:6e:20:0d:0a)
+ * 	Source: zte_6c:fa:43 (00:1e:73:6c:fa:43)
+ * 	Type: IPv4 (0x0800)
+ * Internet Protocol Version 4, Src: 10.1.1.1, Dst: 192.168.1.10
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	Total Length: 110
+ * 	Identification: 0x0000 (0)
+ * 	000. .... = Flags: 0x0
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 254
+ * 	Protocol: UDP (17)
+ * 	Header Checksum: 0xefca [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 10.1.1.1
+ * 	Destination Address: 192.168.1.10
+ * User Datagram Protocol, Src Port: 50709, Dst Port: 4789
+ * 	Source Port: 50709
+ * 	Destination Port: 4789
+ * 	Length: 90
+ * 	Checksum: 0x0000 [zero-value ignored]
+ * 	[Stream index: 0]
+ * 	[Timestamps]
+ * 	UDP payload (82 bytes)
+ * Virtual eXtensible Local Area Network
+ * 	Flags: 0x0800, VXLAN Network ID (VNI)
+ * 	Group Policy ID: 0
+ * 	VXLAN Network Identifier (VNI): 458755
+ * 	Reserved: 0
+ * Ethernet II, Src: WistronI_18:18:41 (3c:97:0e:18:18:41), Dst: DawningI_13:70:7a (e8:61:1f:13:70:7a)
+ * 	Destination: DawningI_13:70:7a (e8:61:1f:13:70:7a)
+ * 	Source: WistronI_18:18:41 (3c:97:0e:18:18:41)
+ * 	Type: IPv4 (0x0800)
+ * Internet Protocol Version 4, Src: 192.168.11.193, Dst: 114.114.114.114
+ * 	0100 .... = Version: 4
+ * 	.... 0101 = Header Length: 20 bytes (5)
+ * 	Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)
+ * 	Total Length: 60
+ * 	Identification: 0x0cb6 (3254)
+ * 	000. .... = Flags: 0x0
+ * 	...0 0000 0000 0000 = Fragment Offset: 0
+ * 	Time to Live: 64
+ * 	Protocol: UDP (17)
+ * 	Header Checksum: 0xbcad [validation disabled]
+ * 	[Header checksum status: Unverified]
+ * 	Source Address: 192.168.11.193
+ * 	Destination Address: 114.114.114.114
+ * User Datagram Protocol, Src Port: 65290, Dst Port: 53
+ * 	Source Port: 65290
+ * 	Destination Port: 53
+ * 	Length: 40
+ * 	Checksum: 0x39e4 [unverified]
+ * 	[Checksum Status: Unverified]
+ * 	[Stream index: 1]
+ * 	[Timestamps]
+ * 	UDP payload (32 bytes)
+ * Domain Name System (query)
+ */
+
+unsigned char data11[] = {
+	0xe4, 0x95, 0x6e, 0x20, 0x0d, 0x0a, 0x00, 0x1e, 0x73, 0x6c, 0xfa, 0x43, 0x08, 0x00, 0x45, 0x00, 0x00, 0x6e, 0x00, 0x00, 0x00, 0x00, 0xfe, 0x11, 0xef, 0xca,
+	0x0a, 0x01, 0x01, 0x01, 0xc0, 0xa8, 0x01, 0x0a, 0xc6, 0x15, 0x12, 0xb5, 0x00, 0x5a, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x07, 0x00, 0x03, 0x00, 0xe8, 0x61,
+	0x1f, 0x13, 0x70, 0x7a, 0x3c, 0x97, 0x0e, 0x18, 0x18, 0x41, 0x08, 0x00, 0x45, 0x00, 0x00, 0x3c, 0x0c, 0xb6, 0x00, 0x00, 0x40, 0x11, 0xbc, 0xad, 0xc0, 0xa8,
+	0x0b, 0xc1, 0x72, 0x72, 0x72, 0x72, 0xff, 0x0a, 0x00, 0x35, 0x00, 0x28, 0x39, 0xe4, 0x86, 0x84, 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x03, 0x77, 0x77, 0x77, 0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x03, 0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01};
+
+TEST(RAW_PACKET, ETH_IP4_UDP_VXLAN_ETH_IP4_UDP_DNS)
+{
+	char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser,0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data11, sizeof(data11), g_packet_io_logger);
+    raw_traffic_decapsulate(&raw_parser, (char *)data11, sizeof(data11), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header == nullptr);
+    EXPECT_TRUE(header_len == 0);
+}
+
+/******************************************************************************
+ * Pcap file: 12-ETH_MPLS_MPLS_PWETHCW_ETH_ARP.pcap
+ * [Protocols in frame: eth:ethertype:mpls:pwethheuristic:pwethcw:eth:ethertype:arp]
+ ******************************************************************************
+ *
+ * Frame 1: 90 bytes on wire (720 bits), 90 bytes captured (720 bits)
+ * Ethernet II, Src: cc:01:0d:5c:00:10 (cc:01:0d:5c:00:10), Dst: cc:00:0d:5c:00:10 (cc:00:0d:5c:00:10)
+ * 	Destination: cc:00:0d:5c:00:10 (cc:00:0d:5c:00:10)
+ * 	Source: cc:01:0d:5c:00:10 (cc:01:0d:5c:00:10)
+ * 	Type: MPLS label switched packet (0x8847)
+ * MultiProtocol Label Switching Header, Label: 19, Exp: 0, S: 0, TTL: 254
+ * 	0000 0000 0000 0001 0011 .... .... .... = MPLS Label: 19 (0x00013)
+ * 	.... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0
+ * 	.... .... .... .... .... ...0 .... .... = MPLS Bottom Of Label Stack: 0
+ * 	.... .... .... .... .... .... 1111 1110 = MPLS TTL: 254
+ * MultiProtocol Label Switching Header, Label: 16, Exp: 0, S: 1, TTL: 255
+ * 	0000 0000 0000 0001 0000 .... .... .... = MPLS Label: 16 (0x00010)
+ * 	.... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0
+ * 	.... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1
+ * 	.... .... .... .... .... .... 1111 1111 = MPLS TTL: 255
+ * PW Ethernet Control Word
+ * 	Sequence Number: 0
+ * Ethernet II, Src: Private_66:68:00 (00:50:79:66:68:00), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
+ * 	Destination: Broadcast (ff:ff:ff:ff:ff:ff)
+ * 	Source: Private_66:68:00 (00:50:79:66:68:00)
+ * 	Type: ARP (0x0806)
+ * 	Trailer: 00000000000000000000000000000000000000000000
+ * Address Resolution Protocol (request)
+ */
+
+unsigned char data12[] = {
+	0xcc, 0x00, 0x0d, 0x5c, 0x00, 0x10, 0xcc, 0x01, 0x0d, 0x5c, 0x00, 0x10, 0x88, 0x47, 0x00, 0x01, 0x30, 0xfe, 0x00, 0x01, 0x01, 0xff, 0x00, 0x00, 0x00, 0x00,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x50, 0x79, 0x66, 0x68, 0x00, 0x08, 0x06, 0x00, 0x01, 0x08, 0x00, 0x06, 0x04, 0x00, 0x01, 0x00, 0x50, 0x79, 0x66,
+	0x68, 0x00, 0xc0, 0xa8, 0x00, 0x0a, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xc0, 0xa8, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+TEST(RAW_PACKET, ETH_MPLS_MPLS_PWETHCW_ETH_ARP)
+{
+	char *header = NULL;
+    int header_len = 0;
+	int is_ipv4 = 0;
+	struct raw_pkt_parser raw_parser;
+
+    raw_packet_parser_init(&raw_parser,0, LAYER_TYPE_ALL, 8);
+    raw_packet_parser_parse(&raw_parser, (const void *)data12, sizeof(data12), g_packet_io_logger);
+    raw_traffic_decapsulate(&raw_parser, (char *)data12, sizeof(data12), &header, &header_len, &is_ipv4);
+    EXPECT_TRUE(header == nullptr);
+    EXPECT_TRUE(header_len == 0);
+}
+
+int main(int argc, char **argv)
+{
+	::testing::InitGoogleTest(&argc, argv);
+	return RUN_ALL_TESTS();
+}
\ No newline at end of file
diff --git a/common/test/test_session_table.cpp b/common/test/test_session_table.cpp
index a804dc0..16849b8 100644
--- a/common/test/test_session_table.cpp
+++ b/common/test/test_session_table.cpp
@@ -3,6 +3,9 @@
 
