From: davis mcpherson <davis.mcpherson@gmail.com>
Date: Fri, 1 Apr 2016 19:58:39 +0000 (-0400)
Subject: more changes to support tcp sm as flyweight/singleton, delete redundant typecasts... 
X-Git-Tag: 3.0.0-233~422^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3aec7931d9ffc2f87da787da8c662c51f7f62bee;p=thirdparty%2Fsnort3.git

more changes to support tcp sm as flyweight/singleton, delete redundant typecasts of tracker objects

use packet helper functions to determine packet direction (client or server)
---

diff --git a/src/actions/act_react.cc b/src/actions/act_react.cc
index 3c0efd930..90364e3dd 100644
--- a/src/actions/act_react.cc
+++ b/src/actions/act_react.cc
@@ -149,7 +149,7 @@ void ReactAction::exec(Packet* p)
 
 void ReactAction::send(Packet* p)
 {
-    EncodeFlags df = (p->packet_flags & PKT_FROM_SERVER) ? ENC_FLAG_FWD : 0;
+    EncodeFlags df = (p->is_from_server()) ? ENC_FLAG_FWD : 0;
     EncodeFlags sent = config->buf_len;
 
     if ( p->packet_flags & PKT_STREAM_EST )
diff --git a/src/detection/fp_detect.cc b/src/detection/fp_detect.cc
index 914ff8a0e..d81849cfd 100644
--- a/src/detection/fp_detect.cc
+++ b/src/detection/fp_detect.cc
@@ -1208,7 +1208,7 @@ static inline bool fpEvalHeaderSvc(Packet* p, OTNX_MATCH_DATA* omd, int proto)
 
     if (proto_ordinal > 0)
     {
-        if (p->packet_flags & PKT_FROM_SERVER) /* to cli */
+        if (p->is_from_server()) /* to cli */
         {
             DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_server\n");
 
@@ -1216,7 +1216,7 @@ static inline bool fpEvalHeaderSvc(Packet* p, OTNX_MATCH_DATA* omd, int proto)
             file = snort_conf->sopgTable->get_port_group(proto, false, SNORT_PROTO_FILE);
         }
 
-        if (p->packet_flags & PKT_FROM_CLIENT) /* to srv */
+        if (p->is_from_client()) /* to srv */
         {
             DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_client\n");
 
diff --git a/src/filters/rate_filter.cc b/src/filters/rate_filter.cc
index cc30af331..9138712c9 100644
--- a/src/filters/rate_filter.cc
+++ b/src/filters/rate_filter.cc
@@ -147,7 +147,7 @@ int RateFilter_Test(
     {
         // at present stream connection events are the only internal
         // events and these require: src -> client, dst -> server.
-        if ( p->packet_flags & PKT_FROM_SERVER )
+        if ( p->is_from_server() )
         {
             return SFRF_TestThreshold(
                 snort_conf->rate_filter_config, gid, sid, dip, sip,
diff --git a/src/filters/sfrf.h b/src/filters/sfrf.h
index 710e8a18f..1ded56a56 100644
--- a/src/filters/sfrf.h
+++ b/src/filters/sfrf.h
@@ -164,7 +164,7 @@ void SFRF_ShowObjects(RateFilterConfig*);
 
 inline void enable_internal_event(RateFilterConfig* config, uint32_t sid)
 {
-    if (config == NULL)
+    if (config == nullptr)
         return;
 
     config->internal_event_mask |= (1 << sid);
@@ -172,7 +172,7 @@ inline void enable_internal_event(RateFilterConfig* config, uint32_t sid)
 
 inline bool is_internal_event_enabled(RateFilterConfig* config, uint32_t sid)
 {
-    if (config == NULL)
+    if (config == nullptr)
         return false;
 
     return (config->internal_event_mask & (1 << sid));
diff --git a/src/ips_options/ips_flow.cc b/src/ips_options/ips_flow.cc
index fe6634758..f542916ac 100644
--- a/src/ips_options/ips_flow.cc
+++ b/src/ips_options/ips_flow.cc
@@ -150,7 +150,7 @@ int FlowCheckOption::eval(Cursor&, Packet* p)
     if (fcd->from_client)
     {
         {
-            if (!p->from_client() && p->from_server())
+            if (!p->is_from_client() && p->is_from_server())
             {
                 // No match on from_client
                 return DETECTION_OPTION_NO_MATCH;
@@ -162,7 +162,7 @@ int FlowCheckOption::eval(Cursor&, Packet* p)
     if (fcd->from_server)
     {
         {
-            if (!p->from_server() && p->from_client())
+            if (!p->is_from_server() && p->is_from_client())
             {
                 // No match on from_server
                 return DETECTION_OPTION_NO_MATCH;
diff --git a/src/loggers/alert_csv.cc b/src/loggers/alert_csv.cc
index 9c6953149..0a008379a 100644
--- a/src/loggers/alert_csv.cc
+++ b/src/loggers/alert_csv.cc
@@ -83,9 +83,9 @@ static void ff_dir(Args& a)
 {
     const char* dir;
 
-    if ( a.pkt->packet_flags & PKT_FROM_CLIENT )
+    if ( a.pkt->is_from_client() )
         dir = "C2S";
-    else if ( a.pkt->packet_flags & PKT_FROM_SERVER )
+    else if ( a.pkt->is_from_server() )
         dir = "S2C";
     else
         dir = "UNK";
diff --git a/src/network_inspectors/port_scan/ps_detect.cc b/src/network_inspectors/port_scan/ps_detect.cc
index 83e40fd99..2fa78899f 100644
--- a/src/network_inspectors/port_scan/ps_detect.cc
+++ b/src/network_inspectors/port_scan/ps_detect.cc
@@ -305,7 +305,7 @@ int PortScan::ps_filter_ignore(PS_PKT* ps_pkt)
         /*
         if(!(p->ptrs.tcph->th_flags & TH_RST) &&
            !(p->packet_flags & (PKT_STREAM_EST)) &&
-            (p->packet_flags & PKT_FROM_SERVER))
+            (p->is_from_server()))
         {
             return 1;
         }
@@ -333,7 +333,7 @@ int PortScan::ps_filter_ignore(PS_PKT* ps_pkt)
     /*
     **  Check if the packet is reversed
     */
-    if ((p->packet_flags & PKT_FROM_SERVER))
+    if ((p->is_from_server()))
     {
         reverse_pkt = 1;
     }
@@ -822,7 +822,7 @@ int PortScan::ps_tracker_update_tcp(PS_PKT* ps_pkt, PS_TRACKER* scanner,
         /*
         **  RST packet on unestablished streams
         */
-        else if ((p->packet_flags & PKT_FROM_SERVER) &&
+        else if ((p->is_from_server()) &&
             (p->ptrs.tcph && (p->ptrs.tcph->th_flags & TH_RST)) &&
             (!(p->packet_flags & PKT_STREAM_EST) ||
             (session_flags & SSNFLAG_MIDSTREAM)))
@@ -846,7 +846,7 @@ int PortScan::ps_tracker_update_tcp(PS_PKT* ps_pkt, PS_TRACKER* scanner,
         **  That's why we use the sp, because that's the port that is
         **  open.
         */
-        else if ((p->packet_flags & PKT_FROM_SERVER) &&
+        else if ((p->is_from_server()) &&
             !(p->packet_flags & PKT_STREAM_EST))
         {
             if (scanned)
diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index 15d732734..d1ace00d8 100644
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -249,10 +249,10 @@ struct SO_PUBLIC Packet
         ptrs.reset();
     }
 
-    bool from_client()
+    bool is_from_client() const
     { return (packet_flags & PKT_FROM_CLIENT) != 0; }
 
-    bool from_server()
+    bool is_from_server() const
     { return (packet_flags & PKT_FROM_SERVER) != 0; }
 
     bool is_portscan()
diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc
index 42ab61858..273f65367 100644
--- a/src/protocols/packet_manager.cc
+++ b/src/protocols/packet_manager.cc
@@ -383,7 +383,7 @@ static inline uint8_t GetTTL(const Packet* const p, bool forward)
     if ( !p->flow )
         return 0;
 
-    if ( p->packet_flags & PKT_FROM_CLIENT )
+    if ( p->is_from_client() )
         dir = forward ? FROM_CLIENT : FROM_SERVER;
     else
         dir = forward ? FROM_SERVER : FROM_CLIENT;
diff --git a/src/service_inspectors/dce_rpc/dce_common.h b/src/service_inspectors/dce_rpc/dce_common.h
index 6e560249f..cc45f694b 100644
--- a/src/service_inspectors/dce_rpc/dce_common.h
+++ b/src/service_inspectors/dce_rpc/dce_common.h
@@ -279,12 +279,12 @@ inline uint16_t DCE2_GcMaxFragLen(dce2CommonProtoConf* config)
 
 inline int DCE2_SsnFromServer(Packet* p)
 {
-    return p->from_server();
+    return p->is_from_server();
 }
 
 inline int DCE2_SsnFromClient(Packet* p)
 {
-    return p->from_client();
+    return p->is_from_client();
 }
 
 inline DCE2_Policy DCE2_SsnGetPolicy(DCE2_SsnData* sd)
diff --git a/src/service_inspectors/dce_rpc/dce_tcp.h b/src/service_inspectors/dce_rpc/dce_tcp.h
index c1375ddd8..24f143723 100644
--- a/src/service_inspectors/dce_rpc/dce_tcp.h
+++ b/src/service_inspectors/dce_rpc/dce_tcp.h
@@ -102,7 +102,7 @@ inline bool DCE2_TcpAutodetect(Packet* p)
 
         if ((DceRpcCoVersMaj(co_hdr) == DCERPC_PROTO_MAJOR_VERS__5)
             && (DceRpcCoVersMin(co_hdr) == DCERPC_PROTO_MINOR_VERS__0)
-            && ((p->from_client()
+            && ((p->is_from_client()
             && DceRpcCoPduType(co_hdr) == DCERPC_PDU_TYPE__BIND)
             || (DCE2_SsnFromServer(p)
             && DceRpcCoPduType(co_hdr) == DCERPC_PDU_TYPE__BIND_ACK))
@@ -111,7 +111,7 @@ inline bool DCE2_TcpAutodetect(Packet* p)
             return true;
         }
     }
-    else if ((*p->data == DCERPC_PROTO_MAJOR_VERS__5) && p->from_client())
+    else if ((*p->data == DCERPC_PROTO_MAJOR_VERS__5) && p->is_from_client())
     {
         return true;
     }
diff --git a/src/service_inspectors/dnp3/dnp3.cc b/src/service_inspectors/dnp3/dnp3.cc
index 8b1ef97b2..fd0f27ae6 100644
--- a/src/service_inspectors/dnp3/dnp3.cc
+++ b/src/service_inspectors/dnp3/dnp3.cc
@@ -176,7 +176,7 @@ static void process_dnp3(dnp3ProtoConf& config, Packet* p)
     p->packet_flags |= PKT_ALLOW_MULTIPLE_DETECT;
 
     /* Set reassembly direction */
-    if (p->packet_flags & PKT_FROM_CLIENT)
+    if (p->is_from_client())
         dnp3_sess->direction = DNP3_CLIENT;
     else
         dnp3_sess->direction = DNP3_SERVER;
diff --git a/src/service_inspectors/dns/dns.cc b/src/service_inspectors/dns/dns.cc
index f0e6d5f87..cfad96364 100644
--- a/src/service_inspectors/dns/dns.cc
+++ b/src/service_inspectors/dns/dns.cc
@@ -1049,7 +1049,7 @@ static void snort_dns(Packet* p)
     }
 
     // Get the direction of the packet.
-    bool from_server = ( (p->packet_flags & PKT_FROM_SERVER ) ? true : false );
+    bool from_server = ( (p->is_from_server() ) ? true : false );
 
 
     // Attempt to get a previously allocated DNS block.
diff --git a/src/service_inspectors/ftp_telnet/ftp.cc b/src/service_inspectors/ftp_telnet/ftp.cc
index 2fcf023ee..55cd2cfe2 100644
--- a/src/service_inspectors/ftp_telnet/ftp.cc
+++ b/src/service_inspectors/ftp_telnet/ftp.cc
@@ -164,11 +164,11 @@ static int snort_ftp(Packet* p)
                 }
                 else
                 {
-                    if ( p->packet_flags & PKT_FROM_SERVER )
+                    if ( p->is_from_server() )
                     {
                         iInspectMode = FTPP_SI_SERVER_MODE;
                     }
-                    else if ( p->packet_flags & PKT_FROM_CLIENT )
+                    else if ( p->is_from_client() )
                     {
                         iInspectMode = FTPP_SI_CLIENT_MODE;
                     }
diff --git a/src/service_inspectors/ftp_telnet/ftpp_si.cc b/src/service_inspectors/ftp_telnet/ftpp_si.cc
index 11414f3d1..397459c48 100644
--- a/src/service_inspectors/ftp_telnet/ftpp_si.cc
+++ b/src/service_inspectors/ftp_telnet/ftpp_si.cc
@@ -223,8 +223,8 @@ static int FTPInitConf(
      * session, so we can still assume that the initial packet is the client
      * talking.
      */
-    iServerDip = (p->packet_flags & PKT_FROM_CLIENT);
-    iServerSip = (p->packet_flags & PKT_FROM_SERVER);
+    iServerDip = (p->is_from_client());
+    iServerSip = (p->is_from_server());
 
