diff --git a/package/ctcgfw/luci-app-appfilter/luasrc/controller/appfilter.lua b/package/ctcgfw/luci-app-appfilter/luasrc/controller/appfilter.lua
index f163d9bca0..d767df95e3 100644
--- a/package/ctcgfw/luci-app-appfilter/luasrc/controller/appfilter.lua
+++ b/package/ctcgfw/luci-app-appfilter/luasrc/controller/appfilter.lua
@@ -36,7 +36,7 @@ function get_hostname_by_mac(dst_mac)
 end
 
 function get_app_name_by_id(appid)
-	local class_fd = io.popen("find /etc/appfilter/ -type f -name *.class |xargs cat |grep "..appid.."|awk '{print $2}'")
+	local class_fd = io.popen("find /tmp/appfilter/ -type f -name *.class |xargs cat |grep "..appid.."|awk '{print $2}'")
 	if class_fd then
 		local name = class_fd:read("*l")
 		class_fd:close()
diff --git a/package/ctcgfw/luci-app-appfilter/luasrc/model/cbi/appfilter/appfilter.lua b/package/ctcgfw/luci-app-appfilter/luasrc/model/cbi/appfilter/appfilter.lua
index ea50ac7218..72750815a9 100644
--- a/package/ctcgfw/luci-app-appfilter/luasrc/model/cbi/appfilter/appfilter.lua
+++ b/package/ctcgfw/luci-app-appfilter/luasrc/model/cbi/appfilter/appfilter.lua
@@ -30,7 +30,7 @@ s.anonymous = true
 s.addremove = false
 
 
-local class_fd = io.popen("find /etc/appfilter/ -type f -name '*.class'")
+local class_fd = io.popen("find /tmp/appfilter/ -type f -name '*.class'")
 if class_fd then
 	while true do
 		local apps
diff --git a/package/ctcgfw/luci-app-appfilter/luasrc/view/admin_network/user_status.htm b/package/ctcgfw/luci-app-appfilter/luasrc/view/admin_network/user_status.htm
index 472f6d0690..5b7a8c4dc5 100644
--- a/package/ctcgfw/luci-app-appfilter/luasrc/view/admin_network/user_status.htm
+++ b/package/ctcgfw/luci-app-appfilter/luasrc/view/admin_network/user_status.htm
@@ -7,20 +7,21 @@ table.imagetable {
     border-color: #999999;
     border-collapse: collapse;
 }
+<!--
 table.imagetable th {
-    background:#b5cfd2 url('cell-blue.jpg');
-    border-width: 1px;
-    padding: 8px;
+    background:#f5f5f5
+    border-width: 0px;
+    padding: 5px;
     border-style: solid;
     border-color: #999999;
 }
 table.imagetable td {
-    background:#dcddc0 url('cell-grey.jpg');
-    border-width: 1px;
-    padding: 8px;
+    background:#ffffffff
+    border-width: 0px;
+    padding: 5px;
     border-style: solid;
     border-color: #999999;
-}
+}-->
 </style>
 <script type="text/javascript">//<![CDATA[
 
diff --git a/package/ctcgfw/oaf/src/af_client.c b/package/ctcgfw/oaf/src/af_client.c
index 02232e847d..9bb143f6b9 100644
--- a/package/ctcgfw/oaf/src/af_client.c
+++ b/package/ctcgfw/oaf/src/af_client.c
@@ -21,6 +21,7 @@
 #include "af_client.h"
 #include "af_client_fs.h"
 #include "af_log.h"
+#include "af_utils.h"
 
 DEFINE_RWLOCK(af_client_lock);            
 
