diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 09125c79..25ff8383 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -47,33 +47,15 @@ jobs:
         run: |
             bash testdata/test_run_with_docker.sh "quay.io/ptcpdump/ptcpdump:latest"
 
-  test-backend:
-    runs-on: ubuntu-latest
-    needs: build
-    timeout-minutes: 5
-
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - name: Retrieve stored ptcpdump executable
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
-        with:
-          name: ptcpdump
-          path: ptcpdump
-
-      - name: test cgroup-skb
-        run: |
-          set -ex
-          chmod +x ./ptcpdump/ptcpdump
-          sudo bash testdata/test_cgroup_skb_base_pcap.sh ./ptcpdump/ptcpdump
-          sudo bash testdata/test_cgroup_skb_base_pcapng.sh ./ptcpdump/ptcpdump
-          sudo bash testdata/test_cgroup_skb_filter_ifindex.sh ./ptcpdump/ptcpdump
-
   e2e-test:
     name: e2e-test
     needs: build
     strategy:
       fail-fast: false
       matrix:
+        backend:
+          - 'tc'
+          - 'cgroup-skb'
         kernel:
           # renovate: datasource=docker depName=quay.io/lvh-images/kernel-images
           - '4.19-20241031.113911'
@@ -98,6 +80,14 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
+      - run: |
+          if [ "${{ matrix.backend }}" = "tc" ]; then
+            PTCPDUMP_EXTRA_ARGS=''
+          else
+            PTCPDUMP_EXTRA_ARGS='--backend cgroup-skb'
+          fi
+          echo "PTCPDUMP_EXTRA_ARGS=${PTCPDUMP_EXTRA_ARGS}" >> $GITHUB_ENV
+
       - name: Retrieve stored ptcpdump executable
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
         with:
@@ -150,8 +140,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             bash /host/testdata/test_default.sh /host/ptcpdump/ptcpdump
 
@@ -161,8 +150,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             bash /host/testdata/test_base.sh /host/ptcpdump/ptcpdump
 
@@ -172,8 +160,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             bash /host/testdata/test_parent_info.sh /host/ptcpdump/ptcpdump
 
@@ -183,8 +170,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             bash /host/testdata/test_pname_filter.sh /host/ptcpdump/ptcpdump
 
@@ -194,8 +180,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             bash /host/testdata/test_pid_filter.sh /host/ptcpdump/ptcpdump
 
@@ -205,8 +190,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             bash /host/testdata/test_read_pcap.sh /host/ptcpdump/ptcpdump
 
@@ -216,8 +200,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             bash /host/testdata/test_write_pcap.sh /host/ptcpdump/ptcpdump
 
@@ -227,8 +210,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             bash /host/testdata/test_write_stdout.sh /host/ptcpdump/ptcpdump
 
@@ -238,20 +220,18 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             bash /host/testdata/test_exist_connection.sh /host/ptcpdump/ptcpdump
 
       - name: Test arp and icmp
-        if: ${{ (!startsWith(matrix.kernel, '5.4')) && (!startsWith(matrix.kernel, '4.')) }}
+        if: ${{ (!startsWith(matrix.kernel, '5.4')) && (!startsWith(matrix.kernel, '4.')) && (!startsWith(matrix.backend, 'cgroup-skb')) }}
         uses: cilium/little-vm-helper@e87948476ca97050b1f149ab2aec379d0de19b84 # v0.0.23
         with:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             bash /host/testdata/test_arp.sh /host/ptcpdump/ptcpdump
             bash /host/testdata/test_icmp.sh /host/ptcpdump/ptcpdump
@@ -263,6 +243,8 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
+            
             bash /host/testdata/test_netns.sh /host/ptcpdump/ptcpdump
 
       - name: Test netns newly
@@ -272,6 +254,8 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
+            
             bash /host/testdata/test_netns_newly_normal.sh /host/ptcpdump/ptcpdump
             bash /host/testdata/test_netns_newly_exec.sh /host/ptcpdump/ptcpdump
 