     /*
      * We default to the no FTP traffic case
@@ -501,11 +501,11 @@ int SetSiInput(FTPP_SI_INPUT* SiInput, Packet* p)
     {
         SiInput->pdir = FTPP_SI_NO_MODE;
     }
-    else if (p->packet_flags & PKT_FROM_SERVER)
+    else if (p->is_from_server())
     {
         SiInput->pdir = FTPP_SI_SERVER_MODE;
     }
-    else if (p->packet_flags & PKT_FROM_CLIENT)
+    else if (p->is_from_client())
     {
         SiInput->pdir = FTPP_SI_CLIENT_MODE;
     }
diff --git a/src/service_inspectors/ftp_telnet/telnet.cc b/src/service_inspectors/ftp_telnet/telnet.cc
index 5a3db2427..812dedf17 100644
--- a/src/service_inspectors/ftp_telnet/telnet.cc
+++ b/src/service_inspectors/ftp_telnet/telnet.cc
@@ -139,11 +139,11 @@ static int snort_telnet(TELNET_PROTO_CONF* GlobalConf, Packet* p)
                 }
                 else
                 {
-                    if ( p->packet_flags & PKT_FROM_SERVER )
+                    if ( p->is_from_server() )
                     {
                         iInspectMode = FTPP_SI_SERVER_MODE;
                     }
-                    else if ( p->packet_flags & PKT_FROM_CLIENT )
+                    else if ( p->is_from_client() )
                     {
                         iInspectMode = FTPP_SI_CLIENT_MODE;
                     }
diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc
index fa1813b12..38770ec22 100644
--- a/src/service_inspectors/http_inspect/hi_main.cc
+++ b/src/service_inspectors/http_inspect/hi_main.cc
@@ -374,11 +374,11 @@ static inline int SetSiInput(HI_SI_INPUT* SiInput, Packet* p)
     {
         SiInput->pdir = HI_SI_NO_MODE;
     }
-    else if (p->packet_flags & PKT_FROM_SERVER)
+    else if (p->is_from_server())
     {
         SiInput->pdir = HI_SI_SERVER_MODE;
     }
-    else if (p->packet_flags & PKT_FROM_CLIENT)
+    else if (p->is_from_client())
     {
         SiInput->pdir = HI_SI_CLIENT_MODE;
     }
diff --git a/src/service_inspectors/http_inspect/hi_si.cc b/src/service_inspectors/http_inspect/hi_si.cc
index adf23b725..4f0ed3654 100644
--- a/src/service_inspectors/http_inspect/hi_si.cc
+++ b/src/service_inspectors/http_inspect/hi_si.cc
@@ -112,8 +112,8 @@ static int InitServerConf(HTTPINSPECT_CONF* GlobalConf,
     **  session, so we can still assume that the initial packet is the client
     **  talking.
     */
-    iServerSip = (p->packet_flags & PKT_FROM_SERVER);
-    iServerDip = (p->packet_flags & PKT_FROM_CLIENT);
+    iServerSip = (p->is_from_server());
+    iServerDip = (p->is_from_client());
 
     /*
     **  We default to the no HTTP traffic case
diff --git a/src/service_inspectors/imap/imap.cc b/src/service_inspectors/imap/imap.cc
index 143045626..9c0c04f7f 100644
--- a/src/service_inspectors/imap/imap.cc
+++ b/src/service_inspectors/imap/imap.cc
@@ -294,7 +294,7 @@ static int IMAP_Setup(Packet* p, IMAPData* ssn)
     int pkt_dir;
 
     /* Get the direction of the packet. */
-    if ( p->packet_flags & PKT_FROM_SERVER )
+    if ( p->is_from_server() )
         pkt_dir = IMAP_PKT_FROM_SERVER;
     else
         pkt_dir = IMAP_PKT_FROM_CLIENT;
diff --git a/src/service_inspectors/modbus/modbus_decode.cc b/src/service_inspectors/modbus/modbus_decode.cc
index 05db651ae..4dbe62e5c 100644
--- a/src/service_inspectors/modbus/modbus_decode.cc
+++ b/src/service_inspectors/modbus/modbus_decode.cc
@@ -429,7 +429,7 @@ bool ModbusDecode(Packet* p)
 
     /* Read the Modbus payload and check lengths against the expected length for
        each function. */
-    if (p->packet_flags & PKT_FROM_CLIENT)
+    if (p->is_from_client())
         ModbusCheckRequestLengths(&mfd->ssn_data, p);
     else
         ModbusCheckResponseLengths(&mfd->ssn_data, p);
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc b/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc
index 27d551199..2271c681b 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc
@@ -197,9 +197,9 @@ void NHttpInspect::clear(Packet* p)
 
     if (session_data == nullptr)
         return;
-    assert((p->packet_flags & PKT_FROM_CLIENT) || (p->packet_flags & PKT_FROM_SERVER));
-    assert(!((p->packet_flags & PKT_FROM_CLIENT) && (p->packet_flags & PKT_FROM_SERVER)));
-    SourceId source_id = (p->packet_flags & PKT_FROM_CLIENT) ? SRC_CLIENT : SRC_SERVER;
+    assert((p->is_from_client()) || (p->is_from_server()));
+    assert(!((p->is_from_client()) && (p->is_from_server())));
+    SourceId source_id = (p->is_from_client()) ? SRC_CLIENT : SRC_SERVER;
 
     if (session_data->transaction[source_id] == nullptr)
         return;
diff --git a/src/service_inspectors/pop/pop.cc b/src/service_inspectors/pop/pop.cc
index eb77011cf..03074f37c 100644
--- a/src/service_inspectors/pop/pop.cc
+++ b/src/service_inspectors/pop/pop.cc
@@ -251,7 +251,7 @@ static int POP_Setup(Packet* p, POPData* ssn)
     int pkt_dir;
 
     /* Get the direction of the packet. */
-    if ( p->packet_flags & PKT_FROM_SERVER )
+    if ( p->is_from_server() )
         pkt_dir = POP_PKT_FROM_SERVER;
     else
         pkt_dir = POP_PKT_FROM_CLIENT;
diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc
index 205d3dc7d..7d2abc9b1 100644
--- a/src/service_inspectors/rpc_decode/rpc_decode.cc
+++ b/src/service_inspectors/rpc_decode/rpc_decode.cc
@@ -999,7 +999,7 @@ void RpcDecode::eval(Packet* p)
     // If no 3 way, then the packet flags won't be set, so don't look at it
     // since we won't be able to determeine who's the client and who's the
     // server.
-    if ( !p->from_client() )
+    if ( !p->is_from_client() )
         return;
 
     RpcSsnData* rsdata = nullptr;
diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc
index e60f4824a..33c55e549 100644
--- a/src/service_inspectors/smtp/smtp.cc
+++ b/src/service_inspectors/smtp/smtp.cc
@@ -542,7 +542,7 @@ static int SMTP_Setup(Packet* p, SMTPData* ssn)
     int pkt_dir;
 
     /* Get the direction of the packet. */
-    if ( p->packet_flags & PKT_FROM_SERVER )
+    if ( p->is_from_server() )
         pkt_dir = SMTP_PKT_FROM_SERVER;
     else
         pkt_dir = SMTP_PKT_FROM_CLIENT;
diff --git a/src/service_inspectors/ssh/ssh.cc b/src/service_inspectors/ssh/ssh.cc
index f316a069d..8d722e32e 100644
--- a/src/service_inspectors/ssh/ssh.cc
+++ b/src/service_inspectors/ssh/ssh.cc
@@ -190,7 +190,7 @@ static void snort_ssh(SSH_PROTO_CONF* config, Packet* p)
     uint32_t search_dir_keyinit;
 
     // Get the direction of the packet.
-    if ( p->packet_flags & PKT_FROM_SERVER )
+    if ( p->is_from_server() )
     {
         direction = SSH_DIR_FROM_SERVER;
         search_dir_ver = SSH_FLG_SERV_IDSTRING_SEEN;
diff --git a/src/service_inspectors/ssl/ssl_inspector.cc b/src/service_inspectors/ssl/ssl_inspector.cc
index 84b4f4f2f..94993d3fd 100644
--- a/src/service_inspectors/ssl/ssl_inspector.cc
+++ b/src/service_inspectors/ssl/ssl_inspector.cc
@@ -197,10 +197,10 @@ static inline uint32_t SSLPP_process_alert(
 
     /* Need to negate the application flags from the opposing side. */
 
-    if (packet->packet_flags & PKT_FROM_CLIENT)
+    if (packet->is_from_client())
         return ssn_flags & ~SSL_SAPP_FLAG;
 
-    else if (packet->packet_flags & PKT_FROM_SERVER)
+    else if (packet->is_from_server())
         return ssn_flags & ~SSL_CAPP_FLAG;
 
     return ssn_flags;
@@ -317,7 +317,7 @@ static void snort_ssl(SSL_PROTO_CONF* config, Packet* p)
 
     SSL_CLEAR_TEMPORARY_FLAGS(sd->ssn_flags);
 
-    uint8_t dir = (p->packet_flags & PKT_FROM_SERVER) ? 1 : 0;
+    uint8_t dir = (p->is_from_server()) ? 1 : 0;
     uint8_t index = (p->packet_flags & PKT_REBUILT_STREAM) ? 2 : 0;
 
     uint8_t heartbleed_type = 0;
diff --git a/src/service_inspectors/wizard/wizard.cc b/src/service_inspectors/wizard/wizard.cc
index 57ebe277e..ea46f84bf 100644
--- a/src/service_inspectors/wizard/wizard.cc
+++ b/src/service_inspectors/wizard/wizard.cc
@@ -188,7 +188,7 @@ void Wizard::eval(Packet* p)
         return;
 
     Wand wand;
-    reset(wand, false, p->packet_flags & PKT_FROM_CLIENT);
+    reset(wand, false, p->is_from_client());
 
     if ( cast_spell(wand, p->flow, p->data, p->dsize) )
         ++tstats.udp_hits;
diff --git a/src/stream/ip/ip_session.cc b/src/stream/ip/ip_session.cc
index f374b8705..b312634b6 100644
--- a/src/stream/ip/ip_session.cc
+++ b/src/stream/ip/ip_session.cc
@@ -96,7 +96,7 @@ static inline void UpdateSession(Packet* p, Flow* lws)
 
     if ( !(lws->ssn_state.session_flags & SSNFLAG_ESTABLISHED) )
     {
-        if ( p->packet_flags & PKT_FROM_CLIENT )
+        if ( p->is_from_client() )
         {
             DebugMessage(DEBUG_STREAM_STATE,
                 "Stream: Updating on packet from client\n");
diff --git a/src/stream/libtcp/tcp_segment_descriptor.h b/src/stream/libtcp/tcp_segment_descriptor.h
index 6c09e3442..921547c48 100644
--- a/src/stream/libtcp/tcp_segment_descriptor.h
+++ b/src/stream/libtcp/tcp_segment_descriptor.h
@@ -135,7 +135,7 @@ public:
 
     bool is_packet_from_server(void)
     {
-        return pkt->packet_flags & PKT_FROM_SERVER;
+        return pkt->is_from_server();
     }
 
     void slide_segment_in_rcv_window(int32_t offset)
diff --git a/src/stream/libtcp/tcp_state_handler.cc b/src/stream/libtcp/tcp_state_handler.cc
index 68a4a15ce..6bb8bbf50 100644
--- a/src/stream/libtcp/tcp_state_handler.cc
+++ b/src/stream/libtcp/tcp_state_handler.cc
@@ -32,8 +32,8 @@ using namespace std;
 #include "stream_tcp_unit_test.h"
 #endif
 
-TcpStateHandler::TcpStateHandler(TcpStreamTracker::TcpState state, TcpStateMachine& tsm,
-    TcpStreamSession& ssn) : tsm(&tsm), tcp_state(state), session(ssn)
+TcpStateHandler::TcpStateHandler(TcpStreamTracker::TcpState state, TcpStateMachine& tsm)
+    : tsm(&tsm), tcp_state(state)
 {
     tsm.register_state_handler(state, *this);
 }
@@ -49,12 +49,12 @@ TcpStateHandler::~TcpStateHandler()
     // TODO Auto-generated destructor stub
 }
 
-bool TcpStateHandler::do_pre_sm_packet_actions(TcpSegmentDescriptor&)
+bool TcpStateHandler::do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&)
 {
     return true;
 }
 
-bool TcpStateHandler::do_post_sm_packet_actions(TcpSegmentDescriptor&)
+bool TcpStateHandler::do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&)
 {
     return true;
 }
diff --git a/src/stream/libtcp/tcp_state_handler.h b/src/stream/libtcp/tcp_state_handler.h
index 7f62bf253..230f9e686 100644
--- a/src/stream/libtcp/tcp_state_handler.h
+++ b/src/stream/libtcp/tcp_state_handler.h
@@ -24,7 +24,6 @@
 
 #include "protocols/tcp.h"
 #include "tcp_segment_descriptor.h"
-#include "tcp_stream_session.h"
 #include "tcp_stream_tracker.h"
 
 class TcpStateMachine;
@@ -32,7 +31,7 @@ class TcpStateMachine;
 class TcpStateHandler
 {
 public:
-    TcpStateHandler(TcpStreamTracker::TcpState, TcpStateMachine&, TcpStreamSession&);
+    TcpStateHandler(TcpStreamTracker::TcpState, TcpStateMachine&);
     virtual ~TcpStateHandler();
 
     virtual bool eval(TcpSegmentDescriptor&, TcpStreamTracker&);
@@ -62,8 +61,8 @@ public:
         this->tsm = tsm;
     }
 
-    virtual bool do_pre_sm_packet_actions(TcpSegmentDescriptor&);
-    virtual bool do_post_sm_packet_actions(TcpSegmentDescriptor&);
+    virtual bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&);
+    virtual bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&);
 
 protected:
     virtual bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&);
@@ -83,7 +82,6 @@ protected:
 
     const TcpStateMachine* tsm;
     TcpStreamTracker::TcpState tcp_state;
-    TcpStreamSession& session;
     TcpStreamTracker::TcpEvent tcp_event = TcpStreamTracker::TCP_MAX_EVENTS;
 };
 
diff --git a/src/stream/libtcp/tcp_state_machine.cc b/src/stream/libtcp/tcp_state_machine.cc
index ad870b5bf..e1aebe6ed 100644
--- a/src/stream/libtcp/tcp_state_machine.cc
+++ b/src/stream/libtcp/tcp_state_machine.cc
@@ -48,14 +48,14 @@ bool TcpStateMachine::eval(TcpSegmentDescriptor& tsd, TcpStreamTracker& talker,
     TcpStreamTracker::TcpState tcp_state = talker.get_tcp_state( );
 
     talker.set_tcp_event(tsd);
-    if ( tcp_state_handlers[ tcp_state ]->do_pre_sm_packet_actions(tsd) )
+    if ( tcp_state_handlers[ tcp_state ]->do_pre_sm_packet_actions(tsd, talker) )
     {
         if ( tcp_state_handlers[ tcp_state ]->eval(tsd, talker) )
         {
             tcp_state = listener.get_tcp_state( );
             listener.set_tcp_event(tsd);
             tcp_state_handlers[ tcp_state ]->eval(tsd, listener);
-            tcp_state_handlers[ tcp_state ]->do_post_sm_packet_actions(tsd);
+            tcp_state_handlers[ tcp_state ]->do_post_sm_packet_actions(tsd, listener);
             return true;
         }
 
diff --git a/src/stream/libtcp/tcp_state_machine.h b/src/stream/libtcp/tcp_state_machine.h
index 0c80ab107..1ce9cad3c 100644
--- a/src/stream/libtcp/tcp_state_machine.h
+++ b/src/stream/libtcp/tcp_state_machine.h
@@ -31,13 +31,13 @@
 class TcpStateMachine
 {
 public:
-    TcpStateMachine(void);
     virtual ~TcpStateMachine(void);
 
     virtual void register_state_handler(TcpStreamTracker::TcpState, TcpStateHandler&);
     virtual bool eval(TcpSegmentDescriptor&, TcpStreamTracker&, TcpStreamTracker&);
 
