diff --git a/rust/src/applayer.rs b/rust/src/applayer.rs
index 4518ae9cf3..048afbe5a7 100644
--- a/rust/src/applayer.rs
+++ b/rust/src/applayer.rs
@@ -18,7 +18,8 @@
 //! Parser registration functions and common interface module.
 
 use std;
-use crate::core::{self,DetectEngineState,AppLayerEventType,AppProto,Direction};
+use crate::core::{self,DetectEngineState,AppLayerEventType,AppProto};
+use crate::direction::Direction;
 use crate::filecontainer::FileContainer;
 use crate::flow::Flow;
 use std::os::raw::{c_void,c_char,c_int};
diff --git a/rust/src/applayertemplate/detect.rs b/rust/src/applayertemplate/detect.rs
index 5cfa364bd8..9eaf880ed7 100644
--- a/rust/src/applayertemplate/detect.rs
+++ b/rust/src/applayertemplate/detect.rs
@@ -19,7 +19,7 @@ use super::template::{TemplateTransaction, ALPROTO_TEMPLATE};
 /* TEMPLATE_START_REMOVE */
 use crate::conf::conf_get_node;
 /* TEMPLATE_END_REMOVE */
-use crate::core::Direction;
+use crate::direction::Direction;
 use crate::detect::{
     DetectBufferSetActiveList, DetectHelperBufferMpmRegister, DetectHelperGetData,
     DetectHelperKeywordRegister, DetectSignatureSetAppProto, SCSigTableElmt,
diff --git a/rust/src/bittorrent_dht/bittorrent_dht.rs b/rust/src/bittorrent_dht/bittorrent_dht.rs
index 82c267df37..33c4c51f44 100644
--- a/rust/src/bittorrent_dht/bittorrent_dht.rs
+++ b/rust/src/bittorrent_dht/bittorrent_dht.rs
@@ -19,7 +19,8 @@ use crate::applayer::{self, *};
 use crate::bittorrent_dht::parser::{
     parse_bittorrent_dht_packet, BitTorrentDHTError, BitTorrentDHTRequest, BitTorrentDHTResponse,
 };
-use crate::core::{AppProto, ALPROTO_UNKNOWN, IPPROTO_UDP, Direction};
+use crate::core::{AppProto, ALPROTO_UNKNOWN, IPPROTO_UDP};
+use crate::direction::Direction;
 use crate::flow::Flow;
 use std::ffi::CString;
 use std::os::raw::c_char;
@@ -99,7 +100,7 @@ impl BitTorrentDHTState {
         }
     }
 
-    pub fn parse(&mut self, input: &[u8], _direction: crate::core::Direction) -> bool {
+    pub fn parse(&mut self, input: &[u8], _direction: Direction) -> bool {
         if !Self::is_dht(input) {
             return true;
         }
@@ -171,7 +172,7 @@ pub unsafe extern "C" fn rs_bittorrent_dht_parse_ts(
 ) -> AppLayerResult {
     return rs_bittorrent_dht_parse(
         _flow, state, _pstate, stream_slice,
-        _data, crate::core::Direction::ToServer);
+        _data, Direction::ToServer);
 }
 
 #[no_mangle]
@@ -181,14 +182,14 @@ pub unsafe extern "C" fn rs_bittorrent_dht_parse_tc(
 ) -> AppLayerResult {
     return rs_bittorrent_dht_parse(
         _flow, state, _pstate, stream_slice,
-        _data, crate::core::Direction::ToClient);
+        _data, Direction::ToClient);
 }
 
 #[no_mangle]
 pub unsafe extern "C" fn rs_bittorrent_dht_parse(
     _flow: *const Flow, state: *mut std::os::raw::c_void, _pstate: *mut std::os::raw::c_void,
     stream_slice: StreamSlice, _data: *const std::os::raw::c_void,
-    direction: crate::core::Direction,
+    direction: Direction,
 ) -> AppLayerResult {
     let state = cast_pointer!(state, BitTorrentDHTState);
     let buf = stream_slice.as_slice();
@@ -302,7 +303,7 @@ pub unsafe extern "C" fn rs_bittorrent_dht_udp_register_parser() {
             BITTORRENT_DHT_PAYLOAD_PREFIX.as_ptr() as *const c_char,
             BITTORRENT_DHT_PAYLOAD_PREFIX.len() as u16 - 1,
             0,
-            crate::core::Direction::ToServer.into(),
+            Direction::ToServer.into(),
         ) < 0
         {
             SCLogDebug!("Failed to register protocol detection pattern for direction TOSERVER");
@@ -313,7 +314,7 @@ pub unsafe extern "C" fn rs_bittorrent_dht_udp_register_parser() {
             BITTORRENT_DHT_PAYLOAD_PREFIX.as_ptr() as *const c_char,
             BITTORRENT_DHT_PAYLOAD_PREFIX.len() as u16 - 1,
             0,
-            crate::core::Direction::ToClient.into(),
+            Direction::ToClient.into(),
         ) < 0
         {
             SCLogDebug!("Failed to register protocol detection pattern for direction TOCLIENT");
diff --git a/rust/src/bittorrent_dht/parser.rs b/rust/src/bittorrent_dht/parser.rs
index 545a1ad537..d2a93f30c8 100644
--- a/rust/src/bittorrent_dht/parser.rs
+++ b/rust/src/bittorrent_dht/parser.rs
@@ -446,7 +446,7 @@ pub fn parse_bittorrent_dht_packet(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::core::Direction;
+    use crate::direction::Direction;
     use test_case::test_case;
 