@@ -281,8 +265,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             bash /host/testdata/test_sub_program.sh /host/ptcpdump/ptcpdump
             bash /host/testdata/test_sub_curl_domain_program.sh /host/ptcpdump/ptcpdump
@@ -293,8 +276,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             for i in {1..10}; do
               bash /host/testdata/test_nat.sh /host/ptcpdump/ptcpdump && exit 0 || sleep 1
@@ -313,8 +295,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             ls -lh /host/testdata/gohttpapp
 
@@ -332,8 +313,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             ls -lh /host/testdata/gohttpapp
 
@@ -351,8 +331,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             ls -lh /host/testdata/gohttpapp
 
@@ -370,8 +349,7 @@ jobs:
           provision: 'false'
           cmd: |
             set -ex
-            uname -a
-            cat /etc/issue
+            export PTCPDUMP_EXTRA_ARGS="${{ env.PTCPDUMP_EXTRA_ARGS }}"
 
             ls -lh /host/testdata/gohttpapp
 
diff --git a/bpf/bpf_arm64_bpfel.o b/bpf/bpf_arm64_bpfel.o
index ca4b24d2..baff9db5 100644
Binary files a/bpf/bpf_arm64_bpfel.o and b/bpf/bpf_arm64_bpfel.o differ
diff --git a/bpf/bpf_legacy_arm64_bpfel.o b/bpf/bpf_legacy_arm64_bpfel.o
index 9ae721cc..98031f09 100644
Binary files a/bpf/bpf_legacy_arm64_bpfel.o and b/bpf/bpf_legacy_arm64_bpfel.o differ
diff --git a/bpf/bpf_legacy_x86_bpfel.o b/bpf/bpf_legacy_x86_bpfel.o
index cb914015..7d9871ab 100644
Binary files a/bpf/bpf_legacy_x86_bpfel.o and b/bpf/bpf_legacy_x86_bpfel.o differ
diff --git a/bpf/bpf_no_tracing_arm64_bpfel.o b/bpf/bpf_no_tracing_arm64_bpfel.o
index ed23d2af..665bcba0 100644
Binary files a/bpf/bpf_no_tracing_arm64_bpfel.o and b/bpf/bpf_no_tracing_arm64_bpfel.o differ
diff --git a/bpf/bpf_no_tracing_x86_bpfel.o b/bpf/bpf_no_tracing_x86_bpfel.o
index 66f95b33..67b2e119 100644
Binary files a/bpf/bpf_no_tracing_x86_bpfel.o and b/bpf/bpf_no_tracing_x86_bpfel.o differ
diff --git a/bpf/bpf_x86_bpfel.o b/bpf/bpf_x86_bpfel.o
index d751595f..b49c19a7 100644
Binary files a/bpf/bpf_x86_bpfel.o and b/bpf/bpf_x86_bpfel.o differ
diff --git a/bpf/ptcpdump.c b/bpf/ptcpdump.c
index 0553b0de..ace7ff26 100644
--- a/bpf/ptcpdump.c
+++ b/bpf/ptcpdump.c
@@ -303,6 +303,11 @@ static __always_inline int fill_packet_event_meta(struct __sk_buff *skb, bool cg
     if (cgroup_skb && egress) {
         struct task_struct *task = (struct task_struct *)bpf_get_current_task();
         if (task && !is_kernel_thread(task)) {
+            if (parent_process_filter(task) < 0) {
+                if (process_filter(task) < 0) {
+                    goto outer;
+                }
+            }
             event_meta->l3_protocol = bpf_ntohs(skb->protocol);
             fill_process_meta_with_thread(task, pid_meta);
             if (pid_meta->pid > 0) {
@@ -310,6 +315,8 @@ static __always_inline int fill_packet_event_meta(struct __sk_buff *skb, bool cg
                 return 0;
             }
         }
+    outer:
+        (void)0;
         // debug_log("[ptcpdump][cgroup_sk] get_current_task failed\n");
     }
 
diff --git a/testdata/test_base.sh b/testdata/test_base.sh
index 2e36ec16..3daff309 100644
--- a/testdata/test_base.sh
+++ b/testdata/test_base.sh
@@ -10,7 +10,7 @@ RNAME="${FILE_PREFIX}_base.read.txt"
 