-private:
+protected:
+    TcpStateMachine(void);
 
     TcpStateHandler* tcp_state_handlers[ TcpStreamTracker::TCP_MAX_STATES ];
 };
diff --git a/src/stream/libtcp/tcp_stream_session.cc b/src/stream/libtcp/tcp_stream_session.cc
index 9c9f05425..5ac562036 100644
--- a/src/stream/libtcp/tcp_stream_session.cc
+++ b/src/stream/libtcp/tcp_stream_session.cc
@@ -349,7 +349,7 @@ void TcpStreamSession::SetPacketHeaderFoo(const Packet* p)
         egress_index = p->pkth->egress_index;
         egress_group = p->pkth->egress_group;
     }
-    else if ( p->packet_flags & PKT_FROM_CLIENT )
+    else if ( p->is_from_client() )
     {
         ingress_index = p->pkth->ingress_index;
         ingress_group = p->pkth->ingress_group;
diff --git a/src/stream/libtcp/tcp_stream_tracker.cc b/src/stream/libtcp/tcp_stream_tracker.cc
index 4aedcdbca..f8d47e84e 100644
--- a/src/stream/libtcp/tcp_stream_tracker.cc
+++ b/src/stream/libtcp/tcp_stream_tracker.cc
@@ -55,7 +55,7 @@ TcpStreamTracker::TcpEvent TcpStreamTracker::set_tcp_event(TcpSegmentDescriptor&
     bool talker;
     const tcp::TCPHdr* tcph = tsd.get_tcph();
 
-    if ( tsd.get_pkt()->packet_flags & PKT_FROM_CLIENT )
+    if ( tsd.get_pkt()->is_from_client() )
         talker = ( client_tracker ) ? true : false;
     else
         talker = ( client_tracker ) ? false : true;
diff --git a/src/stream/libtcp/tcp_stream_tracker.h b/src/stream/libtcp/tcp_stream_tracker.h
index 693caba5e..7ffc8d167 100644
--- a/src/stream/libtcp/tcp_stream_tracker.h
+++ b/src/stream/libtcp/tcp_stream_tracker.h
@@ -46,6 +46,7 @@ extern const char* tcp_event_names[];
 
 class TcpNormalizer;
 class TcpReassembler;
+class TcpSession;
 
 class TcpStreamTracker
 {
@@ -371,7 +372,6 @@ public:
     bool rst_pkt_sent = false;
 
 // FIXIT - make these non-public
-
 public:
     uint32_t r_nxt_ack = 0; /* next expected ack from remote side */
     uint32_t r_win_base = 0; /* remote side window base sequence number
@@ -380,6 +380,7 @@ public:
     StreamSplitter* splitter = nullptr;
     TcpNormalizer* normalizer = nullptr;
     TcpReassembler* reassembler = nullptr;
+    TcpSession* session = nullptr;
 
     uint32_t small_seg_count = 0;
     uint8_t alert_count = 0;
diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc
index 26d45a3ed..2827ef591 100644
--- a/src/stream/stream_api.cc
+++ b/src/stream/stream_api.cc
@@ -560,7 +560,7 @@ static void active_response(Packet* p, Flow* lwssn)
 {
     uint8_t max = snort_conf->max_responses;
 
-    if ( p->packet_flags & PKT_FROM_CLIENT )
+    if ( p->is_from_client() )
         lwssn->session_state |= STREAM_STATE_DROP_CLIENT;
     else
         lwssn->session_state |= STREAM_STATE_DROP_SERVER;
@@ -587,15 +587,15 @@ bool Stream::blocked_session(Flow* flow, Packet* p)
         return false;
 
     if (
-        ((p->packet_flags & PKT_FROM_SERVER) &&
+        ((p->is_from_server()) &&
         (flow->ssn_state.session_flags & SSNFLAG_DROP_SERVER)) ||
 
-        ((p->packet_flags & PKT_FROM_CLIENT) &&
+        ((p->is_from_client()) &&
         (flow->ssn_state.session_flags & SSNFLAG_DROP_CLIENT)) )
     {
         DebugFormat(DEBUG_STREAM_STATE,
             "Blocking %s packet as session was blocked\n",
-            p->packet_flags & PKT_FROM_SERVER ?  "server" : "client");
+            p->is_from_server() ?  "server" : "client");
 
         DisableDetect();
         Active::drop_packet(p);
@@ -607,14 +607,14 @@ bool Stream::blocked_session(Flow* flow, Packet* p)
 
 bool Stream::ignored_session(Flow* flow, Packet* p)
 {
-    if (((p->packet_flags & PKT_FROM_SERVER) &&
+    if (((p->is_from_server()) &&
         (flow->ssn_state.ignore_direction & SSN_DIR_FROM_CLIENT)) ||
-        ((p->packet_flags & PKT_FROM_CLIENT) &&
+        ((p->is_from_client()) &&
         (flow->ssn_state.ignore_direction & SSN_DIR_FROM_SERVER)) )
     {
         DebugFormat(DEBUG_STREAM_STATE,
             "Stream Ignoring packet from %d. Session marked as ignore\n",
-            p->packet_flags & PKT_FROM_CLIENT ? "sender" : "responder");
+            p->is_from_client() ? "sender" : "responder");
 
         DisableInspection();
         return true;
diff --git a/src/stream/tcp/CMakeLists.txt b/src/stream/tcp/CMakeLists.txt
index 11c54b5bf..aa96db558 100644
--- a/src/stream/tcp/CMakeLists.txt
+++ b/src/stream/tcp/CMakeLists.txt
@@ -48,6 +48,8 @@ add_library( stream_tcp STATIC
     tcp_state_syn_recv.h
     tcp_state_syn_sent.h
     tcp_state_time_wait.h 
+    tcp_stream_state_machine.cc
+    tcp_stream_state_machine.h
     ips_stream_reassemble.cc
     ips_stream_size.cc
 )
diff --git a/src/stream/tcp/Makefile.am b/src/stream/tcp/Makefile.am
index 1bb48368c..75324a255 100644
--- a/src/stream/tcp/Makefile.am
+++ b/src/stream/tcp/Makefile.am
@@ -28,6 +28,8 @@ tcp_tracker.cc \
 tcp_tracker.h \
 tcp_session.cc \
 tcp_session.h \
+tcp_stream_state_machine.cc \
+tcp_stream_state_machine.h \
 tcp_state_closed.cc \
 tcp_state_close_wait.cc \
 tcp_state_closing.cc \
diff --git a/src/stream/tcp/tcp_debug_trace.h b/src/stream/tcp/tcp_debug_trace.h
index 26349023f..10cffcdf7 100644
--- a/src/stream/tcp/tcp_debug_trace.h
+++ b/src/stream/tcp/tcp_debug_trace.h
@@ -113,7 +113,7 @@ inline void TraceTCP(const Packet* p, const Flow* lws, TcpSegmentDescriptor* tsd
     const char* cdir = "?", * sdir = "?";
     uint32_t txd = 0, rxd = 0;
 
-    if (p->packet_flags & PKT_FROM_SERVER)
+    if (p->is_from_server())
     {
         sdir = "SRV>";
         cdir = "CLI<";
@@ -121,7 +121,7 @@ inline void TraceTCP(const Packet* p, const Flow* lws, TcpSegmentDescriptor* tsd
         txd = srv->get_iss();
         rxd = srv->get_irs();
     }
-    else if ( p->packet_flags & PKT_FROM_CLIENT )
+    else if ( p->is_from_client() )
     {
         sdir = "SRV<";
         cdir = "CLI>";
diff --git a/src/stream/tcp/tcp_normalizers.cc b/src/stream/tcp/tcp_normalizers.cc
index 4c9929334..71f9548c4 100644
--- a/src/stream/tcp/tcp_normalizers.cc
+++ b/src/stream/tcp/tcp_normalizers.cc
@@ -23,6 +23,7 @@
 #include "tcp_module.h"
 #include "tcp_normalizers.h"
 
+
 class TcpNormalizerFirst : public TcpNormalizer
 {
 public:
@@ -191,77 +192,6 @@ public:
     int handle_repeated_syn(TcpSegmentDescriptor&) override;
 };
 
-TcpNormalizer* TcpNormalizerFactory::create(TcpSession* session, StreamPolicy os_policy,
-    TcpStreamTracker* tracker, TcpStreamTracker* peer)
-{
-    TcpNormalizer* normalizer;
-
-    switch (os_policy)
-    {
-    case StreamPolicy::OS_FIRST:
-        normalizer = new TcpNormalizerFirst(session, tracker);
-        break;
-
-    case StreamPolicy::OS_LAST:
-        normalizer = new TcpNormalizerLast(session, tracker);
-        break;
-
-    case StreamPolicy::OS_LINUX:
-        normalizer = new TcpNormalizerLinux(session, tracker);
-        break;
-
-    case StreamPolicy::OS_OLD_LINUX:
-        normalizer = new TcpNormalizerOldLinux(session, tracker);
-        break;
-
-    case StreamPolicy::OS_BSD:
-        normalizer = new TcpNormalizerBSD(session, tracker);
-        break;
-
-    case StreamPolicy::OS_MACOS:
-        normalizer = new TcpNormalizerMacOS(session, tracker);
-        break;
-
-    case StreamPolicy::OS_SOLARIS:
-        normalizer = new TcpNormalizerSolaris(session, tracker);
-        break;
-
-    case StreamPolicy::OS_IRIX:
-        normalizer = new TcpNormalizerIrix(session, tracker);
-        break;
-
-    case StreamPolicy::OS_HPUX11:
-        normalizer = new TcpNormalizerHpux11(session, tracker);
-        break;
-
-    case StreamPolicy::OS_HPUX10:
-        normalizer = new TcpNormalizerHpux10(session, tracker);
-        break;
-
-    case StreamPolicy::OS_WINDOWS:
-        normalizer = new TcpNormalizerWindows(session, tracker);
-        break;
-
-    case StreamPolicy::OS_WINDOWS2K3:
-        normalizer = new TcpNormalizerWindows2K3(session, tracker);
-        break;
-
-    case StreamPolicy::OS_VISTA:
-        normalizer = new TcpNormalizerVista(session, tracker);
-        break;
-
-    case StreamPolicy::OS_PROXY:
-        normalizer = new TcpNormalizerProxy(session, tracker);
-        break;
-
-    default:
-        normalizer = new TcpNormalizerBSD(session, tracker);
-        break;
-    }
-
-    normalizer->set_peer_tracker(peer);
-    return normalizer;
-}
 
 static inline int handle_repeated_syn_mswin(TcpStreamTracker* talker, TcpStreamTracker* listener,
     TcpSegmentDescriptor& tsd, TcpSession* session)
@@ -528,3 +458,75 @@ int TcpNormalizerProxy::handle_repeated_syn(TcpSegmentDescriptor&)
     return ACTION_NOTHING;
 }
 
+TcpNormalizer* TcpNormalizerFactory::create(TcpSession* session, StreamPolicy os_policy,
+    TcpStreamTracker* tracker, TcpStreamTracker* peer)
+{
+    TcpNormalizer* normalizer;
+
+    switch (os_policy)
+    {
+    case StreamPolicy::OS_FIRST:
+        normalizer = new TcpNormalizerFirst(session, tracker);
+        break;
+
+    case StreamPolicy::OS_LAST:
+        normalizer = new TcpNormalizerLast(session, tracker);
+        break;
+
+    case StreamPolicy::OS_LINUX:
+        normalizer = new TcpNormalizerLinux(session, tracker);
+        break;
+
+    case StreamPolicy::OS_OLD_LINUX:
+        normalizer = new TcpNormalizerOldLinux(session, tracker);
+        break;
+
+    case StreamPolicy::OS_BSD:
+        normalizer = new TcpNormalizerBSD(session, tracker);
+        break;
+
+    case StreamPolicy::OS_MACOS:
+        normalizer = new TcpNormalizerMacOS(session, tracker);
+        break;
+
+    case StreamPolicy::OS_SOLARIS:
+        normalizer = new TcpNormalizerSolaris(session, tracker);
+        break;
+
+    case StreamPolicy::OS_IRIX:
+        normalizer = new TcpNormalizerIrix(session, tracker);
+        break;
+
+    case StreamPolicy::OS_HPUX11:
+        normalizer = new TcpNormalizerHpux11(session, tracker);
+        break;
+
+    case StreamPolicy::OS_HPUX10:
+        normalizer = new TcpNormalizerHpux10(session, tracker);
+        break;
+
+    case StreamPolicy::OS_WINDOWS:
+        normalizer = new TcpNormalizerWindows(session, tracker);
+        break;
+
+    case StreamPolicy::OS_WINDOWS2K3:
+        normalizer = new TcpNormalizerWindows2K3(session, tracker);
+        break;
+
+    case StreamPolicy::OS_VISTA:
+        normalizer = new TcpNormalizerVista(session, tracker);
+        break;
+
+    case StreamPolicy::OS_PROXY:
+        normalizer = new TcpNormalizerProxy(session, tracker);
+        break;
+
+    default:
+        normalizer = new TcpNormalizerBSD(session, tracker);
+        break;
+    }
+
+    normalizer->set_peer_tracker(peer);
+    return normalizer;
+}
+
diff --git a/src/stream/tcp/tcp_reassembler.cc b/src/stream/tcp/tcp_reassembler.cc
index 294da31df..9468bb261 100644
--- a/src/stream/tcp/tcp_reassembler.cc
+++ b/src/stream/tcp/tcp_reassembler.cc
@@ -623,7 +623,7 @@ void TcpReassembler::prep_s5_pkt(Flow* flow, Packet* p, uint32_t pkt_flags)
     else
     {
         // reverse
-        if (p->packet_flags & PKT_FROM_CLIENT)
+        if (p->is_from_client())
             s5_pkt->packet_flags |= PKT_FROM_SERVER;
         else
             s5_pkt->packet_flags |= PKT_FROM_CLIENT;
@@ -919,9 +919,9 @@ uint32_t TcpReassembler::get_reverse_packet_dir(const Packet* p)
      * is the ACK from the talker and we're flushing packets
      * that actually came from the listener.
      */
-    if ( p->packet_flags & PKT_FROM_SERVER )
+    if ( p->is_from_server() )
         return PKT_FROM_CLIENT;
-    else if ( p->packet_flags & PKT_FROM_CLIENT )
+    else if ( p->is_from_client() )
         return PKT_FROM_SERVER;
 
     return 0;
@@ -929,9 +929,9 @@ uint32_t TcpReassembler::get_reverse_packet_dir(const Packet* p)
 
 uint32_t TcpReassembler::get_forward_packet_dir(const Packet* p)
 {
-    if ( p->packet_flags & PKT_FROM_SERVER )
+    if ( p->is_from_server() )
         return PKT_FROM_SERVER;
-    else if ( p->packet_flags & PKT_FROM_CLIENT )
+    else if ( p->is_from_client() )
         return PKT_FROM_CLIENT;
 
     return 0;
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index b0d5bb8ed..79e22344a 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -84,44 +84,18 @@
 #include "tcp_module.h"
 #include "tcp_event_logger.h"
 #include "tcp_debug_trace.h"
-
-#include "tcp_state_none.h"
-#include "tcp_state_closed.h"
-#include "tcp_state_listen.h"
-#include "tcp_state_syn_sent.h"
-#include "tcp_state_syn_recv.h"
-#include "tcp_state_established.h"
-#include "tcp_state_close_wait.h"
-#include "tcp_state_closing.h"
-#include "tcp_state_fin_wait1.h"
-#include "tcp_state_fin_wait2.h"
-#include "tcp_state_last_ack.h"
-#include "tcp_state_time_wait.h"
-
 #include "tcp_normalizers.h"
 #include "tcp_reassemblers.h"
+#include "tcp_stream_state_machine.h"
 #include "tcp_session.h"
 