     #[test_case(
diff --git a/rust/src/core.rs b/rust/src/core.rs
index a6578b66ad..387d2b1524 100644
--- a/rust/src/core.rs
+++ b/rust/src/core.rs
@@ -19,7 +19,6 @@
 
 use std;
 use crate::filecontainer::*;
-use crate::debug_validate_fail;
 use crate::flow::Flow;
 
 /// Opaque C types.
@@ -41,70 +40,6 @@ pub const STREAM_TOCLIENT: u8 = 0x08;
 pub const STREAM_GAP:      u8 = 0x10;
 pub const STREAM_DEPTH:    u8 = 0x20;
 pub const STREAM_MIDSTREAM:u8 = 0x40;
-pub const DIR_BOTH:        u8 = 0b0000_1100;
-const DIR_TOSERVER:        u8 = 0b0000_0100;
-const DIR_TOCLIENT:        u8 = 0b0000_1000;
-
-#[repr(C)]
-#[derive(Debug, PartialEq, Eq, Clone, Copy)]
-pub enum Direction {
-    ToServer = 0x04,
-    ToClient = 0x08,
-}
-
-impl Direction {
-    /// Return true if the direction is to server.
-    pub fn is_to_server(&self) -> bool {
-	matches!(self, Self::ToServer)
-    }
-
-    /// Return true if the direction is to client.
-    pub fn is_to_client(&self) -> bool {
-	matches!(self, Self::ToClient)
-    }
-
-    pub fn index(&self) -> usize {
-        match self {
-            Self::ToClient => 0,
-            _ => 1,
-        }
-    }
-}
-
-impl Default for Direction {
-    fn default() -> Self { Direction::ToServer }
-}
-
-impl std::fmt::Display for Direction {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::ToServer => write!(f, "toserver"),
-            Self::ToClient => write!(f, "toclient"),
-        }
-    }
-}
-
-impl From<u8> for Direction {
-    fn from(d: u8) -> Self {
-        if d & (DIR_TOSERVER | DIR_TOCLIENT) == (DIR_TOSERVER | DIR_TOCLIENT) {
-            debug_validate_fail!("Both directions are set");
-            Direction::ToServer
-        } else if d & DIR_TOSERVER != 0 {
-            Direction::ToServer
-        } else if d & DIR_TOCLIENT != 0 {
-            Direction::ToClient
-        } else {
-            debug_validate_fail!("Unknown direction!!");
-            Direction::ToServer
-        }
-    }
-}
-
-impl From<Direction> for u8 {
-    fn from(d: Direction) -> u8 {
-        d as u8
-    }
-}
 
 // Application layer protocol identifiers (app-layer-protos.h)
 pub type AppProto = u16;
@@ -299,17 +234,3 @@ pub fn sc_app_layer_decoder_events_free_events(
         }
     }
 }
-
-#[cfg(test)]
-mod test {
-    use super::*;
-
-    #[test]
-    fn test_direction() {
-	assert!(Direction::ToServer.is_to_server());
-	assert!(!Direction::ToServer.is_to_client());
-
-	assert!(Direction::ToClient.is_to_client());
-	assert!(!Direction::ToClient.is_to_server());
-    }
-}
diff --git a/rust/src/dcerpc/dcerpc.rs b/rust/src/dcerpc/dcerpc.rs
index 2a2db94a3b..433dc4b5bf 100644
--- a/rust/src/dcerpc/dcerpc.rs
+++ b/rust/src/dcerpc/dcerpc.rs
@@ -18,6 +18,7 @@
 use crate::applayer::{self, *};
 use crate::core::{self, *};
 use crate::dcerpc::parser;
+use crate::direction::{Direction, DIR_BOTH};
 use crate::flow::Flow;
 use nom7::error::{Error, ErrorKind};
 use nom7::number::Endianness;
@@ -1389,6 +1390,7 @@ mod tests {
     use crate::applayer::AppLayerResult;
     use crate::core::*;
     use crate::dcerpc::dcerpc::DCERPCState;
+    use crate::direction::Direction;
     use std::cmp;
 
     #[test]
diff --git a/rust/src/dcerpc/dcerpc_udp.rs b/rust/src/dcerpc/dcerpc_udp.rs
index f890f10ace..673d1608ae 100644
--- a/rust/src/dcerpc/dcerpc_udp.rs
+++ b/rust/src/dcerpc/dcerpc_udp.rs
@@ -15,12 +15,13 @@
  * 02110-1301, USA.
  */
 
