diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9c6cebb..c942631 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -25,6 +25,13 @@ jobs:
           ./configure
           make test
 
+      - if: ${{ failure() }}
+        name: Upload tests output
+        uses: actions/upload-artifact@v3
+        with:
+          name: tests-smoketest
+          path: tests
+
   smoketest_all_opts:
     name: Smoke test With all options turned on
     runs-on: ubuntu-latest
@@ -39,12 +46,24 @@ jobs:
 
       - name: Install libraries needed for all options turned on
         run: |
-          sudo apt-get install -y libminiupnpc-dev libnatpmp-dev libpcap-dev libcap-dev
+          sudo apt-get install -y \
+            libminiupnpc-dev \
+            libnatpmp-dev \
+            libpcap-dev \
+            libcap-dev \
+            libzstd-dev
 
       - name: Run minimal test set
         run: |
           ./autogen.sh
-          ./configure --enable-pthread --enable-miniupnp --enable-natpmp --enable-cap --enable-pcap CFLAGS="-O3 -DN2N_OPTION_USE_PORTMAPPING"
+          ./configure \
+            --enable-pthread \
+            --enable-miniupnp \
+            --enable-natpmp \
+            --enable-cap \
+            --enable-pcap \
+            --with-zstd \
+            CFLAGS="-O3 -DN2N_OPTION_USE_PORTMAPPING"
           make test
 
   lint:
@@ -174,7 +193,7 @@ jobs:
         name: Upload tests output
         uses: actions/upload-artifact@v3
         with:
-          name: tests-out
+          name: tests-linux
           path: tests
 
       - name: Generate coverage reports
@@ -244,7 +263,7 @@ jobs:
         name: Upload tests output
         uses: actions/upload-artifact@v3
         with:
-          name: tests-out
+          name: tests-macos
           path: tests
 
       - name: Generate coverage reports
@@ -321,7 +340,7 @@ jobs:
         name: Upload tests output
         uses: actions/upload-artifact@v3
         with:
-          name: tests-out
+          name: tests-windows
           path: tests
 
       - name: Generate coverage data
diff --git a/include/aes.h b/include/aes.h
index b22f0f8..4604a16 100644
--- a/include/aes.h
+++ b/include/aes.h
@@ -17,9 +17,6 @@
  */
 
 
-#include "n2n.h"               // HAVE_OPENSSL_1_1, traceEvent ...
-
-
 #ifndef AES_H
 #define AES_H
 
diff --git a/include/auth.h b/include/auth.h
index 0376d3f..d4d65d4 100644
--- a/include/auth.h
+++ b/include/auth.h
@@ -17,13 +17,15 @@
  */
 
 
-#include "n2n.h"
-
-
 #ifndef AUTH_H
 #define AUTH_H
 
 
+#include <stddef.h>  // for size_t
+#include <stdint.h>  // for uint8_t, uint32_t
+#include "n2n.h"     // for n2n_private_public_key_t, n2n_community_t, N2N_A...
+
+
 int bin_to_ascii (char *out, uint8_t *in, size_t in_len);
 
 int ascii_to_bin (uint8_t *out, char *in);
diff --git a/include/cc20.h b/include/cc20.h
index 3a5b553..51f4425 100644
--- a/include/cc20.h
+++ b/include/cc20.h
@@ -21,9 +21,9 @@
 #define CC20_H
 
 
-#include <stdint.h>
-
-#include "n2n.h"               // HAVE_OPENSSL_1_1, traceEvent ...
+#include <stddef.h>  // for size_t
+#include <stdint.h>  // for uint32_t, uint8_t
+#include "config.h"  // HAVE_OPENSSL_1_1
 
 
 #define CC20_IV_SIZE           16
@@ -46,8 +46,6 @@ typedef struct cc20_context_t {
 #elif defined (__SSE2__)  // SSE2 ---------------------------------------------------------------------------------
 
 
-#include <immintrin.h>
-
 typedef struct cc20_context {
     uint32_t keystream32[16];
     uint8_t key[CC20_KEY_BYTES];
diff --git a/include/header_encryption.h b/include/header_encryption.h
index a5e3f89..6e10254 100644
--- a/include/header_encryption.h
+++ b/include/header_encryption.h
@@ -16,6 +16,7 @@
  *
  */
 