 DEBUG_WRAP(const char* t_name = NULL; const char* l_name = NULL; )
 
 TcpSession::TcpSession(Flow* flow) : TcpStreamSession(flow)
 {
-    client = new TcpTracker(true);
-    server = new TcpTracker(false);
-
-    // initialize stream tracker state machine...
-    new TcpStateNone(tsm, *this);
-    new TcpStateClosed(tsm, *this);
-    new TcpStateListen(tsm, *this);
-    new TcpStateSynSent(tsm, *this);
-    new TcpStateSynRecv(tsm, *this);
-    new TcpStateEstablished(tsm, *this);
-    new TcpStateFinWait1(tsm, *this);
-    new TcpStateFinWait2(tsm, *this);
-    new TcpStateClosing(tsm, *this);
-    new TcpStateCloseWait(tsm, *this);
-    new TcpStateLastAck(tsm, *this);
-    new TcpStateTimeWait(tsm, *this);
+    tsm = TcpStreamStateMachine::get_instance();
+    client = new TcpTracker(true, this);
+    server = new TcpTracker(false, this);
 }
 
 TcpSession::~TcpSession(void)
@@ -152,7 +126,7 @@ void TcpSession::restart(Packet* p)
 
     TcpStreamTracker* talker, * listener;
 
-    if (p->packet_flags & PKT_FROM_SERVER)
+    if (p->is_from_server())
     {
         talker = server;
         listener = client;
@@ -736,7 +710,7 @@ void TcpSession::check_for_session_hijack(TcpSegmentDescriptor& tsd)
 
             if ( t_hijack )
             {
-                if ( p->packet_flags & PKT_FROM_CLIENT )
+                if ( p->is_from_client() )
                     event_code |= EVENT_SESSION_HIJACK_CLIENT;
                 else
                     event_code |= EVENT_SESSION_HIJACK_SERVER;
@@ -744,7 +718,7 @@ void TcpSession::check_for_session_hijack(TcpSegmentDescriptor& tsd)
 
             if ( l_hijack )
             {
-                if ( p->packet_flags & PKT_FROM_CLIENT )
+                if ( p->is_from_client() )
                     event_code |= EVENT_SESSION_HIJACK_SERVER;
                 else
                     event_code |= EVENT_SESSION_HIJACK_CLIENT;
@@ -769,7 +743,7 @@ bool TcpSession::check_for_window_slam(TcpSegmentDescriptor& tsd)
         pkt_action_mask |= ACTION_BAD_PKT;
         return true;
     }
-    else if ((tsd.get_pkt()->packet_flags & PKT_FROM_CLIENT)
+    else if ((tsd.get_pkt()->is_from_client())
         && (tsd.get_seg_wnd() <= SLAM_MAX)
         && (tsd.get_seg_ack() == listener->get_iss() + 1)
         && !( tsd.get_tcph()->is_fin() | tsd.get_tcph()->is_rst() )
@@ -919,14 +893,14 @@ void TcpSession::flush_listener(Packet* p)
 
     /* figure out direction of this packet -- we should've already
      * looked at it, so the packet_flags are already set. */
-    if ( p->packet_flags & PKT_FROM_SERVER )
+    if ( p->is_from_server() )
     {
         DebugMessage(DEBUG_STREAM_STATE, "Flushing listener on packet from server\n");
         listener = client;
         /* dir of flush is the data from the opposite side */
         dir = PKT_FROM_SERVER;
     }
-    else if ( p->packet_flags & PKT_FROM_CLIENT )
+    else if ( p->is_from_client() )
     {
         DebugMessage(DEBUG_STREAM_STATE, "Flushing listener on packet from client\n");
         listener = server;
@@ -951,14 +925,14 @@ void TcpSession::flush_talker(Packet* p)
 
     /* figure out direction of this packet -- we should've already
      * looked at it, so the packet_flags are already set. */
-    if ( p->packet_flags & PKT_FROM_SERVER )
+    if ( p->is_from_server() )
     {
         DebugMessage(DEBUG_STREAM_STATE, "Flushing talker on packet from server\n");
         talker = server;
         /* dir of flush is the data from the opposite side */
         dir = PKT_FROM_CLIENT;
     }
-    else if ( p->packet_flags & PKT_FROM_CLIENT )
+    else if ( p->is_from_client() )
     {
         DebugMessage(DEBUG_STREAM_STATE, "Flushing talker on packet from client\n");
         talker = client;
@@ -1027,7 +1001,7 @@ void TcpSession::do_packet_analysis_post_checks(Packet* p)
 
         DebugFormat(DEBUG_STREAM_STATE,
             "Stream Ignoring packet from %d. Session marked as ignore\n",
-            p->packet_flags & PKT_FROM_SERVER ? "server" : "client");
+            p->is_from_server() ? "server" : "client");
     }
 }
 
@@ -1087,7 +1061,7 @@ bool TcpSession::do_packet_analysis_pre_checks(Packet* p, TcpSegmentDescriptor&
     pkt_action_mask = ACTION_NOTHING;
     tel.clear_tcp_events();
     // process thru state machine...talker first
-    if (p->packet_flags & PKT_FROM_CLIENT)
+    if (p->is_from_client())
     {
         update_session_on_client_packet(tsd);
         DEBUG_WRAP(t_name = "Server"; l_name = "Client");
@@ -1159,7 +1133,7 @@ int TcpSession::process(Packet* p)
     {
         Profile profile(s5TcpStatePerfStats);
 
-        if ( tsm.eval(tsd, *talker, *listener) )
+        if ( tsm->eval(tsd, *talker, *listener) )
         {
             do_packet_analysis_post_checks(p);
             S5TraceTCP(p, flow, &tsd, 0);
diff --git a/src/stream/tcp/tcp_session.h b/src/stream/tcp/tcp_session.h
index c1c910949..cd033e56b 100644
--- a/src/stream/tcp/tcp_session.h
+++ b/src/stream/tcp/tcp_session.h
@@ -35,9 +35,6 @@
 
 class TcpEventLogger;
 
-// FIXIT-L session tracking must be split from reassembly
-// into a separate module a la ip_session.cc and ip_defrag.cc
-// (of course defrag should also be cleaned up)
 class TcpSession : public TcpStreamSession
 {
 public:
@@ -93,7 +90,7 @@ private:
     void do_packet_analysis_post_checks(Packet*);
 
 
-    TcpStateMachine tsm;
+    TcpStateMachine* tsm;
 };
 
 #endif
diff --git a/src/stream/tcp/tcp_state_close_wait.cc b/src/stream/tcp/tcp_state_close_wait.cc
index 84c815117..96eb85f0f 100644
--- a/src/stream/tcp/tcp_state_close_wait.cc
+++ b/src/stream/tcp/tcp_state_close_wait.cc
@@ -32,8 +32,8 @@ using namespace std;
 #include "catch/catch.hpp"
 #endif
 
-TcpStateCloseWait::TcpStateCloseWait(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_CLOSE_WAIT, tsm, ssn)
+TcpStateCloseWait::TcpStateCloseWait(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_CLOSE_WAIT, tsm)
 {
 }
 
@@ -41,144 +41,121 @@ TcpStateCloseWait::~TcpStateCloseWait()
 {
 }
 
-bool TcpStateCloseWait::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+    trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
 
     if ( tsd.get_seg_len() )
-        session.handle_data_on_syn(tsd);
+        trk.session->handle_data_on_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
-    session.handle_data_segment(tsd);
+    trk.session->handle_data_segment(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_on_fin_sent(tsd);
     trk.set_tcp_state(TcpStreamTracker::TCP_LAST_ACK);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
     Flow* flow = tsd.get_flow();
 
     trk.update_tracker_ack_recv(tsd);
     if ( SEQ_GEQ(tsd.get_seg_seq(), trk.get_fin_final_seq() ) )
     {
         DebugMessage(DEBUG_STREAM_STATE, "FIN beyond previous, ignoring\n");
-        session.tel.set_tcp_event(EVENT_BAD_FIN);
+        trk.session->tel.set_tcp_event(EVENT_BAD_FIN);
         trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
-        session.set_pkt_action_flag(ACTION_BAD_PKT);
+        trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
     }
     else
     {
         if ( !flow->two_way_traffic() )
             trk.set_tf_flags(TF_FORCE_FLUSH);
         if ( tsd.get_seg_len() > 0 )
-            session.handle_data_segment(tsd);
+            trk.session->handle_data_segment(tsd);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateCloseWait::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.update_on_rst_recv(tsd) )
     {
-        session.update_session_on_rst(tsd, true);
-        session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
-        session.set_pkt_action_flag(ACTION_RST);
+        trk.session->update_session_on_rst(tsd, true);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+        trk.session->set_pkt_action_flag(ACTION_RST);
     }
     else
     {
-        session.tel.set_tcp_event(EVENT_BAD_RST);
+        trk.session->tel.set_tcp_event(EVENT_BAD_RST);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateCloseWait::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateCloseWait::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    return session.validate_packet_established_session(tsd);
+    return trk.session->validate_packet_established_session(tsd);
 }
 
-bool TcpStateCloseWait::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateCloseWait::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    session.update_paws_timestamps(tsd);
-    session.check_for_window_slam(tsd);
+    trk.session->update_paws_timestamps(tsd);
+    trk.session->check_for_window_slam(tsd);
 
     return true;
 }
diff --git a/src/stream/tcp/tcp_state_close_wait.h b/src/stream/tcp/tcp_state_close_wait.h
index 3d28aa076..de99b2445 100644
--- a/src/stream/tcp/tcp_state_close_wait.h
+++ b/src/stream/tcp/tcp_state_close_wait.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateCloseWait : public TcpStateHandler
 {
 public:
-    TcpStateCloseWait(TcpStateMachine&, TcpSession&);
+    TcpStateCloseWait(TcpStateMachine&);
     virtual ~TcpStateCloseWait(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
@@ -45,8 +45,8 @@ public:
     bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
     bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 
-    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
-    bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+    bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 };
 
 #endif
diff --git a/src/stream/tcp/tcp_state_closed.cc b/src/stream/tcp/tcp_state_closed.cc
index c378e884a..b7426419f 100644
--- a/src/stream/tcp/tcp_state_closed.cc
+++ b/src/stream/tcp/tcp_state_closed.cc
@@ -32,8 +32,8 @@
 #include "stream/libtcp/stream_tcp_unit_test.h"
 #endif
 
-TcpStateClosed::TcpStateClosed(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_CLOSED, tsm, ssn)
+TcpStateClosed::TcpStateClosed(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_CLOSED, tsm)
 {
 }
 
@@ -45,7 +45,7 @@ bool TcpStateClosed::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& track
 {
     auto& trk = static_cast< TcpStreamTracker& >( tracker );
 
-    session.check_for_repeated_syn(tsd);
+    trk.session->check_for_repeated_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
@@ -55,7 +55,7 @@ bool TcpStateClosed::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& track
     auto& trk = static_cast< TcpStreamTracker& >( tracker );
     Flow* flow = tsd.get_flow();
 
-    flow->set_expire(tsd.get_pkt(), session.config->session_timeout);
+    flow->set_expire(tsd.get_pkt(), trk.session->config->session_timeout);
 
     return default_state_action(tsd, trk);
 }
@@ -102,14 +102,14 @@ bool TcpStateClosed::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker&
     if ( flow->get_session_flags() & SSNFLAG_RESET )
     {
         if ( trk.is_rst_pkt_sent() )
-            session.tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
+            trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
         else
-            session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+            trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
     }
     else
-        session.tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
+        trk.session->tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
 
-    session.mark_packet_for_drop(tsd);
+    trk.session->mark_packet_for_drop(tsd);
 
     return default_state_action(tsd, trk);
 }
@@ -141,9 +141,9 @@ bool TcpStateClosed::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& track
     if( tsd.get_seg_len() > 0 )
     {
         if ( trk.is_rst_pkt_sent() )
-            session.tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
+            trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RESET);
         else
-            session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+            trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
     }
 
     return default_state_action(tsd, trk);
@@ -162,40 +162,40 @@ bool TcpStateClosed::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& track
 
     if ( trk.update_on_rst_recv(tsd) )
     {
-        session.update_session_on_rst(tsd, false);
-        session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
-        session.set_pkt_action_flag(ACTION_RST);
+        trk.session->update_session_on_rst(tsd, false);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+        trk.session->set_pkt_action_flag(ACTION_RST);
     }
     else
     {
-        session.tel.set_tcp_event(EVENT_BAD_RST);
+        trk.session->tel.set_tcp_event(EVENT_BAD_RST);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosed::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateClosed::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    return session.validate_packet_established_session(tsd);
+    return trk.session->validate_packet_established_session(tsd);
 }
 