+use crate::core;
 use crate::applayer::{self, *};
-use crate::core::{self, Direction, DIR_BOTH};
 use crate::dcerpc::dcerpc::{
     DCERPCTransaction, DCERPC_MAX_TX, DCERPC_TYPE_REQUEST, DCERPC_TYPE_RESPONSE, PFCL1_FRAG, PFCL1_LASTFRAG,
     rs_dcerpc_get_alstate_progress, ALPROTO_DCERPC, PARSER_NAME,
 };
+use crate::direction::{Direction, DIR_BOTH};
 use crate::flow::Flow;
 use nom7::Err;
 use std;
diff --git a/rust/src/direction.rs b/rust/src/direction.rs
new file mode 100644
index 0000000000..7cf10a0a37
--- /dev/null
+++ b/rust/src/direction.rs
@@ -0,0 +1,97 @@
+/* Copyright (C) 2017-2025 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+pub const DIR_BOTH: u8 = 0b0000_1100;
+const DIR_TOSERVER: u8 = 0b0000_0100;
+const DIR_TOCLIENT: u8 = 0b0000_1000;
+
+#[repr(C)]
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
+pub enum Direction {
+    ToServer = 0x04,
+    ToClient = 0x08,
+}
+
+impl Direction {
+    /// Return true if the direction is to server.
+    pub fn is_to_server(&self) -> bool {
+        matches!(self, Self::ToServer)
+    }
+
+    /// Return true if the direction is to client.
+    pub fn is_to_client(&self) -> bool {
+        matches!(self, Self::ToClient)
+    }
+
+    pub fn index(&self) -> usize {
+        match self {
+            Self::ToClient => 0,
+            _ => 1,
+        }
+    }
+}
+
+impl Default for Direction {
+    fn default() -> Self {
+        Direction::ToServer
+    }
+}
+
+impl std::fmt::Display for Direction {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::ToServer => write!(f, "toserver"),
+            Self::ToClient => write!(f, "toclient"),
+        }
+    }
+}
+
+impl From<u8> for Direction {
+    fn from(d: u8) -> Self {
+        if d & (DIR_TOSERVER | DIR_TOCLIENT) == (DIR_TOSERVER | DIR_TOCLIENT) {
+            debug_validate_fail!("Both directions are set");
+            Direction::ToServer
+        } else if d & DIR_TOSERVER != 0 {
+            Direction::ToServer
+        } else if d & DIR_TOCLIENT != 0 {
+            Direction::ToClient
+        } else {
+            debug_validate_fail!("Unknown direction!!");
+            Direction::ToServer
+        }
+    }
+}
+
+impl From<Direction> for u8 {
+    fn from(d: Direction) -> u8 {
+        d as u8
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+
+    #[test]
+    fn test_direction() {
+        assert!(Direction::ToServer.is_to_server());
+        assert!(!Direction::ToServer.is_to_client());
+
+        assert!(Direction::ToClient.is_to_client());
+        assert!(!Direction::ToClient.is_to_server());
+    }
+}
diff --git a/rust/src/dns/detect.rs b/rust/src/dns/detect.rs
index 67e30c9546..2eb81c6ba3 100644
--- a/rust/src/dns/detect.rs
+++ b/rust/src/dns/detect.rs
@@ -16,7 +16,7 @@
  */
 
 use super::dns::DNSTransaction;
-use crate::core::Direction;
+use crate::direction::Direction;
 use crate::detect::uint::{detect_match_uint, DetectUintData};
 
 /// Perform the DNS opcode match.
diff --git a/rust/src/dns/dns.rs b/rust/src/dns/dns.rs
index 6cf2e35ecf..30c1254274 100644
--- a/rust/src/dns/dns.rs
+++ b/rust/src/dns/dns.rs
@@ -22,6 +22,8 @@ use std::ffi::CString;
 
 use crate::applayer::*;
 use crate::core::{self, *};
+use crate::direction::Direction;
+use crate::direction::DIR_BOTH;
 use crate::dns::parser;
 use crate::flow::Flow;
 use crate::frames::Frame;
diff --git a/rust/src/enip/detect.rs b/rust/src/enip/detect.rs
index ff1b38558b..c652aa01ca 100644
--- a/rust/src/enip/detect.rs
+++ b/rust/src/enip/detect.rs
@@ -40,7 +40,7 @@ use crate::detect::{
     SigMatchAppendSMToList, SIGMATCH_INFO_STICKY_BUFFER, SIGMATCH_NOOPT,
 };
 