 #include "tfe_session_table.h"
 
+bool g_print_to_stderr = true;
+void * g_packet_io_logger = NULL;
+
 TEST(STREAM_TABLE, INSERT)
 {
 	// TEST Create
@@ -48,10 +51,10 @@ TEST(STREAM_TABLE, SEARCH_BY_ID)
 	struct session_node *node = NULL;
 	node = session_table_search_by_id(table, 1);
 	EXPECT_TRUE(node != nullptr);
-	EXPECT_STREQ((const char *)node->value, "HELLO");
+	EXPECT_STREQ((const char *)node->val_data, "HELLO");
 	node = session_table_search_by_id(table, 2);
 	EXPECT_TRUE(node != nullptr);
-	EXPECT_STREQ((const char *)node->value, "WORLD");
+	EXPECT_STREQ((const char *)node->val_data, "WORLD");
 	node = session_table_search_by_id(table, 3);
 	EXPECT_TRUE(node == nullptr);
 
@@ -80,10 +83,10 @@ TEST(STREAM_TABLE, SEARCH_BY_ADDR)
 	struct session_node *node = NULL;
 	node = session_table_search_by_addr(table, &addr1);
 	EXPECT_TRUE(node != nullptr);
-	EXPECT_STREQ((const char *)node->value, "HELLO");
+	EXPECT_STREQ((const char *)node->val_data, "HELLO");
 	node = session_table_search_by_addr(table, &addr2);
 	EXPECT_TRUE(node != nullptr);
-	EXPECT_STREQ((const char *)node->value, "WORLD");
+	EXPECT_STREQ((const char *)node->val_data, "WORLD");
 	node = session_table_search_by_addr(table, &addr3);
 	EXPECT_TRUE(node == nullptr);
 
@@ -115,10 +118,10 @@ TEST(STREAM_TABLE, SEARCH_BY_REVERSE_ADDR)
 	struct session_node *node = NULL;
 	node = session_table_search_by_addr(table, &addr1_reverse);
 	EXPECT_TRUE(node != nullptr);
-	EXPECT_STREQ((const char *)node->value, "HELLO");
+	EXPECT_STREQ((const char *)node->val_data, "HELLO");
 	node = session_table_search_by_addr(table, &addr2_reverse);
 	EXPECT_TRUE(node != nullptr);
-	EXPECT_STREQ((const char *)node->value, "WORLD");
+	EXPECT_STREQ((const char *)node->val_data, "WORLD");
 
 	// TEST Destory
 	session_table_destory(table);