-bool TcpStateClosed::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateClosed::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    session.update_paws_timestamps(tsd);
-    session.check_for_window_slam(tsd);
+    trk.session->update_paws_timestamps(tsd);
+    trk.session->check_for_window_slam(tsd);
 
     if ( tcp_event != TcpStreamTracker::TCP_FIN_RECV_EVENT )
     {
-        TcpStreamTracker::TcpState talker_state = session.get_talker_state();
+        TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
         Flow* flow = tsd.get_flow();
 
         if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT ) || !flow->two_way_traffic() )
         {
             // The last ACK is a part of the session. Delete the session after processing is
             // complete.
-            session.clear_session(false, true, false, tsd.get_pkt() );
+            trk.session->clear_session(false, true, false, tsd.get_pkt() );
             flow->session_state |= STREAM_STATE_CLOSED;
-            session.set_pkt_action_flag(ACTION_LWSSN_CLOSED);
+            trk.session->set_pkt_action_flag(ACTION_LWSSN_CLOSED);
         }
     }
 
diff --git a/src/stream/tcp/tcp_state_closed.h b/src/stream/tcp/tcp_state_closed.h
index 13c556433..f95bf51f9 100644
--- a/src/stream/tcp/tcp_state_closed.h
+++ b/src/stream/tcp/tcp_state_closed.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateClosed : public TcpStateHandler
 {
 public:
-    TcpStateClosed(TcpStateMachine&, TcpSession&);
+    TcpStateClosed(TcpStateMachine&);
     virtual ~TcpStateClosed(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
@@ -45,8 +45,8 @@ public:
     bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
     bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 
-    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
-    bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+    bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 };
 
 #endif
diff --git a/src/stream/tcp/tcp_state_closing.cc b/src/stream/tcp/tcp_state_closing.cc
index 54e462137..ab8020a94 100644
--- a/src/stream/tcp/tcp_state_closing.cc
+++ b/src/stream/tcp/tcp_state_closing.cc
@@ -32,8 +32,8 @@ using namespace std;
 #include "catch/catch.hpp"
 #endif
 
-TcpStateClosing::TcpStateClosing(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_CLOSING, tsm, ssn)
+TcpStateClosing::TcpStateClosing(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_CLOSING, tsm)
 {
 }
 
@@ -41,53 +41,41 @@ TcpStateClosing::~TcpStateClosing()
 {
 }
 
-bool TcpStateClosing::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    session.check_for_repeated_syn(tsd);
+    trk.session->check_for_repeated_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+    trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
     if ( tsd.get_seg_len() )
-        session.handle_data_on_syn(tsd);
+        trk.session->handle_data_on_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
     if ( SEQ_GEQ(tsd.get_end_seq(), trk.r_nxt_ack) )
         trk.set_tcp_state(TcpStreamTracker::TCP_TIME_WAIT);
@@ -95,19 +83,15 @@ bool TcpStateClosing::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trac
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
     if ( SEQ_GEQ(tsd.get_end_seq(), trk.r_nxt_ack) )
         trk.set_tcp_state(TcpStreamTracker::TCP_TIME_WAIT);
@@ -115,27 +99,24 @@ bool TcpStateClosing::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker&
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
     Flow* flow = tsd.get_flow();
 
     trk.update_tracker_ack_recv(tsd);
     if ( SEQ_GEQ(tsd.get_seg_seq(), trk.get_fin_final_seq() ) )
     {
         DebugMessage(DEBUG_STREAM_STATE, "FIN beyond previous, ignoring\n");
-        session.tel.set_tcp_event(EVENT_BAD_FIN);
+        trk.session->tel.set_tcp_event(EVENT_BAD_FIN);
         trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
-        session.set_pkt_action_flag(ACTION_BAD_PKT);
+        trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
     }
 
     if ( !flow->two_way_traffic() )
@@ -147,40 +128,36 @@ bool TcpStateClosing::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trac
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateClosing::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.update_on_rst_recv(tsd) )
     {
-        session.update_session_on_rst(tsd, true);
-        session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
-        session.set_pkt_action_flag(ACTION_RST);
+        trk.session->update_session_on_rst(tsd, true);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+        trk.session->set_pkt_action_flag(ACTION_RST);
     }
     else
     {
-        session.tel.set_tcp_event(EVENT_BAD_RST);
+        trk.session->tel.set_tcp_event(EVENT_BAD_RST);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateClosing::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateClosing::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    return session.validate_packet_established_session(tsd);
+    return trk.session->validate_packet_established_session(tsd);
 }
 
-bool TcpStateClosing::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateClosing::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    session.update_paws_timestamps(tsd);
-    session.check_for_window_slam(tsd);
+    trk.session->update_paws_timestamps(tsd);
+    trk.session->check_for_window_slam(tsd);
 
     return true;
 }
diff --git a/src/stream/tcp/tcp_state_closing.h b/src/stream/tcp/tcp_state_closing.h
index 7aa182114..c63523b39 100644
--- a/src/stream/tcp/tcp_state_closing.h
+++ b/src/stream/tcp/tcp_state_closing.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateClosing : public TcpStateHandler
 {
 public:
-    TcpStateClosing(TcpStateMachine&, TcpSession&);
+    TcpStateClosing(TcpStateMachine&);
     virtual ~TcpStateClosing(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
@@ -45,8 +45,8 @@ public:
     bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
     bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 
-    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
-    bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+    bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 };
 
 #endif
diff --git a/src/stream/tcp/tcp_state_established.cc b/src/stream/tcp/tcp_state_established.cc
index 2d41bae4c..77b2b0264 100644
--- a/src/stream/tcp/tcp_state_established.cc
+++ b/src/stream/tcp/tcp_state_established.cc
@@ -25,8 +25,8 @@
 #include "tcp_normalizer.h"
 #include "tcp_state_established.h"
 
-TcpStateEstablished::TcpStateEstablished(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_ESTABLISHED, tsm, ssn)
+TcpStateEstablished::TcpStateEstablished(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_ESTABLISHED, tsm)
 {
 }
 
@@ -34,152 +34,127 @@ TcpStateEstablished::~TcpStateEstablished()
 {
 }
 
-bool TcpStateEstablished::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    session.check_for_repeated_syn(tsd);
+    trk.session->check_for_repeated_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    session.check_for_repeated_syn(tsd);
+    trk.session->check_for_repeated_syn(tsd);
 
-    trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+    trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt()) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt()) )
     {
-        session.update_session_on_syn_ack( );
+        trk.session->update_session_on_syn_ack( );
     }
 
     if ( trk.is_server_tracker() )
-        trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+        trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
-    session.handle_data_segment(tsd);
+    trk.session->handle_data_segment(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_on_fin_sent(tsd);
-    session.eof_handle(tsd.get_pkt());
+    trk.session->eof_handle(tsd.get_pkt());
     trk.set_tcp_state(TcpStreamTracker::TCP_FIN_WAIT1);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
     if ( tsd.get_seg_len() > 0 )
     {
-        session.handle_data_segment(tsd);
+        trk.session->handle_data_segment(tsd);
         trk.flush_data_on_fin_recv(tsd);
     }
     trk.update_on_fin_recv(tsd);
-    session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+    trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
     trk.set_tcp_state(TcpStreamTracker::TCP_CLOSE_WAIT);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateEstablished::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.update_on_rst_recv(tsd) )
     {
-        session.update_session_on_rst(tsd, false);
-        session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
-        session.set_pkt_action_flag(ACTION_RST);
+        trk.session->update_session_on_rst(tsd, false);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+        trk.session->set_pkt_action_flag(ACTION_RST);
     }
     else
     {
-        session.tel.set_tcp_event(EVENT_BAD_RST);
+        trk.session->tel.set_tcp_event(EVENT_BAD_RST);
     }
 
     // FIXIT - might be good to create alert specific to RST with data
     if ( tsd.get_seg_len() > 0 )
-        session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+        trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateEstablished::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateEstablished::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    return session.validate_packet_established_session(tsd);
+    return trk.session->validate_packet_established_session(tsd);
 }
 
-bool TcpStateEstablished::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateEstablished::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    session.update_paws_timestamps(tsd);
-
-    session.check_for_window_slam(tsd);
+    trk.session->update_paws_timestamps(tsd);
+    trk.session->check_for_window_slam(tsd);
 
     return true;
 }
diff --git a/src/stream/tcp/tcp_state_established.h b/src/stream/tcp/tcp_state_established.h
index 8261ca663..b57900fcc 100644
--- a/src/stream/tcp/tcp_state_established.h
+++ b/src/stream/tcp/tcp_state_established.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateEstablished : public TcpStateHandler
 {
 public:
-    TcpStateEstablished(TcpStateMachine&, TcpSession&);
+    TcpStateEstablished(TcpStateMachine&);
     virtual ~TcpStateEstablished(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
@@ -45,8 +45,8 @@ public:
     bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
     bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 
-    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
-    bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+    bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 };
 
 #endif
diff --git a/src/stream/tcp/tcp_state_fin_wait1.cc b/src/stream/tcp/tcp_state_fin_wait1.cc
index 1f920d262..67c4192fa 100644
--- a/src/stream/tcp/tcp_state_fin_wait1.cc
+++ b/src/stream/tcp/tcp_state_fin_wait1.cc
@@ -32,8 +32,8 @@ using namespace std;
 #include "catch/catch.hpp"
 #endif
 
-TcpStateFinWait1::TcpStateFinWait1(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_FIN_WAIT1, tsm, ssn)
+TcpStateFinWait1::TcpStateFinWait1(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_FIN_WAIT1, tsm)
 {
 }
 
@@ -41,97 +41,78 @@ TcpStateFinWait1::~TcpStateFinWait1()
 {
 }
 
-bool TcpStateFinWait1::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    session.check_for_repeated_syn(tsd);
+    trk.session->check_for_repeated_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait1::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+    trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
     if ( tsd.get_seg_len() )
-        session.handle_data_on_syn(tsd);
+        trk.session->handle_data_on_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait1::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait1::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( tsd.get_seg_len() )
-        session.handle_data_on_syn(tsd);
+        trk.session->handle_data_on_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait1::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait1::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
     check_for_window_slam(tsd, trk);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait1::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait1::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
     if ( check_for_window_slam(tsd, trk) )
     {
         if ( tsd.get_seg_len() > 0 )
-            session.handle_data_segment(tsd);
+            trk.session->handle_data_segment(tsd);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait1::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait1::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
     Flow* flow = tsd.get_flow();
 
     trk.update_tracker_ack_recv(tsd);
@@ -141,7 +122,7 @@ bool TcpStateFinWait1::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tra
     {
         //session.handle_fin_recv_in_fw1(tsd);
         if ( tsd.get_seg_len() > 0 )
-            session.handle_data_segment(tsd);
+            trk.session->handle_data_segment(tsd);
 
         if ( !flow->two_way_traffic() )
             trk.set_tf_flags(TF_FORCE_FLUSH);
@@ -152,31 +133,27 @@ bool TcpStateFinWait1::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tra
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait1::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait1::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait1::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.update_on_rst_recv(tsd) )
     {
-        session.update_session_on_rst(tsd, true);
-        session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
-        session.set_pkt_action_flag(ACTION_RST);
+        trk.session->update_session_on_rst(tsd, true);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+        trk.session->set_pkt_action_flag(ACTION_RST);
     }
     else
     {
-        session.tel.set_tcp_event(EVENT_BAD_RST);
+        trk.session->tel.set_tcp_event(EVENT_BAD_RST);
     }
 
     // FIXIT - might be good to create alert specific to RST with data
     if ( tsd.get_seg_len() > 0 )
-        session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+        trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
 
     return default_state_action(tsd, trk);
 }
@@ -191,12 +168,12 @@ bool TcpStateFinWait1::check_for_window_slam(TcpSegmentDescriptor& tsd, TcpStrea
         if ( (trk.normalizer->get_os_policy() == StreamPolicy::OS_WINDOWS)
             && (tsd.get_seg_wnd() == 0))
         {
-            session.tel.set_tcp_event(EVENT_WINDOW_SLAM);
+            trk.session->tel.set_tcp_event(EVENT_WINDOW_SLAM);
             inc_tcp_discards();
 
             if (trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK))
             {
-                session.set_pkt_action_flag(ACTION_BAD_PKT);
+                trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
                 return false;
             }
         }
@@ -207,15 +184,15 @@ bool TcpStateFinWait1::check_for_window_slam(TcpSegmentDescriptor& tsd, TcpStrea
     return true;
 }
 
-bool TcpStateFinWait1::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateFinWait1::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    return session.validate_packet_established_session(tsd);
+    return trk.session->validate_packet_established_session(tsd);
 }
 
-bool TcpStateFinWait1::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateFinWait1::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    session.update_paws_timestamps(tsd);
-    session.check_for_window_slam(tsd);
+    trk.session->update_paws_timestamps(tsd);
+    trk.session->check_for_window_slam(tsd);
     return true;
 }
 
diff --git a/src/stream/tcp/tcp_state_fin_wait1.h b/src/stream/tcp/tcp_state_fin_wait1.h
index 1f026625b..feaf0b7a9 100644
--- a/src/stream/tcp/tcp_state_fin_wait1.h
+++ b/src/stream/tcp/tcp_state_fin_wait1.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateFinWait1 : public TcpStateHandler
 {
 public:
-    TcpStateFinWait1(TcpStateMachine&, TcpSession&);
+    TcpStateFinWait1(TcpStateMachine&);
     virtual ~TcpStateFinWait1(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
@@ -45,8 +45,8 @@ public:
     bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
     bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 
-    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
-    bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+    bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 
 private:
     bool check_for_window_slam(TcpSegmentDescriptor&, TcpStreamTracker&);
diff --git a/src/stream/tcp/tcp_state_fin_wait2.cc b/src/stream/tcp/tcp_state_fin_wait2.cc
index 08a915304..cb75a85c2 100644
--- a/src/stream/tcp/tcp_state_fin_wait2.cc
+++ b/src/stream/tcp/tcp_state_fin_wait2.cc
@@ -32,8 +32,8 @@ using namespace std;
 #include "catch/catch.hpp"
 #endif
 