 
 function test_ptcpdump() {
-  timeout 30s ${CMD} -c 1 -v -i any --print -w "${FNAME}"  \
+  timeout 30s ${CMD} -c 1 -v -i any ${PTCPDUMP_EXTRA_ARGS} --print -w "${FNAME}"  \
     'dst host 1.1.1.1 and tcp[tcpflags] = tcp-syn' | tee "${LNAME}" &
   sleep 10
   curl -m 10 1.1.1.1 &>/dev/null || true
diff --git a/testdata/test_cgroup_skb_base_pcap.sh b/testdata/test_cgroup_skb_base_pcap.sh
deleted file mode 100644
index adc9e571..00000000
--- a/testdata/test_cgroup_skb_base_pcap.sh
+++ /dev/null
@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-
-set -ex
-
-CMD="$1"
-FILE_PREFIX="/tmp/ptcpdump"
-FNAME="${FILE_PREFIX}_base_cgroup_skb.pcap"
-LNAME="${FILE_PREFIX}_base_cgroup_skb.log"
-RNAME="${FILE_PREFIX}_base_cgroup_skb.read.txt"
-
-
-function test_ptcpdump() {
-  timeout 30s ${CMD} -c 1 --backend=cgroup-skb -v -i any --print -w "${FNAME}"  \
-    'dst host 1.1.1.1 and tcp[tcpflags] = tcp-syn' | tee "${LNAME}" &
-  sleep 10
-  curl -m 10 1.1.1.1 &>/dev/null || true
-  wait
-
-  cat "${LNAME}"
-  cat "${LNAME}" | grep '/usr/bin/curl'
-  cat "${LNAME}" | grep -F ' > 1.1.1.1.80: Flags [S],'   # SYN
-}
-
-function test_tcpdump_read() {
-  which tcpdump || (apt update || true && apt install -y tcpdump)
-  tcpdump -nr "${FNAME}"
-  tcpdump -nr "${FNAME}" | grep -F ' > 1.1.1.1.80: Flags [S],'   # SYN
-}
-
-function test_ptcpdump_read() {
-    timeout 30s ${CMD} -v -r "${FNAME}" |tee "${RNAME}"
-    cat "${RNAME}" | grep -F ' > 1.1.1.1.80: Flags [S],'   # SYN
-}
-
-function main() {
-    test_ptcpdump
-    test_tcpdump_read
-    test_ptcpdump_read
-}
-
-main
diff --git a/testdata/test_cgroup_skb_base_pcapng.sh b/testdata/test_cgroup_skb_base_pcapng.sh
deleted file mode 100644
index a3ec22ad..00000000
--- a/testdata/test_cgroup_skb_base_pcapng.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-
-set -ex
-
-CMD="$1"
-FILE_PREFIX="/tmp/ptcpdump"
-FNAME="${FILE_PREFIX}_base_cgroup_skb.pcapng"
-LNAME="${FILE_PREFIX}_base_cgroup_skb.log"
-RNAME="${FILE_PREFIX}_base_cgroup_skb.read.txt"
-
-
-function test_ptcpdump() {
-  timeout 30s ${CMD} -c 1 --backend=cgroup-skb -v -i any --print -w "${FNAME}"  \
-    'dst host 1.1.1.1 and tcp[tcpflags] = tcp-syn' | tee "${LNAME}" &
-  sleep 10
-  curl -m 10 1.1.1.1 &>/dev/null || true
-  wait
-
-  cat "${LNAME}"
-  cat "${LNAME}" | grep '/usr/bin/curl'
-  cat "${LNAME}" | grep -F ' > 1.1.1.1.80: Flags [S],'   # SYN
-}
-
-function test_tcpdump_read() {
-  which tcpdump || (apt update || true && apt install -y tcpdump)
-  tcpdump -nr "${FNAME}"
-  tcpdump -nr "${FNAME}" | grep -F ' > 1.1.1.1.80: Flags [S],'   # SYN
-}
-
-function test_ptcpdump_read() {
-    EXPECT_NAME="${LNAME}.read.expect"
-    cat "${LNAME}" > "${EXPECT_NAME}"
-    timeout 30s ${CMD} -v -r "${FNAME}" |tee "${RNAME}"
-    cat "${RNAME}" | grep '/usr/bin/curl'
-    cat "${RNAME}" | grep -F ' > 1.1.1.1.80: Flags [S],'   # SYN
-}
-
-function main() {
-    test_ptcpdump
-    test_tcpdump_read
-    test_ptcpdump_read
-}
-
-main
diff --git a/testdata/test_cgroup_skb_filter_ifindex.sh b/testdata/test_cgroup_skb_filter_ifindex.sh
deleted file mode 100644
index 72c496e7..00000000
--- a/testdata/test_cgroup_skb_filter_ifindex.sh
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/usr/bin/env bash
-
-set -ex
-
-CMD="$1"
-FILE_PREFIX="/tmp/ptcpdump"
-FNAME="${FILE_PREFIX}_ifindex_cgroup_skb.pcapng"
-LNAME="${FILE_PREFIX}_ifindex_cgroup_skb.log"
-RNAME="${FILE_PREFIX}_ifindex_cgroup_skb.read.txt"
-
-
-function test_ptcpdump() {
-  timeout 30s ${CMD} -c 2 --backend=cgroup-skb -v -i lo --print -w "${FNAME}"  \
-    'icmp' | tee "${LNAME}" &
-  sleep 10
-  ping -c 10 1.1.1.1 &>/dev/null || true &
-  ping -c 2 127.0.0.1 &>/dev/null || true
-  wait
-
-  cat "${LNAME}"
-  cat "${LNAME}" | grep 'ping'
-  cat "${LNAME}" | grep -F ' > 127.0.0.1: ICMP echo request,'
-}
-
-function test_tcpdump_read() {
-  which tcpdump || (apt update || true && apt install -y tcpdump)
-  tcpdump -nr "${FNAME}"
-  tcpdump -nr "${FNAME}" | grep -F ' > 127.0.0.1: ICMP echo request,'
-}
-
-function test_ptcpdump_read() {
-    EXPECT_NAME="${LNAME}.read.expect"
-    cat "${LNAME}" > "${EXPECT_NAME}"
-    timeout 30s ${CMD} -v -r "${FNAME}" |tee "${RNAME}"
-    cat "${RNAME}" | grep 'ping'
-    cat "${RNAME}" | grep -F ' > 127.0.0.1: ICMP echo request,'
-}
-
-function main() {
-    test_ptcpdump
-    test_tcpdump_read
-    test_ptcpdump_read
-}
-
-main
diff --git a/testdata/test_containerd.sh b/testdata/test_containerd.sh
index fb79197a..f2f73e5c 100644
--- a/testdata/test_containerd.sh
+++ b/testdata/test_containerd.sh
@@ -13,7 +13,7 @@ function test_ptcpdump() {
   nerdctl pull busybox:1
   nerdctl pull alpine:3.18
 