-use crate::core::Direction;
+use crate::direction::Direction;
 
 use std::ffi::CStr;
 
diff --git a/rust/src/enip/enip.rs b/rust/src/enip/enip.rs
index 6b99992f12..daccd011e3 100644
--- a/rust/src/enip/enip.rs
+++ b/rust/src/enip/enip.rs
@@ -20,10 +20,11 @@ use super::parser;
 use crate::applayer::{self, *};
 use crate::conf::conf_get;
 use crate::core::{
-    AppProto, Direction, ALPROTO_FAILED, ALPROTO_UNKNOWN, IPPROTO_TCP, IPPROTO_UDP,
+    AppProto, ALPROTO_FAILED, ALPROTO_UNKNOWN, IPPROTO_TCP, IPPROTO_UDP,
     STREAM_TOCLIENT, STREAM_TOSERVER,
 };
 use crate::detect::EnumString;
+use crate::direction::Direction;
 use crate::flow::Flow;
 use crate::frames::Frame;
 use nom7 as nom;
diff --git a/rust/src/frames.rs b/rust/src/frames.rs
index ac78358438..b1dba3ea40 100644
--- a/rust/src/frames.rs
+++ b/rust/src/frames.rs
@@ -21,7 +21,7 @@ use crate::applayer::StreamSlice;
 use crate::flow::Flow;
 #[cfg(not(test))]
 use crate::core::STREAM_TOSERVER;
-use crate::core::Direction;
+use crate::direction::Direction;
 
 #[cfg(not(test))]
 #[repr(C)]
diff --git a/rust/src/http2/decompression.rs b/rust/src/http2/decompression.rs
index 31e8547a81..8456b43267 100644
--- a/rust/src/http2/decompression.rs
+++ b/rust/src/http2/decompression.rs
@@ -15,7 +15,7 @@
 * 02110-1301, USA.
 */
 
-use crate::core::Direction;
+use crate::direction::Direction;
 use brotli;
 use flate2::read::{DeflateDecoder, GzDecoder};
 use std;
diff --git a/rust/src/http2/detect.rs b/rust/src/http2/detect.rs
index 4a05b29103..66de131365 100644
--- a/rust/src/http2/detect.rs
+++ b/rust/src/http2/detect.rs
@@ -19,7 +19,7 @@ use super::http2::{
     HTTP2Event, HTTP2Frame, HTTP2FrameTypeData, HTTP2State, HTTP2Transaction, HTTP2TransactionState,
 };
 use super::parser;
-use crate::core::Direction;
+use crate::direction::Direction;
 use crate::detect::uint::{detect_match_uint, DetectUintData};
 use std::ffi::CStr;
 use std::str::FromStr;
diff --git a/rust/src/http2/http2.rs b/rust/src/http2/http2.rs
index 4934c9e023..f6625fc786 100644
--- a/rust/src/http2/http2.rs
+++ b/rust/src/http2/http2.rs
@@ -23,6 +23,7 @@ use super::range;
 use crate::applayer::{self, *};
 use crate::conf::conf_get;
 use crate::core::*;
+use crate::direction::Direction;
 use crate::filecontainer::*;
 use crate::filetracker::*;
 use crate::flow::Flow;
diff --git a/rust/src/http2/range.rs b/rust/src/http2/range.rs
index 0749cc0bc5..41366f8a16 100644
--- a/rust/src/http2/range.rs
+++ b/rust/src/http2/range.rs
@@ -17,8 +17,9 @@
 
 use super::detect;
 use crate::core::{
-    Direction, HttpRangeContainerBlock, StreamingBufferConfig, SuricataFileContext, SC,
+    HttpRangeContainerBlock, StreamingBufferConfig, SuricataFileContext, SC,
 };
+use crate::direction::Direction;
 use crate::flow::Flow;
 use crate::http2::http2::HTTP2Transaction;
 use crate::http2::http2::SURICATA_HTTP2_FILE_CONFIG;
diff --git a/rust/src/ike/ike.rs b/rust/src/ike/ike.rs
index 81e10af24e..aed45f644d 100644
--- a/rust/src/ike/ike.rs
+++ b/rust/src/ike/ike.rs
@@ -23,6 +23,7 @@ use self::ipsec_parser::*;
 use crate::applayer;
 use crate::applayer::*;
 use crate::core::{self, *};
+use crate::direction::Direction;
 use crate::flow::Flow;
 use crate::ike::ikev1::{handle_ikev1, IkeV1Header, Ikev1Container};
 use crate::ike::ikev2::{handle_ikev2, Ikev2Container};
diff --git a/rust/src/ike/ikev1.rs b/rust/src/ike/ikev1.rs
index 6f598f9806..4ce29d2a10 100644
--- a/rust/src/ike/ikev1.rs
+++ b/rust/src/ike/ikev1.rs
@@ -19,7 +19,7 @@
 
 use crate::applayer::*;
 use crate::common::to_hex;
-use crate::core::Direction;
+use crate::direction::Direction;
 use crate::ike::ike::{IKEState, IkeEvent};
 use crate::ike::parser::*;
 use nom7::Err;
diff --git a/rust/src/ike/ikev2.rs b/rust/src/ike/ikev2.rs
index d0d1ab321f..57635f4ad6 100644
--- a/rust/src/ike/ikev2.rs
+++ b/rust/src/ike/ikev2.rs
@@ -18,7 +18,7 @@
 // written by Pierre Chifflier  <chifflier@wzdftpd.net>
 