+#include "n2n_typedefs.h"
 
 int packet_header_decrypt (uint8_t packet[], uint16_t packet_len,
                            char *community_name,
diff --git a/include/json.h b/include/json.h
index aabdbb1..585a7bf 100644
--- a/include/json.h
+++ b/include/json.h
@@ -27,17 +27,11 @@
 #define JSON_H
 
 
-#include <string.h>
-#include <stdlib.h>
-
 #define json_str_is_whitespace(x)                     x == '\r' || x == '\n' || x == '\t' || x == ' '
 #define json_str_is_numeral(x)                        (x >= '0' && x <= '9') || x == 'e' || x == 'E' \
                                                       || x == '.'  || x == '+' || x == '-'
 #define json_str_remove_whitespace_calc_offset(x, y)  while(json_str_is_whitespace(*x)) { x++; y++; }
 
-struct _jsonobject;
-struct _jsonpair;
-union _jsonvalue;
 
 typedef enum {
     JSON_STRING = 0,
diff --git a/include/n2n.h b/include/n2n.h
index a81612c..e5b0bfd 100644
--- a/include/n2n.h
+++ b/include/n2n.h
@@ -47,119 +47,55 @@
 #undef N2N_HAVE_DAEMON
 #undef N2N_HAVE_TCP           /* as explained on https://github.com/ntop/n2n/pull/627#issuecomment-782093706 */
 #undef N2N_HAVE_SETUID
-#endif
+#endif /* WIN32 */
 
 
 #include <stdbool.h>
-#include <time.h>
-#include <ctype.h>
-#include <stdlib.h>
+#include <stdio.h>         // for size_t, FILE
+#include "n2n_define.h"
+#include "n2n_typedefs.h"
+
+#ifdef WIN32
+#include <lmaccess.h>           /* for privilege check in tools/n2n-route */
+#include <lmapibuf.h>           /* for privilege check in tools/n2n-route */
+#include <sys/stat.h>
+#include <windows.h>            /* for privilege check in tools/n2n-route */
+#include <winsock2.h>           /* for tcp */
+#include "wintap.h"
+#define SHUT_RDWR   SD_BOTH     /* for tcp */
+#endif /* #ifdef WIN32 */
 
 #ifndef WIN32
-#include <netdb.h>
-#endif
-
-#ifndef _MSC_VER
-#include <getopt.h>
-#endif /* #ifndef _MSC_VER */
-
-#include <stdio.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <stdint.h>
-#include <time.h>
-
-#ifndef WIN32
-#include <unistd.h>
-#include <sys/ioctl.h>
-#include <sys/socket.h>
-#include <sys/param.h>
-#include <pthread.h>
+#include <netinet/in.h>    // for in_addr (ptr only), in_addr_t
+#include <pwd.h>
+#include <stdint.h>        // for uint8_t, uint64_t, uint32_t, uint16_t
+#include <sys/types.h>     // for time_t
+#include <unistd.h>        // for close
+#define closesocket(a) close(a)
 
 #ifdef __linux__
 #define N2N_CAN_NAME_IFACE 1
-#include <linux/netlink.h>
-#include <linux/rtnetlink.h>
-#include <unistd.h>
-#include <net/if_arp.h>
-#include <net/if.h>
-#include <linux/if_tun.h>
-#include <net/route.h>
 #endif /* #ifdef __linux__ */
 
 #ifdef __FreeBSD__
 #include <netinet/in_systm.h>
 #endif /* #ifdef __FreeBSD__ */
 
-#include <syslog.h>
-#include <sys/wait.h>
-
 #ifdef HAVE_ZSTD
 #include <zstd.h>
 #endif
 
-#include <netinet/in.h>
-#include <netinet/udp.h>
-#include <netinet/tcp.h>
-#include <arpa/inet.h>
-#include <sys/types.h>
-#include <sys/time.h>
-#include <unistd.h>
-#include <string.h>
-#include <assert.h>
-#include <sys/stat.h>
-#include <stdint.h>
 #if defined (HAVE_OPENSSL_1_1)
 #include <openssl/opensslv.h>
 #include <openssl/crypto.h>
 #endif
-
-#define closesocket(a) close(a)
 #endif /* #ifndef WIN32 */
 