-  timeout 120s ${CMD} -i any --print -w "${FNAME}" --oneline -v \
+  timeout 120s ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} --print -w "${FNAME}" --oneline -v \
     'host 1.1.1.1 and port 80' -w "${FNAME}" | tee "${LNAME}" &
   sleep 10
 
diff --git a/testdata/test_containerd_container_id_filter.sh b/testdata/test_containerd_container_id_filter.sh
index 24ced962..3e4e7166 100644
--- a/testdata/test_containerd_container_id_filter.sh
+++ b/testdata/test_containerd_container_id_filter.sh
@@ -16,7 +16,7 @@ function test_ptcpdump() {
   export cid1
   echo $cid1
 
-  timeout 120s ${CMD} -i any -c 10 --print -w "${FNAME}" --oneline -v  \
+  timeout 120s ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} -c 10 --print -w "${FNAME}" --oneline -v  \
     --container-id ${cid1} -w "${FNAME}" | tee "${LNAME}"
 
   cat "${LNAME}"
diff --git a/testdata/test_containerd_container_name_filter.sh b/testdata/test_containerd_container_name_filter.sh
index 1c047040..395596fa 100644
--- a/testdata/test_containerd_container_name_filter.sh
+++ b/testdata/test_containerd_container_name_filter.sh
@@ -18,7 +18,7 @@ function test_ptcpdump() {
   export cid1
   echo $cid1
 