 use crate::applayer::*;
-use crate::core::Direction;
+use crate::direction::Direction;
 use crate::ike::ipsec_parser::*;
 
 use super::ipsec_parser::IkeV2Transform;
diff --git a/rust/src/ike/logger.rs b/rust/src/ike/logger.rs
index cc5705f580..7523457537 100644
--- a/rust/src/ike/logger.rs
+++ b/rust/src/ike/logger.rs
@@ -17,7 +17,7 @@
 
 use super::ike::{IKEState, IKETransaction};
 use super::ipsec_parser::IKEV2_FLAG_INITIATOR;
-use crate::core::Direction;
+use crate::direction::Direction;
 use crate::ike::parser::{ExchangeType, IsakmpPayloadType, SaAttribute};
 use crate::jsonbuilder::{JsonBuilder, JsonError};
 use num_traits::FromPrimitive;
diff --git a/rust/src/krb/krb5.rs b/rust/src/krb/krb5.rs
index b322c7b172..d2f384a81c 100644
--- a/rust/src/krb/krb5.rs
+++ b/rust/src/krb/krb5.rs
@@ -28,7 +28,8 @@ use kerberos_parser::krb5::{EncryptionType,ErrorCode,MessageType,PrincipalName,R
 use asn1_rs::FromDer;
 use crate::applayer::{self, *};
 use crate::core;
-use crate::core::{AppProto,ALPROTO_FAILED,ALPROTO_UNKNOWN,Direction, IPPROTO_TCP, IPPROTO_UDP};
+use crate::core::{AppProto,ALPROTO_FAILED,ALPROTO_UNKNOWN, IPPROTO_TCP, IPPROTO_UDP};
+use crate::direction::Direction;
 use crate::flow::Flow;
 
 #[derive(AppLayerEvent)]
diff --git a/rust/src/ldap/ldap.rs b/rust/src/ldap/ldap.rs
index c17de7f991..1aa2e08bbc 100644
--- a/rust/src/ldap/ldap.rs
+++ b/rust/src/ldap/ldap.rs
@@ -20,6 +20,7 @@
 use crate::applayer::{self, *};
 use crate::conf::conf_get;
 use crate::core::*;
+use crate::direction::Direction;
 use crate::flow::Flow;
 use crate::frames::*;
 use nom7 as nom;
diff --git a/rust/src/lib.rs b/rust/src/lib.rs
index 9d2b7990f6..855ee11e29 100644
--- a/rust/src/lib.rs
+++ b/rust/src/lib.rs
@@ -140,6 +140,7 @@ pub mod feature;
 pub mod sdp;
 pub mod ldap;
 pub mod flow;
+pub mod direction;
 
 #[allow(unused_imports)]
 pub use suricata_lua_sys;
diff --git a/rust/src/mqtt/detect.rs b/rust/src/mqtt/detect.rs
index 1a7d048365..13ad30285f 100644
--- a/rust/src/mqtt/detect.rs
+++ b/rust/src/mqtt/detect.rs
@@ -1426,7 +1426,7 @@ pub unsafe extern "C" fn ScDetectMqttRegister() {
 #[cfg(test)]
 mod test {
     use super::*;
-    use crate::core::Direction;
+    use crate::direction::Direction;
     use crate::detect::uint::DetectUintMode;
     use crate::mqtt::mqtt::MQTTTransaction;
     use crate::mqtt::mqtt_message::*;
diff --git a/rust/src/mqtt/mqtt.rs b/rust/src/mqtt/mqtt.rs
index d4ee6cced3..d280664604 100644
--- a/rust/src/mqtt/mqtt.rs
+++ b/rust/src/mqtt/mqtt.rs
@@ -23,6 +23,7 @@ use crate::applayer::*;
 use crate::applayer::{self, LoggerFlags};
 use crate::conf::{conf_get, get_memval};
 use crate::core::*;
+use crate::direction::Direction;
 use crate::flow::Flow;
 use crate::frames::*;
 use nom7::Err;
diff --git a/rust/src/nfs/nfs.rs b/rust/src/nfs/nfs.rs
index 04c205aabf..48a6bba1c1 100644
--- a/rust/src/nfs/nfs.rs
+++ b/rust/src/nfs/nfs.rs
@@ -26,6 +26,8 @@ use nom7::{Err, Needed};
 
 use crate::applayer;
 use crate::applayer::*;
+use crate::direction::Direction;
+use crate::direction::DIR_BOTH;
 use crate::flow::Flow;
 use crate::frames::*;
 use crate::core::*;
diff --git a/rust/src/nfs/nfs3.rs b/rust/src/nfs/nfs3.rs
index 032751f536..de7df344f5 100644
--- a/rust/src/nfs/nfs3.rs
+++ b/rust/src/nfs/nfs3.rs
@@ -17,8 +17,7 @@
 
