diff --git a/src/vnet/flow/flow.h b/src/vnet/flow/flow.h
index b5ec7cc..04305ed 100644
--- a/src/vnet/flow/flow.h
+++ b/src/vnet/flow/flow.h
@@ -26,86 +26,75 @@
 #define foreach_flow_type \
   /* l2 flow*/ \
   _(ETHERNET, ethernet, "ethernet") \
+  /* l3 IP flow */ \
+  _(IP4, ip4, "ipv4") \
+  _(IP6, ip6, "ipv6") \
+  /* IP tunnel flow */ \
+  _(IP4_L2TPV3OIP, ip4_l2tpv3oip, "ipv4-l2tpv3oip") \
+  _(IP4_IPSEC_ESP, ip4_ipsec_esp, "ipv4-ipsec-esp") \
+  _(IP4_IPSEC_AH, ip4_ipsec_ah, "ipv4-ipsec-ah") \
   /* l4 flow*/ \
   _(IP4_N_TUPLE, ip4_n_tuple, "ipv4-n-tuple") \
   _(IP6_N_TUPLE, ip6_n_tuple, "ipv6-n-tuple") \
   _(IP4_N_TUPLE_TAGGED, ip4_n_tuple_tagged, "ipv4-n-tuple-tagged") \
   _(IP6_N_TUPLE_TAGGED, ip6_n_tuple_tagged, "ipv6-n-tuple-tagged") \
-  /* IP tunnel flow */ \
-  _(IP4_L2TPV3OIP, ip4_l2tpv3oip, "ipv4-l2tpv3oip") \
-  _(IP4_IPSEC_ESP, ip4_ipsec_esp, "ipv4-ipsec-esp") \
-  _(IP4_IPSEC_AH, ip4_ipsec_ah, "ipv4-ipsec-ah") \
   /* L4 tunnel flow*/ \
   _(IP4_VXLAN, ip4_vxlan, "ipv4-vxlan") \
   _(IP6_VXLAN, ip6_vxlan, "ipv6-vxlan") \
   _(IP4_GTPC, ip4_gtpc, "ipv4-gtpc") \
-  _(IP4_GTPU, ip4_gtpu, "ipv4-gtpu") \
-  _(IP4_GTPU_IP4, ip4_gtpu_ip4, "ipv4-gtpu-ipv4") \
-  _(IP4_GTPU_IP6, ip4_gtpu_ip6, "ipv4-gtpu-ipv6") \
-  _(IP6_GTPC, ip6_gtpc, "ipv6-gtpc") \
-  _(IP6_GTPU, ip6_gtpu, "ipv6-gtpu") \
-  _(IP6_GTPU_IP4, ip6_gtpu_ip4, "ipv6-gtpu-ipv4") \
-  _(IP6_GTPU_IP6, ip6_gtpu_ip6, "ipv6-gtpu-ipv6")
+  _(IP4_GTPU, ip4_gtpu, "ipv4-gtpu")
 
 #define foreach_flow_entry_ethernet \
   _fe(ethernet_header_t, eth_hdr)
 
-#define foreach_flow_entry_ip4_n_tuple \
+#define foreach_flow_entry_ip4 \
   _fe(ip4_address_and_mask_t, src_addr) \
   _fe(ip4_address_and_mask_t, dst_addr) \
-  _fe(ip_port_and_mask_t, src_port) \
-  _fe(ip_port_and_mask_t, dst_port) \
-  _fe(ip_protocol_t, protocol)
+  _fe(ip_prot_and_mask_t, protocol)
 
-#define foreach_flow_entry_ip6_n_tuple \
+#define foreach_flow_entry_ip6 \
   _fe(ip6_address_and_mask_t, src_addr) \
   _fe(ip6_address_and_mask_t, dst_addr) \
-  _fe(ip_port_and_mask_t, src_port) \
-  _fe(ip_port_and_mask_t, dst_port) \
-  _fe(ip_protocol_t, protocol)
-
-#define foreach_flow_entry_ip4_n_tuple_tagged \
-  _fe(ip4_address_and_mask_t, src_addr) \
-  _fe(ip4_address_and_mask_t, dst_addr) \
-  _fe(ip_port_and_mask_t, src_port) \
-  _fe(ip_port_and_mask_t, dst_port) \
-  _fe(ip_protocol_t, protocol)
-
-#define foreach_flow_entry_ip6_n_tuple_tagged \
-  _fe(ip6_address_and_mask_t, src_addr) \
-  _fe(ip6_address_and_mask_t, dst_addr) \
-  _fe(ip_port_and_mask_t, src_port) \
-  _fe(ip_port_and_mask_t, dst_port) \
-  _fe(ip_protocol_t, protocol)
+  _fe(ip_prot_and_mask_t, protocol)
 