-  timeout 120s ${CMD} -i any -c 10 --print -w "${FNAME}" --oneline -v  \
+  timeout 120s ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} -c 10 --print -w "${FNAME}" --oneline -v  \
     --container-name ${cname} -w "${FNAME}" | tee "${LNAME}"
 
   cat "${LNAME}"
diff --git a/testdata/test_default.sh b/testdata/test_default.sh
index aef4be4a..6d593541 100644
--- a/testdata/test_default.sh
+++ b/testdata/test_default.sh
@@ -10,7 +10,7 @@ RNAME="${FILE_PREFIX}_default.read.txt"
 
 
 function test_ptcpdump() {
-  timeout 30s ${CMD} -c 2 -i lo -v --print -w "${FNAME}" \
+  timeout 30s ${CMD} -c 2 -i lo ${PTCPDUMP_EXTRA_ARGS} -v --print -w "${FNAME}" \
       'icmp and host 127.0.0.1' | tee "${LNAME}" &
   sleep 10
   ping -c 1 127.0.0.1 &>/dev/null || true
diff --git a/testdata/test_docker.sh b/testdata/test_docker.sh
index a95b0bfb..9d5b57c1 100644
--- a/testdata/test_docker.sh
+++ b/testdata/test_docker.sh
@@ -13,7 +13,7 @@ function test_ptcpdump() {
   docker pull busybox:1
   docker pull alpine:3.18
 
-  timeout 120s ${CMD} -i any --print -w "${FNAME}" -v --oneline  \
+  timeout 120s ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} --print -w "${FNAME}" -v --oneline  \
     'host 1.1.1.1' -w "${FNAME}" | tee "${LNAME}" &
   sleep 10
 
diff --git a/testdata/test_docker_container_id_filter.sh b/testdata/test_docker_container_id_filter.sh
index 37cc1461..da9562c7 100644
--- a/testdata/test_docker_container_id_filter.sh
+++ b/testdata/test_docker_container_id_filter.sh
@@ -16,7 +16,7 @@ function test_ptcpdump() {
   export cid1
   echo $cid1
 
-  timeout 120s ${CMD} -i any -c 10 --print -w "${FNAME}" -v --oneline \
+  timeout 120s ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} -c 10 --print -w "${FNAME}" -v --oneline \
     --container-id=${cid1} -w "${FNAME}" | tee "${LNAME}"
 
   cat "${LNAME}"
diff --git a/testdata/test_docker_container_name_filter.sh b/testdata/test_docker_container_name_filter.sh
index dd8c8bfb..715d07fb 100644
--- a/testdata/test_docker_container_name_filter.sh
+++ b/testdata/test_docker_container_name_filter.sh
@@ -17,7 +17,7 @@ function test_ptcpdump() {
   export cid1
   echo $cid1
 
-  timeout 120s ${CMD} -i any -c 10 --print -w "${FNAME}" -v --oneline  \
+  timeout 120s ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} -c 10 --print -w "${FNAME}" -v --oneline  \
     --container-name=${cname} -w "${FNAME}" | tee "${LNAME}"
 
   cat "${LNAME}"
diff --git a/testdata/test_exist_connection.sh b/testdata/test_exist_connection.sh
index 95590aba..2c1f8d9e 100644
--- a/testdata/test_exist_connection.sh
+++ b/testdata/test_exist_connection.sh
@@ -10,7 +10,7 @@ RNAME="${FILE_PREFIX}_exist_connection.read.txt"
 
 
 function test_ptcpdump() {
-  timeout 30s ${CMD} -c 10 -i any -v --print -w "${FNAME}" \
+  timeout 30s ${CMD} -c 10 ${PTCPDUMP_EXTRA_ARGS} -i any -v --print -w "${FNAME}" \
       'port 22' | tee "${LNAME}" &
   sleep 10
   echo foo
diff --git a/testdata/test_gotls_keylog.sh b/testdata/test_gotls_keylog.sh
index 8332cf11..0099544d 100644
--- a/testdata/test_gotls_keylog.sh
+++ b/testdata/test_gotls_keylog.sh
@@ -13,13 +13,13 @@ PCAP_FILE="${FILE_PREFIX}_keylog_${FILE_SUFFIX}.pcap"
 PCAPNG_FILE="${FILE_PREFIX}_keylog_${FILE_SUFFIX}.pcapng"
 