-#include "minilzo.h"
-#include <signal.h>
-#include <string.h>
-#include <stdarg.h>
-#include "lzoconf.h"
-#include "uthash.h"
-#include "n2n_define.h"
-#include "n2n_typedefs.h"
 
-#ifdef WIN32
-#include <windows.h>            /* for privilege check in tools/n2n-route */
-#include <lmaccess.h>           /* for privilege check in tools/n2n-route */
-#include <lmapibuf.h>           /* for privilege check in tools/n2n-route */
-#include <winsock2.h>           /* for tcp */
-#define SHUT_RDWR   SD_BOTH     /* for tcp */
-#include "wintap.h"
-#include <sys/stat.h>
-#else
-#include <pwd.h>
-#endif /* #ifdef WIN32 */
 
-#include "n2n_wire.h"
-#include "random_numbers.h"
-#include "pearson.h"
-#include "portable_endian.h"
-#include "aes.h"
-#include "cc20.h"
-#include "speck.h"
-#include "curve25519.h"
-#include "n2n_regex.h"
-#include "sn_selection.h"
-#include "network_traffic_filter.h"
-#include "auth.h"
-
-#include "n2n_port_mapping.h"
-
-#include "json.h"
 
 /* ************************************** */
 
-#include "header_encryption.h"
-#include "tf.h"
-
 #ifndef TRACE_ERROR
 #define TRACE_ERROR       0
 #define TRACE_WARNING     1
diff --git a/include/pearson.h b/include/pearson.h
index 908f24f..9ceae47 100644
--- a/include/pearson.h
+++ b/include/pearson.h
@@ -17,10 +17,8 @@
  */
 
 
-#include <stddef.h>
-#include <stdint.h>
-
-#include "portable_endian.h"
+#include <stddef.h>  // for size_t
+#include <stdint.h>  // for uint8_t, uint16_t, uint32_t, uint64_t
 
 
 void pearson_hash_256 (uint8_t *out, const uint8_t *in, size_t len);
diff --git a/include/random_numbers.h b/include/random_numbers.h
index b998bcf..2c7eba4 100644
--- a/include/random_numbers.h
+++ b/include/random_numbers.h
@@ -21,21 +21,16 @@
 #define RND_H
 
 
-#include <stdint.h>
-#include <stddef.h>
-#include <time.h>        /* time, clock */
-
-#include "n2n.h"         /* traceEvent */
+#include <stdint.h>   // for uint64_t, uint32_t
 
 
 // syscall and inquiring random number from hardware generators might fail, so we will retry
 #define RND_RETRIES      1000
 
 #if defined (__linux__)
-#include <sys/syscall.h> /* syscall, SYS_getrandom */
+#include <syscall.h>  // for SYS_getrandom
 #ifdef SYS_getrandom
 #define GRND_NONBLOCK       1
-#include <errno.h>       /* errno, EAGAIN */
 #endif
 #endif
 
diff --git a/include/speck.h b/include/speck.h
index 686818b..9f9cb18 100644
--- a/include/speck.h
+++ b/include/speck.h
@@ -26,10 +26,7 @@
 #define SPECK_H
 
 
-#include <stdint.h>
-#include <stdlib.h>
-
-#include "portable_endian.h"
+#include <stdint.h>     // for uint64_t, uint32_t
 
 
 #define u32 uint32_t
diff --git a/include/tf.h b/include/tf.h
index 5f13f76..d2d0a65 100644
--- a/include/tf.h
+++ b/include/tf.h
@@ -51,11 +51,8 @@
 #define TF_H
 
 
-#include <stdint.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "portable_endian.h"
+#include <stdint.h>  // for uint32_t
+#include <stdlib.h>  // for size_t
 