 // written by Victor Julien
 
-use crate::core::*;
-
+use crate::direction::Direction;
 use crate::nfs::nfs::*;
 use crate::nfs::types::*;
 use crate::nfs::rpc_records::*;
diff --git a/rust/src/nfs/nfs4.rs b/rust/src/nfs/nfs4.rs
index 730e82ba1b..0e83b8dafe 100644
--- a/rust/src/nfs/nfs4.rs
+++ b/rust/src/nfs/nfs4.rs
@@ -21,7 +21,7 @@ use nom7::bytes::streaming::take;
 use nom7::number::streaming::be_u32;
 use nom7::{Err, IResult};
 
-use crate::core::*;
+use crate::direction::Direction;
 use crate::nfs::nfs::*;
 use crate::nfs::nfs4_records::*;
 use crate::nfs::nfs_records::*;
diff --git a/rust/src/ntp/ntp.rs b/rust/src/ntp/ntp.rs
index d4c3d8b41b..a899210214 100644
--- a/rust/src/ntp/ntp.rs
+++ b/rust/src/ntp/ntp.rs
@@ -20,8 +20,9 @@
 extern crate ntp_parser;
 use self::ntp_parser::*;
 use crate::core;
-use crate::core::{AppProto,ALPROTO_UNKNOWN,ALPROTO_FAILED,Direction};
+use crate::core::{AppProto,ALPROTO_UNKNOWN,ALPROTO_FAILED};
 use crate::applayer::{self, *};
+use crate::direction::Direction;
 use crate::flow::Flow;
 use std;
 use std::ffi::CString;
diff --git a/rust/src/pgsql/pgsql.rs b/rust/src/pgsql/pgsql.rs
index af6799118e..56eaba5633 100644
--- a/rust/src/pgsql/pgsql.rs
+++ b/rust/src/pgsql/pgsql.rs
@@ -22,7 +22,8 @@
 use super::parser::{self, ConsolidatedDataRowPacket, PgsqlBEMessage, PgsqlFEMessage};
 use crate::applayer::*;
 use crate::conf::*;
-use crate::core::{AppProto, Direction, ALPROTO_FAILED, ALPROTO_UNKNOWN, IPPROTO_TCP, *};
+use crate::core::{AppProto, ALPROTO_FAILED, ALPROTO_UNKNOWN, IPPROTO_TCP, *};
+use crate::direction::Direction;
 use crate::flow::Flow;
 use nom7::{Err, IResult};
 use std;
diff --git a/rust/src/quic/quic.rs b/rust/src/quic/quic.rs
index 54ebc05688..3b0e1f65f3 100644
--- a/rust/src/quic/quic.rs
+++ b/rust/src/quic/quic.rs
@@ -21,8 +21,8 @@ use super::{
     frames::{Frame, QuicTlsExtension, StreamTag},
     parser::{quic_pkt_num, QuicData, QuicHeader, QuicType},
 };
-use crate::{applayer::{self, *}, flow::Flow};
-use crate::core::{AppProto, Direction, ALPROTO_FAILED, ALPROTO_UNKNOWN, IPPROTO_UDP};
+use crate::{applayer::{self, *}, direction::Direction, flow::Flow};
+use crate::core::{AppProto, ALPROTO_FAILED, ALPROTO_UNKNOWN, IPPROTO_UDP};
 use std::collections::VecDeque;
 use std::ffi::CString;
 use tls_parser::TlsExtensionType;
diff --git a/rust/src/rfb/rfb.rs b/rust/src/rfb/rfb.rs
index d7fcdd2354..5c2132dc78 100644
--- a/rust/src/rfb/rfb.rs
+++ b/rust/src/rfb/rfb.rs
@@ -22,6 +22,7 @@ use super::parser;
 use crate::applayer;
 use crate::applayer::*;
 use crate::core::{AppProto, ALPROTO_UNKNOWN, IPPROTO_TCP};
+use crate::direction::Direction;
 use crate::flow::Flow;
 use crate::frames::*;
 use nom7::Err;
@@ -888,7 +889,7 @@ pub unsafe extern "C" fn SCRfbRegisterParser() {
             b"RFB \0".as_ptr() as *const c_char,
             b"RFB ".len() as u16,
             0,
-            crate::core::Direction::ToServer.into(),
+            Direction::ToServer.into(),
         ) < 0
         {
             SCLogDebug!("Failed to register protocol detection pattern for direction TOSERVER");
@@ -899,7 +900,7 @@ pub unsafe extern "C" fn SCRfbRegisterParser() {
             b"RFB \0".as_ptr() as *const c_char,
             b"RFB ".len() as u16,
             0,
-            crate::core::Direction::ToClient.into(),
+            Direction::ToClient.into(),
         ) < 0
         {
             SCLogDebug!("Failed to register protocol detection pattern for direction TOCLIENT");
diff --git a/rust/src/sip/detect.rs b/rust/src/sip/detect.rs
index 708d5640a1..ff2ec3e06e 100644
--- a/rust/src/sip/detect.rs
+++ b/rust/src/sip/detect.rs
@@ -17,7 +17,7 @@
 