 function test_keylog_to_file() {
-    ${CMD} -i any --write-keylog-file ${KEYLOG_PATH} -w ${PCAP_FILE} -- ${APP}
+    ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} --write-keylog-file ${KEYLOG_PATH} -w ${PCAP_FILE} -- ${APP}
     cat ${KEYLOG_PATH}
     tshark -r ${PCAP_FILE} -o tls.keylog_file:${KEYLOG_PATH} | grep "GET /foo/bar HTTP/1.1"
 }
 
 function test_keylog_to_pcapng() {
-    ${CMD} -i any --embed-keylog-to-pcapng -w ${PCAPNG_FILE} -- ${APP}
+    ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} --embed-keylog-to-pcapng -w ${PCAPNG_FILE} -- ${APP}
     tshark -r ${PCAPNG_FILE} | grep "GET /foo/bar HTTP/1.1"
 }
 
diff --git a/testdata/test_k8s_filter_by_container_id.sh b/testdata/test_k8s_filter_by_container_id.sh
index 653c322a..ac90a5ff 100644
--- a/testdata/test_k8s_filter_by_container_id.sh
+++ b/testdata/test_k8s_filter_by_container_id.sh
@@ -16,7 +16,7 @@ function test_ptcpdump() {
   kubectl wait --for condition=Ready pod/test-ptcpdump
   cid=$(kubectl get pod test-ptcpdump -o yaml |grep -i containerID | head -n 1 | awk -F '//' '{print $2}')
 
-  timeout 120s ${CMD} -i any -c 5 --print -w "${FNAME}" --oneline -v \
+  timeout 120s ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} -c 5 --print -w "${FNAME}" --oneline -v \
     --container-id ${cid} -w "${FNAME}" | tee "${LNAME}"
 
   wait
diff --git a/testdata/test_k8s_filter_by_pod.sh b/testdata/test_k8s_filter_by_pod.sh
index 86048607..7d8cc96b 100644
--- a/testdata/test_k8s_filter_by_pod.sh
+++ b/testdata/test_k8s_filter_by_pod.sh
@@ -17,7 +17,7 @@ function test_ptcpdump() {
   kubectl -n test-ns wait --for condition=Ready pod/test-ptcpdump
   cid=$(kubectl get pod test-ptcpdump -o yaml |grep -i containerID | head -n 1 | awk -F '//' '{print $2}')
 
-  timeout 120s ${CMD} -i any -c 5 --print -w "${FNAME}" --oneline -v \
+  timeout 120s ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} -c 5 --print -w "${FNAME}" --oneline -v \
     --pod-name "test-ptcpdump.test-ns" -w "${FNAME}" | tee "${LNAME}"
 
   wait
diff --git a/testdata/test_k8s_filter_by_pod_2.sh b/testdata/test_k8s_filter_by_pod_2.sh
index d3bb03ee..94b19e6c 100644
--- a/testdata/test_k8s_filter_by_pod_2.sh
+++ b/testdata/test_k8s_filter_by_pod_2.sh
@@ -17,7 +17,7 @@ function test_ptcpdump() {
   kubectl -n test-ns apply -f "${TEST_YAML}"
   kubectl -n test-ns wait --for condition=Ready pod/test-ptcpdump
 