 #define foreach_flow_entry_ip4_l2tpv3oip \
-  _fe(ip4_address_and_mask_t, src_addr) \
-  _fe(ip4_address_and_mask_t, dst_addr) \
-  _fe(ip_protocol_t, protocol)          \
+  foreach_flow_entry_ip4 \
   _fe(u32, session_id)
 
 #define foreach_flow_entry_ip4_ipsec_esp \
-  _fe(ip4_address_and_mask_t, src_addr) \
-  _fe(ip4_address_and_mask_t, dst_addr) \
-  _fe(ip_protocol_t, protocol)          \
+  foreach_flow_entry_ip4 \
   _fe(u32, spi)
 
 #define foreach_flow_entry_ip4_ipsec_ah \
-  _fe(ip4_address_and_mask_t, src_addr) \
-  _fe(ip4_address_and_mask_t, dst_addr) \
-  _fe(ip_protocol_t, protocol)          \
+  foreach_flow_entry_ip4 \
   _fe(u32, spi)
 
+#define foreach_flow_entry_ip4_n_tuple \
+  foreach_flow_entry_ip4 \
+  _fe(ip_port_and_mask_t, src_port) \
+  _fe(ip_port_and_mask_t, dst_port)
+
+#define foreach_flow_entry_ip6_n_tuple \
+  foreach_flow_entry_ip6 \
+  _fe(ip_port_and_mask_t, src_port) \
+  _fe(ip_port_and_mask_t, dst_port)
+
+#define foreach_flow_entry_ip4_n_tuple_tagged \
+  foreach_flow_entry_ip4 \
+  _fe(ip_port_and_mask_t, src_port) \
+  _fe(ip_port_and_mask_t, dst_port)
+
+#define foreach_flow_entry_ip6_n_tuple_tagged \
+  foreach_flow_entry_ip6 \
+  _fe(ip_port_and_mask_t, src_port) \
+  _fe(ip_port_and_mask_t, dst_port)
+
 #define foreach_flow_entry_ip4_vxlan \
-  _fe(ip4_address_t, src_addr) \
-  _fe(ip4_address_t, dst_addr) \
-  _fe(u16, dst_port) \
+  foreach_flow_entry_ip4_n_tuple \
   _fe(u16, vni)
 
 #define foreach_flow_entry_ip6_vxlan \
-  _fe(ip6_address_t, src_addr) \
-  _fe(ip6_address_t, dst_addr) \
-  _fe(u16, dst_port) \
+  foreach_flow_entry_ip6_n_tuple \
   _fe(u16, vni)
 
 #define foreach_flow_entry_ip4_gtpc \
@@ -116,34 +105,6 @@
   foreach_flow_entry_ip4_n_tuple \
   _fe(u32, teid)
 
-#define foreach_flow_entry_ip4_gtpu_ip4 \
-  foreach_flow_entry_ip4_gtpu \
-  _fe(ip4_address_and_mask_t, inner_src_addr) \
-  _fe(ip4_address_and_mask_t, inner_dst_addr)
-
-#define foreach_flow_entry_ip4_gtpu_ip6 \
-  foreach_flow_entry_ip4_gtpu \
-  _fe(ip6_address_and_mask_t, inner_src_addr) \
-  _fe(ip6_address_and_mask_t, inner_dst_addr)
-
-#define foreach_flow_entry_ip6_gtpc \
-  foreach_flow_entry_ip6_n_tuple \
-  _fe(u32, teid)
-
-#define foreach_flow_entry_ip6_gtpu \
-  foreach_flow_entry_ip6_n_tuple \
-  _fe(u32, teid)
-
-#define foreach_flow_entry_ip6_gtpu_ip4 \
-  foreach_flow_entry_ip6_gtpu \
-  _fe(ip4_address_and_mask_t, inner_src_addr) \
-  _fe(ip4_address_and_mask_t, inner_dst_addr)
-
-#define foreach_flow_entry_ip6_gtpu_ip6 \
-  foreach_flow_entry_ip6_gtpu \
-  _fe(ip6_address_and_mask_t, inner_src_addr) \
-  _fe(ip6_address_and_mask_t, inner_dst_addr)
-
 #define foreach_flow_action \
   _(0, COUNT, "count") \
   _(1, MARK, "mark") \
@@ -160,7 +121,6 @@
 #undef _
 } vnet_flow_action_t;
 
-
 #define foreach_flow_error \
   _( -1, NOT_SUPPORTED, "not supported")			\
   _( -2, ALREADY_DONE, "already done")				\
@@ -215,6 +175,14 @@
   u16 port, mask;
 } ip_port_and_mask_t;
 
+typedef struct
+{
+  ip_protocol_t prot;
+  /* ip protocol mask should be either 0 or 0xFF */
+  /* other values are meanless */
+  u8 mask;
+} ip_prot_and_mask_t;
+
 typedef enum
 {
   VNET_FLOW_TYPE_UNKNOWN,