 // written by Giuseppe Longo <giuseppe@glongo.it>
 
-use crate::core::Direction;
+use crate::direction::Direction;
 use crate::detect::{
     DetectBufferSetActiveList, DetectHelperBufferMpmRegister, DetectHelperGetData,
     DetectHelperGetMultiData, DetectHelperKeywordRegister, DetectHelperMultiBufferMpmRegister,
diff --git a/rust/src/sip/sip.rs b/rust/src/sip/sip.rs
index 010da975ca..5427465673 100755
--- a/rust/src/sip/sip.rs
+++ b/rust/src/sip/sip.rs
@@ -20,6 +20,7 @@
 use crate::applayer::{self, *};
 use crate::core;
 use crate::core::{AppProto, ALPROTO_UNKNOWN, IPPROTO_TCP, IPPROTO_UDP};
+use crate::direction::Direction;
 use crate::flow::Flow;
 use crate::frames::*;
 use crate::sip::parser::*;
@@ -90,7 +91,7 @@ impl SIPState {
         self.transactions.clear();
     }
 
-    fn new_tx(&mut self, direction: crate::core::Direction) -> SIPTransaction {
+    fn new_tx(&mut self, direction: Direction) -> SIPTransaction {
         self.tx_id += 1;
         SIPTransaction::new(self.tx_id, direction)
     }
@@ -128,7 +129,7 @@ impl SIPState {
 
         match sip_parse_request(input) {
             Ok((_, request)) => {
-                let mut tx = self.new_tx(crate::core::Direction::ToServer);
+                let mut tx = self.new_tx(Direction::ToServer);
                 sip_frames_ts(flow, &stream_slice, &request, tx.id);
                 tx.request = Some(request);
                 if let Ok((_, req_line)) = sip_take_line(input) {
@@ -172,7 +173,7 @@ impl SIPState {
             }
             match sip_parse_request(start) {
                 Ok((rem, request)) => {
-                    let mut tx = self.new_tx(crate::core::Direction::ToServer);
+                    let mut tx = self.new_tx(Direction::ToServer);
                     let tx_id = tx.id;
                     sip_frames_ts(flow, &stream_slice, &request, tx_id);
                     tx.request = Some(request);
@@ -224,7 +225,7 @@ impl SIPState {
 
         match sip_parse_response(input) {
             Ok((_, response)) => {
-                let mut tx = self.new_tx(crate::core::Direction::ToClient);
+                let mut tx = self.new_tx(Direction::ToClient);
                 sip_frames_tc(flow, &stream_slice, &response, tx.id);
                 tx.response = Some(response);
                 if let Ok((_, resp_line)) = sip_take_line(input) {
@@ -267,7 +268,7 @@ impl SIPState {
             }
             match sip_parse_response(start) {
                 Ok((rem, response)) => {
-                    let mut tx = self.new_tx(crate::core::Direction::ToClient);
+                    let mut tx = self.new_tx(Direction::ToClient);
                     let tx_id = tx.id;
                     sip_frames_tc(flow, &stream_slice, &response, tx_id);
                     tx.response = Some(response);
@@ -307,7 +308,7 @@ impl SIPState {
 }
 
 impl SIPTransaction {
-    pub fn new(id: u64, direction: crate::core::Direction) -> SIPTransaction {
+    pub fn new(id: u64, direction: Direction) -> SIPTransaction {
         SIPTransaction {
             id,
             request: None,
@@ -515,7 +516,7 @@ fn register_pattern_probe(proto: u8) -> i8 {
                 method.as_ptr() as *const std::os::raw::c_char,
                 depth,
                 0,
-                core::Direction::ToServer as u8,
+                Direction::ToServer as u8,
             );
         }
         r |= AppLayerProtoDetectPMRegisterPatternCS(
@@ -524,7 +525,7 @@ fn register_pattern_probe(proto: u8) -> i8 {
             b"SIP/2.0\0".as_ptr() as *const std::os::raw::c_char,
             8,
             0,
-            core::Direction::ToClient as u8,
+            Direction::ToClient as u8,
         );
         if proto == core::IPPROTO_UDP {
             r |= AppLayerProtoDetectPMRegisterPatternCS(
@@ -533,7 +534,7 @@ fn register_pattern_probe(proto: u8) -> i8 {
                 "UPDATE\0".as_ptr() as *const std::os::raw::c_char,
                 "UPDATE".len() as u16,
                 0,
-                core::Direction::ToServer as u8,
+                Direction::ToServer as u8,
             );
         }
     }
diff --git a/rust/src/smb/detect.rs b/rust/src/smb/detect.rs
index 968641406b..cbe2454233 100644
--- a/rust/src/smb/detect.rs
+++ b/rust/src/smb/detect.rs
@@ -15,10 +15,10 @@
  * 02110-1301, USA.
  */
 