-  timeout 120s ${CMD} -i any -c 20 --print -w "${FNAME}" --oneline -v \
+  timeout 120s ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} -c 20 --print -w "${FNAME}" --oneline -v \
     --pod-name "test-ptcpdump.test-ns" | tee "${LNAME}"
 
   wait
diff --git a/testdata/test_nat.sh b/testdata/test_nat.sh
index 04e79f83..85797abf 100644
--- a/testdata/test_nat.sh
+++ b/testdata/test_nat.sh
@@ -10,7 +10,7 @@ RNAME="${FILE_PREFIX}_nat.read.txt"
 
 
 function test_ptcpdump() {
-  timeout 60s ${CMD} -c 20 -i any -v --print -w "${FNAME}" --oneline  \
+  timeout 60s ${CMD} -c 20 -i any ${PTCPDUMP_EXTRA_ARGS} -v --print -w "${FNAME}" --oneline  \
     'host 1.1.1.1' | tee "${LNAME}" &
   sleep 10
   docker run --rm alpine:3.18 sh -c 'wget --timeout=10 1.1.1.1 &>/dev/null || true'
diff --git a/testdata/test_netns.sh b/testdata/test_netns.sh
index a495a512..7f644dae 100644
--- a/testdata/test_netns.sh
+++ b/testdata/test_netns.sh
@@ -30,7 +30,7 @@ function setup_netns() {
 
 function test_ptcpdump_normal() {
   local LNAME="${LNAME}.normal"
-  timeout 30s ${CMD} -c 4 -i any --netns ${NETNS1} --netns ${NETNS2} -v --print -w "${FNAME}" \
+  timeout 30s ${CMD} -c 4 -i any ${PTCPDUMP_EXTRA_ARGS} --netns ${NETNS1} --netns ${NETNS2} -v --print -w "${FNAME}" \
       'icmp and host 192.168.64.2' | tee "${LNAME}" &
   sleep 10
   ping -c 2 1.1.1.1 &>/dev/null || true &
diff --git a/testdata/test_netns_newly_exec.sh b/testdata/test_netns_newly_exec.sh
index 1972e3d8..68ae08bd 100644
--- a/testdata/test_netns_newly_exec.sh
+++ b/testdata/test_netns_newly_exec.sh
@@ -29,7 +29,7 @@ function test_ptcpdump_exec() {
   curl 1.1.1.1 &>/dev/null || true &
   ip netns exec ${NETNS2}  sh -c "echo -e 'HTTP/1.1 200 OK\r\nContent-Length: 0\r\n\r\n' | nc -l 8000" &
 
-  timeout 30s ${CMD} -c 4 -i any --netns newly -v --print -w "${FNAME}" \
+  timeout 30s ${CMD} -c 4 -i any ${PTCPDUMP_EXTRA_ARGS} --netns newly -v --print -w "${FNAME}" \
       'tcp' \
       -- sh -c "bash ${CREATE_NS_SCRIPT} $NETNS1 $VETH1 $NETNS2 $VETH2 && ip netns exec ${NETNS1} curl http://192.168.64.2:8000"  | tee "${LNAME}"
 
diff --git a/testdata/test_netns_newly_normal.sh b/testdata/test_netns_newly_normal.sh
index 5e530ba7..e0880ff8 100644
--- a/testdata/test_netns_newly_normal.sh
+++ b/testdata/test_netns_newly_normal.sh
@@ -39,7 +39,7 @@ trap cleanup EXIT
 
 function test_ptcpdump_normal() {
   local LNAME="${LNAME}.normal"
-  timeout 30s ${CMD} -c 4 -i any --netns newly -v --print -w "${FNAME}" \
+  timeout 30s ${CMD} -c 4 -i any ${PTCPDUMP_EXTRA_ARGS} --netns newly -v --print -w "${FNAME}" \
       'icmp' | tee "${LNAME}" &
   sleep 10
   setup_netns
diff --git a/testdata/test_parent_info.sh b/testdata/test_parent_info.sh
index e0d9b49f..aa925785 100644
--- a/testdata/test_parent_info.sh
+++ b/testdata/test_parent_info.sh
@@ -10,7 +10,7 @@ RNAME="${FILE_PREFIX}_parent_info.read.txt"
 
 
 function test_ptcpdump() {
-  timeout 30s ${CMD} -c 1 -v -i any --print -w "${FNAME}" \
+  timeout 30s ${CMD} -c 1 ${PTCPDUMP_EXTRA_ARGS} -v -i any --print -w "${FNAME}" \
     'dst host 1.1.1.1 and tcp[tcpflags] = tcp-syn' | tee "${LNAME}" &
   sleep 10
   curl -m 10 1.1.1.1 &>/dev/null || true
diff --git a/testdata/test_pid_filter.sh b/testdata/test_pid_filter.sh
index 66aa30fb..d0676ae9 100644
--- a/testdata/test_pid_filter.sh
+++ b/testdata/test_pid_filter.sh
@@ -10,7 +10,7 @@ RNAME="${FILE_PREFIX}_filter_by_pid.read.txt"
 