-TcpStateFinWait2::TcpStateFinWait2(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_FIN_WAIT2, tsm, ssn)
+TcpStateFinWait2::TcpStateFinWait2(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_FIN_WAIT2, tsm)
 {
 }
 
@@ -41,61 +41,49 @@ TcpStateFinWait2::~TcpStateFinWait2()
 {
 }
 
-bool TcpStateFinWait2::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    session.check_for_repeated_syn(tsd);
+    trk.session->check_for_repeated_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+    trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
     if ( tsd.get_seg_len() )
-        session.handle_data_on_syn(tsd);
+        trk.session->handle_data_on_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( tsd.get_seg_len() )
-        session.handle_data_on_syn(tsd);
+        trk.session->handle_data_on_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( SEQ_GT(tsd.get_seg_ack(), trk.get_snd_nxt() ) )
     {
         trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
-        session.tel.set_tcp_event(EVENT_BAD_ACK);
-        session.set_pkt_action_flag(ACTION_BAD_PKT);
+        trk.session->tel.set_tcp_event(EVENT_BAD_ACK);
+        trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
     }
     else
         trk.update_tracker_ack_recv(tsd);
@@ -103,54 +91,47 @@ bool TcpStateFinWait2::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tra
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
     // data on a segment when we shouldn't be sending data any more alert!
-    session.tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
-    session.mark_packet_for_drop(tsd);
+    trk.session->tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
+    trk.session->mark_packet_for_drop(tsd);
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( SEQ_GT(tsd.get_seg_ack(), trk.get_snd_nxt() ) )
     {
         trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
-        session.tel.set_tcp_event(EVENT_BAD_ACK);
-        session.set_pkt_action_flag(ACTION_BAD_PKT);
+        trk.session->tel.set_tcp_event(EVENT_BAD_ACK);
+        trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
     }
     else
     {
         trk.update_tracker_ack_recv(tsd);
         if ( tsd.get_seg_len() > 0 )
-            session.handle_data_segment(tsd);
+            trk.session->handle_data_segment(tsd);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
     Flow* flow = tsd.get_flow();
 
     trk.update_tracker_ack_recv(tsd);
     trk.update_on_fin_recv(tsd);
 
     if ( tsd.get_seg_len() > 0 )
-        session.handle_data_segment(tsd);
+        trk.session->handle_data_segment(tsd);
 
     if ( !flow->two_way_traffic() )
         trk.set_tf_flags(TF_FORCE_FLUSH);
@@ -160,40 +141,36 @@ bool TcpStateFinWait2::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tra
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateFinWait2::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.update_on_rst_recv(tsd) )
     {
-        session.update_session_on_rst(tsd, true);
-        session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
-        session.set_pkt_action_flag(ACTION_RST);
+        trk.session->update_session_on_rst(tsd, true);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+        trk.session->set_pkt_action_flag(ACTION_RST);
     }
     else
     {
-        session.tel.set_tcp_event(EVENT_BAD_RST);
+        trk.session->tel.set_tcp_event(EVENT_BAD_RST);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateFinWait2::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateFinWait2::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    return session.validate_packet_established_session(tsd);
+    return trk.session->validate_packet_established_session(tsd);
 }
 
-bool TcpStateFinWait2::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateFinWait2::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    session.update_paws_timestamps(tsd);
-    session.check_for_window_slam(tsd);
+    trk.session->update_paws_timestamps(tsd);
+    trk.session->check_for_window_slam(tsd);
     return true;
 }
 
diff --git a/src/stream/tcp/tcp_state_fin_wait2.h b/src/stream/tcp/tcp_state_fin_wait2.h
index 41e17324e..ef5695c0e 100644
--- a/src/stream/tcp/tcp_state_fin_wait2.h
+++ b/src/stream/tcp/tcp_state_fin_wait2.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateFinWait2 : public TcpStateHandler
 {
 public:
-    TcpStateFinWait2(TcpStateMachine&, TcpSession&);
+    TcpStateFinWait2(TcpStateMachine&);
     virtual ~TcpStateFinWait2(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
@@ -45,8 +45,8 @@ public:
     bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
     bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 
-    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
-    bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+    bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 };
 
 #endif
diff --git a/src/stream/tcp/tcp_state_last_ack.cc b/src/stream/tcp/tcp_state_last_ack.cc
index 4c565827a..31c683841 100644
--- a/src/stream/tcp/tcp_state_last_ack.cc
+++ b/src/stream/tcp/tcp_state_last_ack.cc
@@ -32,8 +32,8 @@ using namespace std;
 #include "catch/catch.hpp"
 #endif
 
-TcpStateLastAck::TcpStateLastAck(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_LAST_ACK, tsm, ssn)
+TcpStateLastAck::TcpStateLastAck(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_LAST_ACK, tsm)
 {
 }
 
@@ -41,53 +41,41 @@ TcpStateLastAck::~TcpStateLastAck()
 {
 }
 
-bool TcpStateLastAck::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    session.check_for_repeated_syn(tsd);
+    trk.session->check_for_repeated_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+    trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
     if ( tsd.get_seg_len() )
-        session.handle_data_on_syn(tsd);
+        trk.session->handle_data_on_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
     if ( SEQ_EQ(tsd.get_seg_ack(), trk.get_snd_nxt() ) )
         trk.set_tcp_state(TcpStreamTracker::TCP_CLOSED);
@@ -95,19 +83,15 @@ bool TcpStateLastAck::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trac
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
     if ( SEQ_EQ(tsd.get_seg_ack(), trk.get_snd_nxt() ) )
         trk.set_tcp_state(TcpStreamTracker::TCP_CLOSED);
@@ -115,18 +99,15 @@ bool TcpStateLastAck::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker&
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
     Flow* flow = tsd.get_flow();
 
     trk.update_tracker_ack_recv(tsd);
@@ -139,49 +120,45 @@ bool TcpStateLastAck::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trac
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateLastAck::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.update_on_rst_recv(tsd) )
     {
-        session.update_session_on_rst(tsd, false);
-        session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
-        session.set_pkt_action_flag(ACTION_RST);
+        trk.session->update_session_on_rst(tsd, false);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+        trk.session->set_pkt_action_flag(ACTION_RST);
     }
     else
     {
-        session.tel.set_tcp_event(EVENT_BAD_RST);
+        trk.session->tel.set_tcp_event(EVENT_BAD_RST);
     }
 
     // FIXIT - might be good to create alert specific to RST with data
     if ( tsd.get_seg_len() > 0 )
-        session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+        trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateLastAck::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateLastAck::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    return session.validate_packet_established_session(tsd);
+    return trk.session->validate_packet_established_session(tsd);
 }
 
-bool TcpStateLastAck::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateLastAck::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    session.update_paws_timestamps(tsd);
-    session.check_for_window_slam(tsd);
+    trk.session->update_paws_timestamps(tsd);
+    trk.session->check_for_window_slam(tsd);
 
-    if ( ( session.get_listener_state() == TcpStreamTracker::TCP_CLOSED ) &&
+    if ( ( trk.session->get_listener_state() == TcpStreamTracker::TCP_CLOSED ) &&
         ( tcp_event != TcpStreamTracker::TCP_FIN_RECV_EVENT ) )
     {
-        TcpStreamTracker::TcpState talker_state = session.get_talker_state();
+        TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
         Flow* flow = tsd.get_flow();
 
         if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT )
@@ -189,9 +166,9 @@ bool TcpStateLastAck::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
         {
             // The last ACK is a part of the session. Delete the session after processing is
             // complete.
-            session.clear_session(false, true, false, tsd.get_pkt() );
+            trk.session->clear_session(false, true, false, tsd.get_pkt() );
             flow->session_state |= STREAM_STATE_CLOSED;
-            session.set_pkt_action_flag(ACTION_LWSSN_CLOSED);
+            trk.session->set_pkt_action_flag(ACTION_LWSSN_CLOSED);
         }
     }
 
diff --git a/src/stream/tcp/tcp_state_last_ack.h b/src/stream/tcp/tcp_state_last_ack.h
index 7cef7243d..c5bc6bc13 100644
--- a/src/stream/tcp/tcp_state_last_ack.h
+++ b/src/stream/tcp/tcp_state_last_ack.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateLastAck : public TcpStateHandler
 {
 public:
-    TcpStateLastAck(TcpStateMachine&, TcpSession&);
+    TcpStateLastAck(TcpStateMachine&);
     virtual ~TcpStateLastAck(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
@@ -45,8 +45,8 @@ public:
     bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
     bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 
-    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
-    bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+    bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 };
 
 #endif
diff --git a/src/stream/tcp/tcp_state_listen.cc b/src/stream/tcp/tcp_state_listen.cc
index 9eb3860e8..2085379f7 100644
--- a/src/stream/tcp/tcp_state_listen.cc
+++ b/src/stream/tcp/tcp_state_listen.cc
@@ -25,8 +25,8 @@
 #include "tcp_normalizer.h"
 #include "tcp_state_listen.h"
 
-TcpStateListen::TcpStateListen(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_LISTEN, tsm, ssn)
+TcpStateListen::TcpStateListen(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_LISTEN, tsm)
 {
 }
 
@@ -34,80 +34,71 @@ TcpStateListen::~TcpStateListen()
 {
 }
 
-bool TcpStateListen::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->require_3whs() || tsd.has_wscale() || ( tsd.get_seg_len() > 0 ) )
+    if ( trk.session->config->require_3whs() || tsd.has_wscale() || ( tsd.get_seg_len() > 0 ) )
     {
         // FIXIT - do we need this check? only server goes into Listen state...
-        if ( tsd.get_pkt()->packet_flags & PKT_FROM_SERVER )
-            session.tel.set_tcp_event(EVENT_4WHS);
+        if ( tsd.get_pkt()->is_from_server() )
+            trk.session->tel.set_tcp_event(EVENT_4WHS);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateListen::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.init_on_syn_recv(tsd);
-    trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
-    session.set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
+    trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
+    trk.session->set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
     if ( tsd.get_seg_len() > 0 )
-        session.handle_data_on_syn(tsd);
+        trk.session->handle_data_on_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateListen::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
     Flow* flow = tsd.get_flow();
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
 
     flow->session_state |= ( STREAM_STATE_SYN | STREAM_STATE_SYN_ACK );
 
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         trk.init_on_synack_sent(tsd);
-        trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
-        session.init_new_tcp_session(tsd);
+        trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
+        trk.session->init_new_tcp_session(tsd);
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateListen::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( !session.config->require_3whs() || session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( !trk.session->config->require_3whs() || trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         trk.init_on_synack_recv(tsd);
         if ( tsd.get_seg_len() > 0 )
-            session.handle_data_segment(tsd);
+            trk.session->handle_data_segment(tsd);
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateListen::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
-        ( tsd.get_seg_len() > 0 ) ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() )
+            && ( tsd.has_wscale() || ( tsd.get_seg_len() > 0 ) ) )
     {
         Flow* flow = tsd.get_flow();
 
@@ -116,47 +107,43 @@ bool TcpStateListen::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& track
         flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_SYN_ACK |
             STREAM_STATE_ESTABLISHED );
         trk.init_on_3whs_ack_sent(tsd);
-        session.init_new_tcp_session(tsd);
-        session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+        trk.session->init_new_tcp_session(tsd);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateListen::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
-        ( tsd.get_seg_len() > 0 ) ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() )
+            && ( tsd.has_wscale() || ( tsd.get_seg_len() > 0 ) ) )
     {
         Flow* flow = tsd.get_flow();
 
         if ( !tsd.get_tcph()->is_rst() && ( flow->session_state & STREAM_STATE_SYN_ACK ) )
         {
             trk.init_on_3whs_ack_recv(tsd);
-            trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+            trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
         }
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateListen::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         Flow* flow = tsd.get_flow();
 
@@ -164,91 +151,81 @@ bool TcpStateListen::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker&
         flow->set_session_flags(SSNFLAG_MIDSTREAM);
 
         trk.init_on_data_seg_sent(tsd);
-        session.init_new_tcp_session(tsd);
+        trk.session->init_new_tcp_session(tsd);
 
         if ( flow->session_state & STREAM_STATE_ESTABLISHED )
-            session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+            trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateListen::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         Flow* flow = tsd.get_flow();
 
         flow->session_state |= STREAM_STATE_MIDSTREAM;
         flow->set_session_flags(SSNFLAG_MIDSTREAM);
         trk.init_on_data_seg_recv(tsd);
-        trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
-        session.handle_data_segment(tsd);
+        trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
+        trk.session->handle_data_segment(tsd);
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateListen::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateListen::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         // FIXIT - handle this
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateListen::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateListen::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateListen::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.normalizer->trim_rst_payload(tsd);
 
     return default_state_action(tsd, trk);
diff --git a/src/stream/tcp/tcp_state_listen.h b/src/stream/tcp/tcp_state_listen.h
index a430d8ab1..fe86fbe5a 100644
--- a/src/stream/tcp/tcp_state_listen.h
+++ b/src/stream/tcp/tcp_state_listen.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateListen : public TcpStateHandler
 {
 public:
-    TcpStateListen(TcpStateMachine&, TcpSession&);
+    TcpStateListen(TcpStateMachine&);
     virtual ~TcpStateListen(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
diff --git a/src/stream/tcp/tcp_state_none.cc b/src/stream/tcp/tcp_state_none.cc
index 2fcf37942..b14e6ab0d 100644
--- a/src/stream/tcp/tcp_state_none.cc
+++ b/src/stream/tcp/tcp_state_none.cc
@@ -32,8 +32,8 @@
 #include "stream/libtcp/stream_tcp_unit_test.h"
 #endif
 
-TcpStateNone::TcpStateNone(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_STATE_NONE, tsm, ssn)
+TcpStateNone::TcpStateNone(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_STATE_NONE, tsm)
 {
 }
 