@@ -146,6 +147,50 @@ void check_client_expire(void)
 	AF_CLIENT_UNLOCK_W();
 }
 
+#define MAX_EXPIRED_VISIT_INFO_COUNT 10
+void flush_expired_visit_info(af_client_info_t *node)
+{
+	int i;
+	int count = 0;
+	u_int32_t cur_timep = 0;
+	int timeout = 0;
+	cur_timep = af_get_timestamp_sec();
+	for (i = 0; i < MAX_RECORD_APP_NUM; i++){
+		if (node->visit_info[i].app_id == 0){
+			return;
+		}
+	}
+	for (i = 0; i < MAX_RECORD_APP_NUM; i++){
+		if (count >= MAX_EXPIRED_VISIT_INFO_COUNT)
+			break;
+		
+		if (node->visit_info[i].total_num > 3){
+			timeout = 180;
+		}
+		else{
+			timeout = 60;
+		}
+		
+		if (cur_timep - node->visit_info[i].latest_time > timeout){
+			// 超时清除记录
+			memset(&node->visit_info[i], 0x0, sizeof(app_visit_info_t));
+			count++;
+		}
+	}
+
+}
+
+void af_visit_info_timer_handle(void){
+	af_client_info_t  *node;
+	int i;
+	AF_CLIENT_LOCK_W();
+	for (i = 0; i < MAX_AF_CLIENT_HASH_SIZE; i++){
+		list_for_each_entry(node, &af_client_list_table[i], hlist) {
+			flush_expired_visit_info(node);
+		}
+	}
+	AF_CLIENT_UNLOCK_W();
+}
 static inline int get_packet_dir(struct net_device *in)
 {
 	if (0 == strncmp(in->name, "br", 2)){
diff --git a/package/ctcgfw/oaf/src/af_client.h b/package/ctcgfw/oaf/src/af_client.h
index c3912414af..859bc5b000 100644
--- a/package/ctcgfw/oaf/src/af_client.h
+++ b/package/ctcgfw/oaf/src/af_client.h
@@ -30,7 +30,7 @@ enum NFC_PKT_DIR{
 
 
 #define MAX_VISIT_HISTORY_TIME 24
-#define MAX_RECORD_APP_NUM 32
+#define MAX_RECORD_APP_NUM 64
 
 
 typedef struct app_visit_info{
@@ -62,4 +62,8 @@ int af_client_init(void);
 void af_client_exit(void);
 af_client_info_t * find_af_client_by_ip(unsigned int ip);
 
+void check_client_expire(void);
+
+void af_visit_info_timer_handle(void);
+
 #endif
diff --git a/package/ctcgfw/oaf/src/af_client_fs.c b/package/ctcgfw/oaf/src/af_client_fs.c
index 8a64fffd8a..57cfac54ff 100644
--- a/package/ctcgfw/oaf/src/af_client_fs.c
+++ b/package/ctcgfw/oaf/src/af_client_fs.c
@@ -130,7 +130,9 @@ static int af_client_seq_show(struct seq_file *s, void *v)
 
 	for(i = 0; i < MAX_RECORD_APP_NUM; i++){
 		if(node->visit_info[i].app_id == 0)
-			break;
+			continue;
+		if(node->visit_info[i].total_num < 3)
+			continue;
 		cJSON *visit_obj = cJSON_CreateObject();
 		cJSON_AddNumberToObject(visit_obj, "appid", node->visit_info[i].app_id);
 		cJSON_AddNumberToObject(visit_obj, "latest_action", node->visit_info[i].latest_action);
diff --git a/package/ctcgfw/oaf/src/af_log.c b/package/ctcgfw/oaf/src/af_log.c
index 1dcc201468..74e89fd265 100644
--- a/package/ctcgfw/oaf/src/af_log.c
+++ b/package/ctcgfw/oaf/src/af_log.c
@@ -8,6 +8,9 @@
 #include "af_log.h"
 int af_log_lvl = 1;
 int af_test_mode = 0;
+// todo: rename af_log.c
+int g_oaf_enable __read_mostly = 0;
+
 /* 
 	cat /proc/sys/oaf/debug
 */
@@ -26,6 +29,13 @@ static struct ctl_table oaf_table[] = {
 		.mode		= 0666,
 		.proc_handler	= proc_dointvec,
 	},
+	{
+		.procname	= "enable",
+		.data		= &g_oaf_enable,
+		.maxlen 	= sizeof(int),
+		.mode		= 0666,
+		.proc_handler	= proc_dointvec,
+	},
 	{
 	}
 };
diff --git a/package/ctcgfw/oaf/src/af_utils.c b/package/ctcgfw/oaf/src/af_utils.c
index 3ed23d4ce3..5ea2daf679 100644
--- a/package/ctcgfw/oaf/src/af_utils.c
+++ b/package/ctcgfw/oaf/src/af_utils.c
@@ -6,6 +6,19 @@
 #include <linux/string.h>
 #include <linux/version.h>
 #include "af_utils.h"
+u_int32_t af_get_timestamp_sec(void)
+{
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,17,0)
+	struct timespec64 ts;
+	ktime_get_ts64(&ts);
+	return (u_int32_t)ts.tv_sec;
+#else
+	struct timespec ts;
+	ts = current_kernel_time();
+	return ts.tv_sec;
+#endif
+
+}
 
 int check_local_network_ip(unsigned int ip)
 {
diff --git a/package/ctcgfw/oaf/src/af_utils.h b/package/ctcgfw/oaf/src/af_utils.h
index 201adfccdc..a57f3f2236 100644
--- a/package/ctcgfw/oaf/src/af_utils.h
+++ b/package/ctcgfw/oaf/src/af_utils.h
@@ -1,5 +1,6 @@
 #ifndef AF_UTILS_H
 #define AF_UTILS_H
+u_int32_t af_get_timestamp_sec(void);
 
 int check_local_network_ip(unsigned int ip);
 
diff --git a/package/ctcgfw/oaf/src/app_filter.c b/package/ctcgfw/oaf/src/app_filter.c
index 1e2a1cdcb0..529f7d4c54 100644
--- a/package/ctcgfw/oaf/src/app_filter.c
+++ b/package/ctcgfw/oaf/src/app_filter.c
@@ -707,22 +707,21 @@ int app_filter_match(flow_info_t *flow)
 }
 