 
 function test_ptcpdump() {
-  timeout 30s ${CMD} -c 6 --pid $$ -f -v -i any --print -w "${FNAME}" | tee "${LNAME}" &
+  timeout 30s ${CMD} -c 6 ${PTCPDUMP_EXTRA_ARGS} --pid $$ -f -v -i any --print -w "${FNAME}" | tee "${LNAME}" &
   sleep 10
   curl -m 10 1.1.1.1 &>/dev/null || true
   wait
diff --git a/testdata/test_pname_filter.sh b/testdata/test_pname_filter.sh
index 4c84cb5e..dae33121 100644
--- a/testdata/test_pname_filter.sh
+++ b/testdata/test_pname_filter.sh
@@ -10,7 +10,7 @@ RNAME="${FILE_PREFIX}_filter_by_pname.read.txt"
 
 
 function test_ptcpdump() {
-  timeout 30s ${CMD} -c 6 -v --pname curl -f -i any --print -w "${FNAME}"  | tee "${LNAME}" &
+  timeout 30s ${CMD} -c 6 ${PTCPDUMP_EXTRA_ARGS} -v --pname curl -f -i any --print -w "${FNAME}"  | tee "${LNAME}" &
   sleep 10
   curl -m 10 1.1.1.1 &>/dev/null || true
   wait
diff --git a/testdata/test_run_with_docker.sh b/testdata/test_run_with_docker.sh
index 75b0a882..c8882aed 100644
--- a/testdata/test_run_with_docker.sh
+++ b/testdata/test_run_with_docker.sh
@@ -14,7 +14,7 @@ export TMP="/tmp/"
 
 
 function test_ptcpdump() {
-  timeout 60s ${CMD} -c 1 -v -i any --print -w "${FNAME}"  \
+  timeout 60s ${CMD} -c 1 -v -i any ${PTCPDUMP_EXTRA_ARGS} --print -w "${FNAME}"  \
     'dst host 1.1.1.1 and tcp[tcpflags] = tcp-syn' | tee "${LNAME}" &
   sleep 30
   curl -m 10 1.1.1.1 &>/dev/null || true
diff --git a/testdata/test_sub_curl_domain_program.sh b/testdata/test_sub_curl_domain_program.sh
index 2358b755..b27edfd7 100644
--- a/testdata/test_sub_curl_domain_program.sh
+++ b/testdata/test_sub_curl_domain_program.sh
@@ -10,7 +10,7 @@ RNAME="${FILE_PREFIX}_sub_program_curl.read.txt"
 
 
 function test_ptcpdump() {
-  timeout 60s ${CMD} -i any -v --print -w "${FNAME}"  \
+  timeout 60s ${CMD} -i any ${PTCPDUMP_EXTRA_ARGS} -v --print -w "${FNAME}"  \
 	  -- curl -m 10 ubuntu.com | tee "${LNAME}"
 
   cat "${LNAME}"
diff --git a/testdata/test_sub_program.sh b/testdata/test_sub_program.sh
index df92a1e7..311784f5 100644
--- a/testdata/test_sub_program.sh
+++ b/testdata/test_sub_program.sh
@@ -8,9 +8,8 @@ FNAME="${FILE_PREFIX}_sub_program.pcapng"
 LNAME="${FILE_PREFIX}_sub_program.log"
 RNAME="${FILE_PREFIX}_sub_program.read.txt"
 
-
 function test_ptcpdump() {
-  timeout 30s ${CMD} -c 10 -i any -v --print -w "${FNAME}" \
+  timeout 30s ${CMD} -c 10 -i any ${PTCPDUMP_EXTRA_ARGS} -v --print -w "${FNAME}" \
 	  -- curl -m 10 1.1.1.1 | tee "${LNAME}"
 
   cat "${LNAME}"