-use crate::core::*;
 use crate::dcerpc::dcerpc::DCERPC_TYPE_REQUEST;
 use crate::dcerpc::detect::{DCEIfaceData, DCEOpnumData, DETECT_DCE_OPNUM_RANGE_UNINITIALIZED};
 use crate::detect::uint::detect_match_uint;
+use crate::direction::Direction;
 use crate::smb::smb::*;
 use std::ffi::CStr;
 use std::os::raw::{c_char, c_void};
diff --git a/rust/src/smb/files.rs b/rust/src/smb/files.rs
index e1de7d171a..c68f3eb077 100644
--- a/rust/src/smb/files.rs
+++ b/rust/src/smb/files.rs
@@ -17,6 +17,7 @@
 
 use std;
 use crate::core::*;
+use crate::direction::Direction;
 use crate::filetracker::*;
 use crate::filecontainer::*;
 
diff --git a/rust/src/smb/smb.rs b/rust/src/smb/smb.rs
index 9cc5c83ec1..43a44545ad 100644
--- a/rust/src/smb/smb.rs
+++ b/rust/src/smb/smb.rs
@@ -39,6 +39,7 @@ use std::num::NonZeroUsize;
 use crate::core::*;
 use crate::applayer;
 use crate::applayer::*;
+use crate::direction::Direction;
 use crate::flow::{Flow, FLOW_DIR_REVERSED};
 use crate::frames::*;
 use crate::conf::*;
diff --git a/rust/src/smb/smb1.rs b/rust/src/smb/smb1.rs
index c74ab5fd02..474e5d4e54 100644
--- a/rust/src/smb/smb1.rs
+++ b/rust/src/smb/smb1.rs
@@ -19,8 +19,7 @@
  * - check all parsers for calls on non-SUCCESS status
  */
 
-use crate::core::*;
-
+use crate::direction::Direction;
 use crate::smb::smb::*;
 use crate::smb::dcerpc::*;
 use crate::smb::events::*;
diff --git a/rust/src/smb/smb2.rs b/rust/src/smb/smb2.rs
index 97deb702ec..b364d66a99 100644
--- a/rust/src/smb/smb2.rs
+++ b/rust/src/smb/smb2.rs
@@ -17,8 +17,7 @@
 
 use nom7::Err;
 
-use crate::core::*;
-
+use crate::direction::Direction;
 use crate::smb::smb::*;
 use crate::smb::smb2_records::*;
 use crate::smb::smb2_session::*;
diff --git a/rust/src/snmp/snmp.rs b/rust/src/snmp/snmp.rs
index d31e0a26bf..64846eaf30 100644
--- a/rust/src/snmp/snmp.rs
+++ b/rust/src/snmp/snmp.rs
@@ -17,6 +17,7 @@
 
 // written by Pierre Chifflier  <chifflier@wzdftpd.net>
 
+use crate::direction::Direction;
 use crate::flow::Flow;
 use crate::snmp::snmp_parser::*;
 use crate::core::{self, *};
diff --git a/rust/src/ssh/detect.rs b/rust/src/ssh/detect.rs
index 6aa18cdac7..a8ba19ffa8 100644
--- a/rust/src/ssh/detect.rs
+++ b/rust/src/ssh/detect.rs
@@ -16,7 +16,7 @@
  */
 
 use super::ssh::SSHTransaction;
-use crate::core::Direction;
+use crate::direction::Direction;
 use std::ptr;
 
 #[no_mangle]
diff --git a/rust/src/ssh/ssh.rs b/rust/src/ssh/ssh.rs
index c75d56f6e4..c0a7677d42 100644
--- a/rust/src/ssh/ssh.rs
+++ b/rust/src/ssh/ssh.rs
@@ -18,6 +18,7 @@
 use super::parser;
 use crate::applayer::*;
 use crate::core::*;
+use crate::direction::Direction;
 use crate::flow::Flow;
 use nom7::Err;
 use std::ffi::CString;
diff --git a/rust/src/websocket/websocket.rs b/rust/src/websocket/websocket.rs
index 0a3f92525c..1138ab759a 100644
--- a/rust/src/websocket/websocket.rs
+++ b/rust/src/websocket/websocket.rs
@@ -18,7 +18,8 @@
 use super::parser;
 use crate::applayer::{self, *};
 use crate::conf::conf_get;
-use crate::core::{AppProto, Direction, ALPROTO_FAILED, ALPROTO_UNKNOWN, IPPROTO_TCP};
+use crate::core::{AppProto, ALPROTO_FAILED, ALPROTO_UNKNOWN, IPPROTO_TCP};
+use crate::direction::Direction;
 use crate::flow::Flow;
 use crate::frames::Frame;