 #define APP_FILTER_DROP_BITS 0xf0000000
-u_int32_t af_get_timestamp_sec(void)
-{
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,17,0)
-	struct timespec64 ts;
-	ktime_get_ts64(&ts);
-	return (u_int32_t)ts.tv_sec;
-#else
-	struct timespec ts;
-	ts = current_kernel_time();
-	return ts.tv_sec;
-#endif
 
+
+
+static int af_get_visit_index(af_client_info_t *node, int app_id){
+	int i;
+	for(i = 0; i < MAX_RECORD_APP_NUM; i++){
+		if(node->visit_info[i].app_id == app_id || node->visit_info[i].app_id == 0){
+			return i;
+		}
+	}
+	// default 0
+	return 0;
 }
 
 
-
 int __af_update_client_app_info(flow_info_t *flow, af_client_info_t *node)
 {
 	int i;
@@ -734,38 +733,13 @@ int __af_update_client_app_info(flow_info_t *flow, af_client_info_t *node)
 	AF_INFO("%s %d visit_app_num = %d\n", __func__, __LINE__, node->visit_app_num);
 	int found = 0;
 
-	for(i = 0; i < MAX_RECORD_APP_NUM; i++){
-		if(node->visit_info[i].app_id == flow->app_id){
-			index = i;
-			found = 1;
-			break;
-		}
-		if(node->visit_info[i].app_id == 0)
-			break;
-	}
+	index = af_get_visit_index(node, flow->app_id);
 
-	if(!found){
-		index = 0;
-		//超过最大个数，查询最老的
-		for(i = 0; i < MAX_RECORD_APP_NUM; i++){
-			if(node->visit_info[i].latest_time == 0){
-				index = i;
-				break;
-			}
-			if(node->visit_info[i].latest_time < node->visit_info[index].latest_time){
-				// 清除之前的数据
-				node->visit_info[i].total_num = 0;
-				node->visit_info[i].drop_num = 0;
-				index = i;
-			}
-		}
-	}
-	
-	
 	if(index < 0 || index >= MAX_RECORD_APP_NUM){
 		AF_ERROR("invalid index:%d\n\n", index);
 		return 0;
 	}
+	
 	node->visit_info[index].total_num++;
 	if(flow->drop)
 		node->visit_info[index].drop_num++;
@@ -820,6 +794,9 @@ static u_int32_t app_filter_hook(unsigned int hook,
 #else
 	struct nf_conn *ct = (struct nf_conn *)skb->nfct;
 #endif
+	if (!g_oaf_enable){
+		return NF_ACCEPT;
+	}
 	if(ct == NULL) {
         return NF_ACCEPT;
     }
@@ -922,6 +899,31 @@ void TEST_cJSON(void)
 }
 
 
+struct timer_list oaf_timer;   
+
+#define OAF_TIMER_INTERVAL 15
+static void oaf_timer_func(unsigned long ptr)
+{
+//	check_client_expire();
+	af_visit_info_timer_handle();
+    mod_timer(&oaf_timer,  jiffies + OAF_TIMER_INTERVAL * HZ);
+}
+
+
+void init_oaf_timer(void)
+{
+    setup_timer(&oaf_timer, oaf_timer_func, OAF_TIMER_INTERVAL * HZ);
+    mod_timer(&oaf_timer,  jiffies + OAF_TIMER_INTERVAL * HZ);
+	AF_INFO("init oaf timer...ok");
+}
+
+void fini_port_timer(void)
+{
+    del_timer_sync(&oaf_timer);
+	AF_INFO("del oaf timer...ok");
+}
+
+
 /*
 	模块初始化
 */
@@ -940,6 +942,8 @@ static int __init app_filter_init(void)
 #else
 	nf_register_hooks(app_filter_ops, ARRAY_SIZE(app_filter_ops));
 #endif
+	init_oaf_timer();
+
 	AF_INFO("init app filter ........ok\n");
 	return 0;
 }
@@ -950,6 +954,7 @@ static int __init app_filter_init(void)
 static void app_filter_fini(void)
 {
 	AF_INFO("app filter module exit\n");
+	fini_port_timer();
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4,13,0)
     nf_unregister_net_hooks(&init_net, app_filter_ops, ARRAY_SIZE(app_filter_ops));
 #else
diff --git a/package/ctcgfw/oaf/src/app_filter.h b/package/ctcgfw/oaf/src/app_filter.h
index b45c1d308e..458be927b1 100644
--- a/package/ctcgfw/oaf/src/app_filter.h
+++ b/package/ctcgfw/oaf/src/app_filter.h
@@ -112,4 +112,6 @@ void af_init_app_status(void);
 int af_get_app_status(int appid);
 int regexp_match(char *reg, char *text);
 