 
 #define TF_BLOCK_SIZE     16
diff --git a/src/aes.c b/src/aes.c
index 35375bd..2d4ec03 100644
--- a/src/aes.c
+++ b/src/aes.c
@@ -17,7 +17,12 @@
  */
 
 
-#include "n2n.h"
+#include <stdint.h>  // for uint32_t, uint8_t
+#include <stdlib.h>  // for calloc, free
+#include <string.h>  // for memcpy, size_t
+#include "aes.h"     // for AES_BLOCK_SIZE, aes_context_t, AES128_KEY_BYTES
+#include "n2n.h"     // for TRACE_ERROR, traceEvent
+#include "portable_endian.h"  // for be32toh, htobe32
 
 
 #if defined (HAVE_OPENSSL_1_1) // openSSL 1.1 ---------------------------------------------------------------------
diff --git a/src/auth.c b/src/auth.c
index c4422a2..b2d76cf 100644
--- a/src/auth.c
+++ b/src/auth.c
@@ -18,6 +18,11 @@
 
 
 #include "auth.h"
+#include <stdlib.h>      // for calloc, free
+#include <string.h>      // for strlen, size_t
+#include "curve25519.h"  // for curve25519
+#include "pearson.h"     // for pearson_hash_128, pearson_hash_256
+#include "speck.h"       // for speck_context_t, speck_128_encrypt, speck_init
 
 
 // mapping six binary bits to printable ascii character
diff --git a/src/cc20.c b/src/cc20.c
index 73fab8c..6a4ae1f 100644
--- a/src/cc20.c
+++ b/src/cc20.c
@@ -17,7 +17,11 @@
  */
 
 
+#include <stdlib.h>     // for calloc, free, size_t
+#include <string.h>     // for memcpy
 #include "cc20.h"
+#include "config.h"  // HAVE_OPENSSL_1_1
+#include "portable_endian.h"  // for htole32
 
 
 #if defined (HAVE_OPENSSL_1_1) // openSSL 1.1 ---------------------------------------------------------------------
@@ -84,6 +88,10 @@ int cc20_crypt (unsigned char *out, const unsigned char *in, size_t in_len,
 // https://github.com/Ginurx/chacha20-c (public domain)
 
 
+#include <immintrin.h>  // for _mm_xor_si128, _mm_add_epi32, _mm_slli_epi32
+#include <xmmintrin.h>  // for _MM_SHUFFLE
+
+
 #define SL  _mm_slli_epi32
 #define SR  _mm_srli_epi32
 #define XOR _mm_xor_si128
diff --git a/src/edge.c b/src/edge.c
index db4da65..d2c0288 100644
--- a/src/edge.c
+++ b/src/edge.c
@@ -16,7 +16,42 @@
  *
  */
 
-#include "n2n.h"
+
+#include <ctype.h>                   // for isspace
+#include <errno.h>                   // for errno
+#include <getopt.h>                  // for required_argument, no_argument
+#include <signal.h>                  // for signal, SIG_IGN, SIGPIPE, SIGCHLD
+#include <stdbool.h>
+#include <stdint.h>                  // for uint8_t, uint16_t
+#include <stdio.h>                   // for printf, NULL, fclose, snprintf
+#include <stdlib.h>                  // for atoi, exit, calloc, free, malloc
+#include <string.h>                  // for strncpy, memset, strlen, strcmp
+#include <sys/param.h>               // for MIN
+#include <sys/time.h>                // for timeval
+#include <sys/types.h>               // for u_char
+#include <time.h>                    // for time
+#include <unistd.h>                  // for setuid, _exit, chdir, fork, getgid
+#include "auth.h"                    // for generate_private_key, generate_p...
+#include "config.h"                  // for PACKAGE_BUILDDATE, PACKAGE_VERSION
+#include "n2n.h"                     // for n2n_edge_conf_t, n2n_edge_t, fil...
+#include "network_traffic_filter.h"  // for process_traffic_filter_rule_str
+#include "pearson.h"                 // for pearson_hash_64
+#include "portable_endian.h"         // for htobe32
+#include "random_numbers.h"          // for n2n_seed, n2n_srand
+#include "sn_selection.h"            // for sn_selection_sort, sn_selection_...
+#include "speck.h"                   // for speck_init, speck_context_t
+#include "uthash.h"                  // for UT_hash_handle, HASH_ADD, HASH_C...
+
+#ifdef WIN32
+#include <winsock.h>
+#include <ws2tcpip.h>
+#else
+#include <arpa/inet.h>               // for inet_addr, inet_ntop
+#include <netinet/in.h>              // for INADDR_ANY, INADDR_NONE, ntohl
+#include <pwd.h>                     // for getpwnam, passwd
+#include <sys/select.h>              // for select, FD_ISSET, FD_SET, FD_ZERO
+#include <sys/socket.h>              // for AF_INET
+#endif
 