@@ -41,74 +41,66 @@ TcpStateNone::~TcpStateNone()
 {
 }
 
-bool TcpStateNone::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
     Flow* flow = tsd.get_flow();
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
 
     flow->ssn_state.direction = FROM_CLIENT;
 
     flow->session_state |= STREAM_STATE_SYN;
     trk.init_on_syn_sent(tsd);
-    session.init_new_tcp_session(tsd);
+    trk.session->init_new_tcp_session(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateNone::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     // FIXIT - syn received on undefined client, figure this out and do the right thing
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateNone::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
     Flow* flow = tsd.get_flow();
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
 
-    if ( !session.config->require_3whs() || session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( !trk.session->config->require_3whs() || trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         flow->session_state |= ( STREAM_STATE_SYN | STREAM_STATE_SYN_ACK );
         trk.init_on_synack_sent(tsd);
-        session.init_new_tcp_session(tsd);
-        trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+        trk.session->init_new_tcp_session(tsd);
+        trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateNone::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         trk.init_on_synack_recv(tsd);
-        trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+        trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
         if ( tsd.get_seg_len() > 0 )
-            session.handle_data_segment(tsd);
+            trk.session->handle_data_segment(tsd);
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateNone::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
         ( tsd.get_seg_len() > 0 ) ) )
     {
         Flow* flow = tsd.get_flow();
@@ -118,23 +110,21 @@ bool TcpStateNone::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker
         flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_SYN_ACK |
             STREAM_STATE_ESTABLISHED );
         trk.init_on_3whs_ack_sent(tsd);
-        session.init_new_tcp_session(tsd);
-        session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+        trk.session->init_new_tcp_session(tsd);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateNone::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) && ( tsd.has_wscale() ||
         ( tsd.get_seg_len() > 0 ) ) )
     {
         Flow* flow = tsd.get_flow();
@@ -142,23 +132,21 @@ bool TcpStateNone::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker
         if ( !tsd.get_tcph()->is_rst() && ( flow->session_state & STREAM_STATE_SYN_ACK ) )
         {
             trk.init_on_3whs_ack_recv(tsd);
-            trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+            trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
         }
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateNone::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         Flow* flow = tsd.get_flow();
 
@@ -166,25 +154,23 @@ bool TcpStateNone::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tr
         flow->set_session_flags(SSNFLAG_MIDSTREAM);
 
         trk.init_on_data_seg_sent(tsd);
-        session.init_new_tcp_session(tsd);
+        trk.session->init_new_tcp_session(tsd);
 
         if ( flow->session_state & STREAM_STATE_ESTABLISHED )
-            session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+            trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateNone::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         Flow* flow = tsd.get_flow();
 
@@ -192,57 +178,51 @@ bool TcpStateNone::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tr
         flow->set_session_flags(SSNFLAG_MIDSTREAM);
 
         trk.init_on_data_seg_recv(tsd);
-        trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
-        session.handle_data_segment(tsd);
+        trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
+        trk.session->handle_data_segment(tsd);
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateNone::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         // FIXIT - handle this
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateNone::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         // FIXIT - handle this
     }
-    else if ( session.config->require_3whs() )
+    else if ( trk.session->config->require_3whs() )
     {
-        session.generate_no_3whs_event();
+        trk.session->generate_no_3whs_event();
         return false;
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateNone::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt() ) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt() ) )
     {
         // FIXIT - handle this
     }
@@ -250,19 +230,17 @@ bool TcpStateNone::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateNone::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateNone::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.update_on_rst_recv(tsd) )
     {
-        session.update_session_on_rst(tsd, false);
-        session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
-        session.set_pkt_action_flag(ACTION_RST);
+        trk.session->update_session_on_rst(tsd, false);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+        trk.session->set_pkt_action_flag(ACTION_RST);
     }
     else
     {
-        session.tel.set_tcp_event(EVENT_BAD_RST);
+        trk.session->tel.set_tcp_event(EVENT_BAD_RST);
     }
 
     return default_state_action(tsd, trk);
diff --git a/src/stream/tcp/tcp_state_none.h b/src/stream/tcp/tcp_state_none.h
index d139021d2..945107055 100644
--- a/src/stream/tcp/tcp_state_none.h
+++ b/src/stream/tcp/tcp_state_none.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateNone : public TcpStateHandler
 {
 public:
-    TcpStateNone(TcpStateMachine&, TcpSession&);
+    TcpStateNone(TcpStateMachine&);
     virtual ~TcpStateNone(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
diff --git a/src/stream/tcp/tcp_state_syn_recv.cc b/src/stream/tcp/tcp_state_syn_recv.cc
index 5ca34d457..a3a96bff0 100644
--- a/src/stream/tcp/tcp_state_syn_recv.cc
+++ b/src/stream/tcp/tcp_state_syn_recv.cc
@@ -28,8 +28,8 @@ using namespace std;
 #include "tcp_normalizer.h"
 #include "tcp_state_syn_recv.h"
 
-TcpStateSynRecv::TcpStateSynRecv(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_SYN_RECV, tsm, ssn)
+TcpStateSynRecv::TcpStateSynRecv(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_SYN_RECV, tsm)
 {
 }
 
@@ -37,174 +37,153 @@ TcpStateSynRecv::~TcpStateSynRecv()
 {
 }
 
-bool TcpStateSynRecv::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
     Flow* flow = tsd.get_flow();
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
 
     trk.finish_server_init(tsd);
-    trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
-    session.update_timestamp_tracking(tsd);
+    trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
+    trk.session->update_timestamp_tracking(tsd);
     if ( tsd.get_tcph()->are_flags_set(TH_ECE) &&
         ( flow->get_session_flags() & SSNFLAG_ECN_CLIENT_QUERY ) )
         flow->set_session_flags(SSNFLAG_ECN_SERVER_REPLY);
 
-    if ( tsd.get_pkt()->packet_flags & PKT_FROM_SERVER )
+    if ( tsd.get_pkt()->is_from_server() )
     {
         flow->set_session_flags(SSNFLAG_SEEN_SERVER);
-        session.tel.set_tcp_event(EVENT_4WHS);
+        trk.session->tel.set_tcp_event(EVENT_4WHS);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( tsd.get_seg_len() )
-        session.handle_data_on_syn(tsd);
+        trk.session->handle_data_on_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
     Flow* flow = tsd.get_flow();
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
 
     // FIXIT - verify ack being sent is valid...
     trk.finish_server_init(tsd);
-    trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+    trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
     flow->session_state |= STREAM_STATE_SYN_ACK;
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.is_ack_valid(tsd.get_seg_ack() ) )
     {
         Flow* flow = tsd.get_flow();
 
         trk.update_tracker_ack_recv(tsd);
-        trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+        trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
         flow->set_session_flags(SSNFLAG_ESTABLISHED);
         flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_ESTABLISHED );
-        session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
         trk.set_tcp_state(TcpStreamTracker::TCP_ESTABLISHED);
         if ( tsd.get_seg_len() )
-            session.handle_data_on_syn(tsd);
+            trk.session->handle_data_on_syn(tsd);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    if ( session.config->midstream_allowed(tsd.get_pkt()) )
+    if ( trk.session->config->midstream_allowed(tsd.get_pkt()) )
     {
-        session.update_session_on_ack( );
+        trk.session->update_session_on_ack( );
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.is_ack_valid(tsd.get_seg_ack() ) )
     {
         Flow* flow = tsd.get_flow();
 
         trk.update_tracker_ack_recv(tsd);
-        session.set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
+        trk.session->set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
         tsd.get_pkt()->packet_flags |= PKT_STREAM_TWH;
         flow->set_session_flags(SSNFLAG_ESTABLISHED);
         flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_ESTABLISHED );
-        session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
         trk.set_tcp_state(TcpStreamTracker::TCP_ESTABLISHED);
         if ( tsd.get_seg_len() > 0 )
-            session.handle_data_segment(tsd);
+            trk.session->handle_data_segment(tsd);
         else
-            session.check_for_window_slam(tsd);
+            trk.session->check_for_window_slam(tsd);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.is_ack_valid(tsd.get_seg_ack() ) )
     {
         trk.update_tracker_ack_recv(tsd);
         tsd.get_pkt()->packet_flags |= PKT_STREAM_TWH;
-        session.set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
-        session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+        trk.session->set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
         trk.set_tcp_state(TcpStreamTracker::TCP_ESTABLISHED);
         if ( tsd.get_seg_len() > 0 )
-            session.handle_data_segment(tsd);
+            trk.session->handle_data_segment(tsd);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
     if ( tsd.get_tcph()->is_ack() )
     {
         Flow* flow = tsd.get_flow();
 
         trk.update_tracker_ack_recv(tsd);
-        session.set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
+        trk.session->set_pkt_action_flag(trk.normalizer->handle_paws(tsd) );
         flow->session_state |= STREAM_STATE_ACK;
         if ( tsd.get_seg_len() > 0 )
         {
-            session.handle_data_segment(tsd);
+            trk.session->handle_data_segment(tsd);
             trk.flush_data_on_fin_recv(tsd);
         }
 
         trk.update_on_fin_recv(tsd);
-        session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
         trk.set_tcp_state(TcpStreamTracker::TCP_CLOSE_WAIT);
     }
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynRecv::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.normalizer->trim_rst_payload(tsd);
     if ( trk.normalizer->validate_rst(tsd) )
     {
@@ -219,19 +198,19 @@ bool TcpStateSynRecv::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trac
         DebugMessage(DEBUG_STREAM_STATE, "Received RST with bad sequence number\n");
         inc_tcp_discards();
         trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
-        session.tel.set_tcp_event(EVENT_BAD_RST);
+        trk.session->tel.set_tcp_event(EVENT_BAD_RST);
     }
 
     // FIXIT - might be good to create alert specific to RST with data
     if ( tsd.get_seg_len() > 0 )
-        session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+        trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynRecv::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateSynRecv::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    session.check_for_window_slam(tsd);
+    trk.session->check_for_window_slam(tsd);
 
     return true;
 }
diff --git a/src/stream/tcp/tcp_state_syn_recv.h b/src/stream/tcp/tcp_state_syn_recv.h
index 0f6177a2c..4b12f1958 100644
--- a/src/stream/tcp/tcp_state_syn_recv.h
+++ b/src/stream/tcp/tcp_state_syn_recv.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateSynRecv : public TcpStateHandler
 {
 public:
-    TcpStateSynRecv(TcpStateMachine&, TcpSession&);
+    TcpStateSynRecv(TcpStateMachine&);
     virtual ~TcpStateSynRecv(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
@@ -45,7 +45,7 @@ public:
     bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
     bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 
-    bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+    bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 };
 
 #endif
diff --git a/src/stream/tcp/tcp_state_syn_sent.cc b/src/stream/tcp/tcp_state_syn_sent.cc
index 41a0188c4..09324b9c4 100644
--- a/src/stream/tcp/tcp_state_syn_sent.cc
+++ b/src/stream/tcp/tcp_state_syn_sent.cc
@@ -32,8 +32,8 @@ using namespace std;
 #include "catch/catch.hpp"
 #endif
 
-TcpStateSynSent::TcpStateSynSent(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_SYN_SENT, tsm, ssn)
+TcpStateSynSent::TcpStateSynSent(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_SYN_SENT, tsm)
 {
 }
 
@@ -41,143 +41,121 @@ TcpStateSynSent::~TcpStateSynSent()
 {
 }
 
-bool TcpStateSynSent::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    session.check_for_repeated_syn(tsd);
+    trk.session->check_for_repeated_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynSent::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.finish_client_init(tsd);
     if ( tsd.get_seg_len() )
-        session.handle_data_on_syn(tsd);
+        trk.session->handle_data_on_syn(tsd);
     trk.set_tcp_state(TcpStreamTracker::TCP_SYN_RECV);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynSent::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynSent::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.update_on_3whs_ack(tsd) )
     {
-        session.update_timestamp_tracking(tsd);
+        trk.session->update_timestamp_tracking(tsd);
         if ( tsd.get_seg_len() )
-            session.handle_data_on_syn(tsd);
+            trk.session->handle_data_on_syn(tsd);
     }
     else
-        session.set_pkt_action_flag(ACTION_BAD_PKT);
+        trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynSent::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
     Flow* flow = tsd.get_flow();
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
 
     // FIXIT - verify ack being sent is valid...
     trk.update_tracker_ack_sent(tsd);
     flow->set_session_flags(SSNFLAG_ESTABLISHED);
     flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_ESTABLISHED );
-    session.update_timestamp_tracking(tsd);
-    session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+    trk.session->update_timestamp_tracking(tsd);
+    trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
     trk.set_tcp_state(TcpStreamTracker::TCP_ESTABLISHED);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynSent::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( tsd.get_seg_len() > 0 )
-        session.handle_data_segment(tsd);
+        trk.session->handle_data_segment(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynSent::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
     Flow* flow = tsd.get_flow();
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
 
     // FIXIT - verify ack being sent is valid...
     trk.update_tracker_ack_sent(tsd);
     flow->set_session_flags(SSNFLAG_ESTABLISHED);
     flow->session_state |= ( STREAM_STATE_ACK | STREAM_STATE_ESTABLISHED );
-    session.update_timestamp_tracking(tsd);
-    session.update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
+    trk.session->update_timestamp_tracking(tsd);
+    trk.session->update_perf_base_state(TcpStreamTracker::TCP_ESTABLISHED);
     trk.set_tcp_state(TcpStreamTracker::TCP_ESTABLISHED);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynSent::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    session.handle_data_segment(tsd);
+    trk.session->handle_data_segment(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynSent::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynSent::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( tsd.get_seg_len() > 0 )
-        session.handle_data_segment(tsd);
+        trk.session->handle_data_segment(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynSent::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateSynSent::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateSynSent::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.update_on_rst_recv(tsd) )
     {
-        session.update_session_on_rst(tsd, false);
-        session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
-        session.set_pkt_action_flag(ACTION_RST);
+        trk.session->update_session_on_rst(tsd, false);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+        trk.session->set_pkt_action_flag(ACTION_RST);
     }
     else
     {
-        session.tel.set_tcp_event(EVENT_BAD_RST);
+        trk.session->tel.set_tcp_event(EVENT_BAD_RST);
     }
 