+extern int g_oaf_enable;
+
 #endif
diff --git a/package/ctcgfw/open-app-filter/files/appfilter.sh b/package/ctcgfw/open-app-filter/files/appfilter.sh
index db42f06d2f..e600aacb93 100755
--- a/package/ctcgfw/open-app-filter/files/appfilter.sh
+++ b/package/ctcgfw/open-app-filter/files/appfilter.sh
@@ -33,16 +33,20 @@ load_rule()
     config_get enable "global" enable
     echo "enable = $enable"	
     if [ x"$enable" != x"1" ];then
-	echo "appfilter is disabled"
-	return 0
-    fi 
+		echo "appfilter is disabled"
+		echo 0 >/proc/sys/oaf/enable>/dev/null
+		return 0
+    else
+		insmod oaf >/dev/null
+		echo 1 >/proc/sys/oaf/enable
+	fi
     echo "appfilter is enabled"
     json_add_int "op" 1
 
     json_add_object "data"
     json_add_array "apps"
 
-    for file in `ls /etc/appfilter/*.class`
+    for file in `ls /tmp/appfilter/*.class`
     do
 	class_name=`echo "$file" | awk -F/ '{print $4}'| awk -F. '{print $1}'`
 	config_get appid_list "appfilter" "${class_name}apps"
diff --git a/package/ctcgfw/open-app-filter/files/feature.cfg b/package/ctcgfw/open-app-filter/files/feature.cfg
index 6554724615..9589d51235 100644
--- a/package/ctcgfw/open-app-filter/files/feature.cfg
+++ b/package/ctcgfw/open-app-filter/files/feature.cfg
@@ -10,6 +10,7 @@
 2001 鐜嬭�呰崳鑰�:[tcp;;;;;00:33|01:66|02:00|03:09,udp;;;;;00:01|01:02|02:00|03:00]
 2002 鍜屽钩绮捐嫳:[tcp;;;;;00:43|1:66|02:aa,tcp;;;;;00:33|1:66|03:0a|05:0a|,tcp;;;;;00:01|1:00|02:00,udp;;;;;00:59|01:ad|03:45|05:e4,udp;;;;;00:b9|01:5d|03:39|05:77]
 2003 鑻遍泟鑱旂洘:[udp;;;;;44:00|45:00|46:00|47:02]
+2015 鎴戠殑涓栫晫:[tcp;;443;g79mclobt.nie.netease;;]
 2004 鑽掗噹琛屽姩:[udp;;;;;00:05|01:09,tcp;;;;;00:02|01:00|02:00|03:00]
 2005 娆箰鏂楀湴涓�:[tcp;;8000;;;00:74|01:67|02:77|03:5f]
 2006 姊﹀够瑗挎父:[tcp;;;;;00:0e|01:00|02:fe|03:ff]
diff --git a/package/ctcgfw/open-app-filter/files/gen_class.sh b/package/ctcgfw/open-app-filter/files/gen_class.sh
index ab09a1c2d8..80350ca0e0 100755
--- a/package/ctcgfw/open-app-filter/files/gen_class.sh
+++ b/package/ctcgfw/open-app-filter/files/gen_class.sh
@@ -2,20 +2,18 @@
 
 f_file=$1
 test -z "$f_file" && return
-
+test -d /tmp/appfilter && return
 cur_class=""
 cur_class_file=""
+mkdir /tmp/appfilter
 while read line
 do
     echo "$line"| grep "^#class"
     if [ $? -eq 0 ];then
-#	echo "match $line"
-#	echo "cur_class=$cur_class"
         class=`echo $line| grep '#class' | awk '{print $2}'`
 	if ! test -z "$class";then
-#		echo "class=$class"
 		cur_class=$class
-		cur_class_file="/etc/appfilter/${cur_class}.class"
+		cur_class_file="/tmp/appfilter/${cur_class}.class"
 		if [ -e "$cur_class_file" ];then
 			rm $cur_class_file 
 		fi