     // FIXIT - might be good to create alert specific to RST with data
     if ( tsd.get_seg_len() > 0 )
-        session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+        trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
 
     return default_state_action(tsd, trk);
 }
diff --git a/src/stream/tcp/tcp_state_syn_sent.h b/src/stream/tcp/tcp_state_syn_sent.h
index fd4f4bd14..c8308a670 100644
--- a/src/stream/tcp/tcp_state_syn_sent.h
+++ b/src/stream/tcp/tcp_state_syn_sent.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateSynSent : public TcpStateHandler
 {
 public:
-    TcpStateSynSent(TcpStateMachine&, TcpSession&);
+    TcpStateSynSent(TcpStateMachine&);
     virtual ~TcpStateSynSent(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
diff --git a/src/stream/tcp/tcp_state_time_wait.cc b/src/stream/tcp/tcp_state_time_wait.cc
index 80573adbe..0fe380c93 100644
--- a/src/stream/tcp/tcp_state_time_wait.cc
+++ b/src/stream/tcp/tcp_state_time_wait.cc
@@ -32,8 +32,8 @@ using namespace std;
 #include "catch/catch.hpp"
 #endif
 
-TcpStateTimeWait::TcpStateTimeWait(TcpStateMachine& tsm, TcpSession& ssn) :
-    TcpStateHandler(TcpStreamTracker::TCP_TIME_WAIT, tsm, ssn)
+TcpStateTimeWait::TcpStateTimeWait(TcpStateMachine& tsm) :
+    TcpStateHandler(TcpStreamTracker::TCP_TIME_WAIT, tsm)
 {
 }
 
@@ -41,139 +41,118 @@ TcpStateTimeWait::~TcpStateTimeWait()
 {
 }
 
-bool TcpStateTimeWait::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::syn_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
-    session.check_for_repeated_syn(tsd);
+    trk.session->check_for_repeated_syn(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateTimeWait::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
-{
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
 
-    trk.normalizer->ecn_tracker(tsd.get_tcph(), session.config->require_3whs() );
+
+bool TcpStateTimeWait::syn_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
+{
+    trk.normalizer->ecn_tracker(tsd.get_tcph(), trk.session->config->require_3whs() );
     if ( tsd.get_seg_len() )
-        session.handle_data_on_syn(tsd);
+        trk.session->handle_data_on_syn(tsd);
 
     return true;
 }
 
-bool TcpStateTimeWait::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::syn_ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateTimeWait::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::syn_ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateTimeWait::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::ack_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_sent(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateTimeWait::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::ack_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateTimeWait::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::data_seg_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
     // data on a segment when we shouldn't be sending data any more alert!
-    session.tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
-    session.mark_packet_for_drop(tsd);
+    trk.session->tel.set_tcp_event(EVENT_DATA_ON_CLOSED);
+    trk.session->mark_packet_for_drop(tsd);
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateTimeWait::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::data_seg_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateTimeWait::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::fin_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateTimeWait::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::fin_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     trk.update_tracker_ack_recv(tsd);
     if ( SEQ_GEQ(tsd.get_seg_seq(), trk.get_fin_final_seq() ) )
     {
         DebugMessage(DEBUG_STREAM_STATE, "FIN beyond previous, ignoring\n");
-        session.tel.set_tcp_event(EVENT_BAD_FIN);
+        trk.session->tel.set_tcp_event(EVENT_BAD_FIN);
         trk.normalizer->packet_dropper(tsd, NORM_TCP_BLOCK);
-        session.set_pkt_action_flag(ACTION_BAD_PKT);
+        trk.session->set_pkt_action_flag(ACTION_BAD_PKT);
     }
     else if ( tsd.get_seg_len() > 0 )
-        session.handle_data_segment(tsd);
+        trk.session->handle_data_segment(tsd);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateTimeWait::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::rst_sent(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateTimeWait::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& tracker)
+bool TcpStateTimeWait::rst_recv(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    auto& trk = static_cast< TcpStreamTracker& >( tracker );
-
     if ( trk.update_on_rst_recv(tsd) )
     {
-        session.update_session_on_rst(tsd, false);
-        session.update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
-        session.set_pkt_action_flag(ACTION_RST);
+        trk.session->update_session_on_rst(tsd, false);
+        trk.session->update_perf_base_state(TcpStreamTracker::TCP_CLOSING);
+        trk.session->set_pkt_action_flag(ACTION_RST);
     }
     else
     {
-        session.tel.set_tcp_event(EVENT_BAD_RST);
+        trk.session->tel.set_tcp_event(EVENT_BAD_RST);
     }
 
     // FIXIT - might be good to create alert specific to RST with data
     if ( tsd.get_seg_len() > 0 )
-        session.tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
+        trk.session->tel.set_tcp_event(EVENT_DATA_AFTER_RST_RCVD);
 
     return default_state_action(tsd, trk);
 }
 
-bool TcpStateTimeWait::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateTimeWait::do_pre_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    return session.validate_packet_established_session(tsd);
+    return trk.session->validate_packet_established_session(tsd);
 }
 
-bool TcpStateTimeWait::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
+bool TcpStateTimeWait::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd, TcpStreamTracker& trk)
 {
-    session.update_paws_timestamps(tsd);
-    session.check_for_window_slam(tsd);
+    trk.session->update_paws_timestamps(tsd);
+    trk.session->check_for_window_slam(tsd);
 
     if ( tcp_event != TcpStreamTracker::TCP_FIN_RECV_EVENT )
     {
-        TcpStreamTracker::TcpState talker_state = session.get_talker_state();
+        TcpStreamTracker::TcpState talker_state = trk.session->get_talker_state();
         Flow* flow = tsd.get_flow();
 
         if ( ( talker_state == TcpStreamTracker::TCP_TIME_WAIT )
@@ -181,9 +160,9 @@ bool TcpStateTimeWait::do_post_sm_packet_actions(TcpSegmentDescriptor& tsd)
         {
             // The last ACK is a part of the session. Delete the session after processing is
             // complete.
-            session.clear_session(false, true, false, tsd.get_pkt() );
+            trk.session->clear_session(false, true, false, tsd.get_pkt() );
             flow->session_state |= STREAM_STATE_CLOSED;
-            session.set_pkt_action_flag(ACTION_LWSSN_CLOSED);
+            trk.session->set_pkt_action_flag(ACTION_LWSSN_CLOSED);
         }
     }
     return true;
diff --git a/src/stream/tcp/tcp_state_time_wait.h b/src/stream/tcp/tcp_state_time_wait.h
index 67a0f4002..d69b7f544 100644
--- a/src/stream/tcp/tcp_state_time_wait.h
+++ b/src/stream/tcp/tcp_state_time_wait.h
@@ -29,7 +29,7 @@ class TcpSession;
 class TcpStateTimeWait : public TcpStateHandler
 {
 public:
-    TcpStateTimeWait(TcpStateMachine&, TcpSession&);
+    TcpStateTimeWait(TcpStateMachine&);
     virtual ~TcpStateTimeWait(void);
 
     bool syn_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
@@ -45,8 +45,8 @@ public:
     bool rst_sent(TcpSegmentDescriptor&, TcpStreamTracker&) override;
     bool rst_recv(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 
-    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&) override;
-    bool do_post_sm_packet_actions(TcpSegmentDescriptor&) override;
+    bool do_pre_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
+    bool do_post_sm_packet_actions(TcpSegmentDescriptor&, TcpStreamTracker&) override;
 };
 
 #endif
diff --git a/src/stream/tcp/tcp_stream_state_machine.cc b/src/stream/tcp/tcp_stream_state_machine.cc
new file mode 100644
index 000000000..d83eb00e8
--- /dev/null
+++ b/src/stream/tcp/tcp_stream_state_machine.cc
@@ -0,0 +1,63 @@
+//--------------------------------------------------------------------------
+// Copyright (C) 2015-2015 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation.  You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+//--------------------------------------------------------------------------
+
+// tcp_stream_state_machine.cc author davis mcpherson <davmcphe@@cisco.com>
+// Created on: Apr 1, 2016
+
+#include "tcp_state_none.h"
+#include "tcp_state_closed.h"
+#include "tcp_state_listen.h"
+#include "tcp_state_syn_sent.h"
+#include "tcp_state_syn_recv.h"
+#include "tcp_state_established.h"
+#include "tcp_state_close_wait.h"
+#include "tcp_state_closing.h"
+#include "tcp_state_fin_wait1.h"
+#include "tcp_state_fin_wait2.h"
+#include "tcp_state_last_ack.h"
+#include "tcp_state_time_wait.h"
+
+#include "tcp_stream_state_machine.h"
+
+TcpStreamStateMachine::TcpStreamStateMachine()
+{
+    // TODO Auto-generated destructor stub
+}
+
+TcpStreamStateMachine::~TcpStreamStateMachine()
+{
+    // TODO Auto-generated destructor stub
+}
+
+void TcpStreamStateMachine::initialize_tsm(void)
+{
+    // initialize stream tracker state machine with handler for each state...
+    new TcpStateNone(*this);
+    new TcpStateClosed(*this);
+    new TcpStateListen(*this);
+    new TcpStateSynSent(*this);
+    new TcpStateSynRecv(*this);
+    new TcpStateEstablished(*this);
+    new TcpStateFinWait1(*this);
+    new TcpStateFinWait2(*this);
+    new TcpStateClosing(*this);
+    new TcpStateCloseWait(*this);
+    new TcpStateLastAck(*this);
+    new TcpStateTimeWait(*this);
+}
+
diff --git a/src/stream/tcp/tcp_stream_state_machine.h b/src/stream/tcp/tcp_stream_state_machine.h
new file mode 100644
index 000000000..80ad311d0
--- /dev/null
+++ b/src/stream/tcp/tcp_stream_state_machine.h
@@ -0,0 +1,52 @@
+//--------------------------------------------------------------------------
+// Copyright (C) 2015-2015 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation.  You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+//--------------------------------------------------------------------------
+
+// tcp_stream_state_machine.h author davis mcpherson <davmcphe@@cisco.com>
+// Created on: Apr 1, 2016
+
+#ifndef TCP_STREAM_STATE_MACHINE_H_
+#define TCP_STREAM_STATE_MACHINE_H_
+
+#include "stream/libtcp/tcp_state_machine.h"
+
+class TcpStreamStateMachine: public TcpStateMachine
+{
+public:
+    virtual ~TcpStreamStateMachine();
+
+
+    static TcpStateMachine* get_instance( void )
+    {
+        static TcpStreamStateMachine* tsm = nullptr;
+
+        if( !tsm )
+        {
+            tsm = new TcpStreamStateMachine;
+            tsm->initialize_tsm();
+        }
+
+        return tsm;
+    }
+
+private:
+    TcpStreamStateMachine();
+    void initialize_tsm(void);
+
+};
+#endif
+
diff --git a/src/stream/tcp/tcp_tracker.cc b/src/stream/tcp/tcp_tracker.cc
index 7ea12a7a9..5dd36a2b4 100644
--- a/src/stream/tcp/tcp_tracker.cc
+++ b/src/stream/tcp/tcp_tracker.cc
@@ -26,10 +26,12 @@
 #include "tcp_module.h"
 #include "tcp_normalizers.h"
 #include "tcp_reassemblers.h"
+#include "tcp_session.h"
 
-TcpTracker::TcpTracker(bool client) :
+TcpTracker::TcpTracker(bool client, TcpSession* ssn) :
     TcpStreamTracker(client)
 {
+    session = ssn;
 }
 
 TcpTracker::~TcpTracker(void)
@@ -74,10 +76,10 @@ void TcpTracker::init_flush_policy(void)
 {
     if ( splitter == nullptr )
         flush_policy = STREAM_FLPOLICY_IGNORE;
-    else if ( !normalizer->is_tcp_ips_enabled() )
-        flush_policy = STREAM_FLPOLICY_ON_ACK;
-    else
+    else if ( normalizer->is_tcp_ips_enabled() )
         flush_policy = STREAM_FLPOLICY_ON_DATA;
+    else
+        flush_policy = STREAM_FLPOLICY_ON_ACK;
 }
 
 void TcpTracker::set_splitter(StreamSplitter* ss)
diff --git a/src/stream/tcp/tcp_tracker.h b/src/stream/tcp/tcp_tracker.h
index f6a07912c..1ea909694 100644
--- a/src/stream/tcp/tcp_tracker.h
+++ b/src/stream/tcp/tcp_tracker.h
@@ -50,11 +50,12 @@
 
 class TcpNormalizer;
 class TcpReassembler;
+class TcpSession;
 
 class TcpTracker : public TcpStreamTracker
 {
 public:
-    TcpTracker(bool);
+    TcpTracker(bool, TcpSession*);
     virtual ~TcpTracker(void);
 
     void init_tcp_state(void) override;
diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc
index 2da861797..e096d674c 100644
--- a/src/stream/udp/udp_session.cc
+++ b/src/stream/udp/udp_session.cc
@@ -80,7 +80,7 @@ static int ProcessUdp(
         return 0;
 
     /* if both seen, mark established */
-    if (p->packet_flags & PKT_FROM_SERVER)
+    if (p->is_from_server())
     {
         DebugMessage(DEBUG_STREAM_STATE,
             "Stream: Updating on packet from responder\n");
diff --git a/src/stream/user/user_session.cc b/src/stream/user/user_session.cc
index 7698af677..ccbcef7ca 100644
--- a/src/stream/user/user_session.cc
+++ b/src/stream/user/user_session.cc
@@ -380,7 +380,7 @@ void UserSession::update(Packet* p, Flow* flow)
 
     if ( !(flow->ssn_state.session_flags & SSNFLAG_ESTABLISHED) )
     {
-        if ( p->packet_flags & PKT_FROM_CLIENT )
+        if ( p->is_from_client() )
             flow->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT;
         else
             flow->ssn_state.session_flags |= SSNFLAG_SEEN_SERVER;
@@ -400,7 +400,7 @@ void UserSession::update(Packet* p, Flow* flow)
 
 void UserSession::restart(Packet* p)
 {
-    bool c2s = p->packet_flags & PKT_FROM_CLIENT;
+    bool c2s = p->is_from_client();
     UserTracker& ut = c2s ? server : client;
     std::list<UserSegment*>::iterator it;
     ut.total = 0;
@@ -483,7 +483,7 @@ int UserSession::process(Packet* p)
 
     update(p, flow);
 
-    UserTracker& ut = p->from_client() ? server : client;
+    UserTracker& ut = p->is_from_client() ? server : client;
 
     if ( p->ptrs.decode_flags & DECODE_SOF or !ut.splitter )
         start(p, flow);