 /* *************************************************** */
 
@@ -32,7 +67,6 @@
 
 #include <sys/capability.h>
 #include <sys/prctl.h>
-#include "network_traffic_filter.h"
 
 static cap_value_t cap_values[] = {
     //CAP_NET_RAW,            /* Use RAW and PACKET sockets */
diff --git a/src/edge_management.c b/src/edge_management.c
index ed329d5..53e0b6f 100644
--- a/src/edge_management.c
+++ b/src/edge_management.c
@@ -16,11 +16,34 @@
  *
  */
 
-#include "n2n.h"
-#include "edge_utils_win32.h"
+#include "n2n.h"           // for n2n_edge_t, peer_info, getTraceLevel, N2N_...
+// FIXME: if this headers is sorted alphabetically, the test_integration_edge
+// fails with what looks like a struct rearrangement involving eee->stats
 
-#include "strbuf.h"
-#include "management.h"
+#include <errno.h>         // for errno
+#include <stdbool.h>
+#include <stdint.h>        // for uint32_t
+#include <stdio.h>         // for snprintf, size_t, NULL
+#include <string.h>        // for memcmp, memcpy, strerror, strncpy
+#include <sys/types.h>     // for ssize_t
+#include <time.h>          // for time, time_t
+#include "config.h"        // for PACKAGE_VERSION
+#include "management.h"    // for mgmt_req_t, send_reply, send_json_1str
+#include "n2n_define.h"    // for N2N_PKT_BUF_SIZE, N2N_EVENT_DEBUG, N2N_EVE...
+#include "n2n_typedefs.h"  // for n2n_edge_t, peer_info, n2n_edge_conf_t
+#include "sn_selection.h"  // for sn_selection_criterion_str, selection_crit...
+#include "strbuf.h"        // for strbuf_t, STRBUF_INIT
+#include "uthash.h"        // for UT_hash_handle, HASH_ITER
+
+#ifdef WIN32
+#include <winsock.h>
+#include <ws2tcpip.h>
+#include "edge_utils_win32.h"
+#else
+#include <arpa/inet.h>     // for inet_ntoa
+#include <netinet/in.h>    // for in_addr, htonl, in_addr_t
+#include <sys/socket.h>    // for sendto, recvfrom, sockaddr_storage
+#endif
 
 size_t event_debug (strbuf_t *buf, char *tag, int data0, void *data1) {
     traceEvent(TRACE_DEBUG, "Unexpected call to event_debug");
diff --git a/src/edge_utils.c b/src/edge_utils.c
index 2dd888b..8d6568a 100644
--- a/src/edge_utils.c
+++ b/src/edge_utils.c
@@ -16,9 +16,41 @@
  *
  */
 
-#include "n2n.h"
-#include "network_traffic_filter.h"
+
+#include <errno.h>                   // for errno, EAFNOSUPPORT, EINPROGRESS
+#include <fcntl.h>                   // for fcntl, F_SETFL, O_NONBLOCK
+#include <stdbool.h>
+#include <stdint.h>                  // for uint8_t, uint16_t, uint32_t, uin...
+#include <stdio.h>                   // for snprintf, sprintf
+#include <stdlib.h>                  // for free, calloc, getenv
+#include <string.h>                  // for memcpy, memset, NULL, memcmp
+#include <sys/time.h>                // for timeval
+#include <sys/types.h>               // for time_t, ssize_t, u_int
+#include <time.h>                    // for time
+#include <unistd.h>                  // for gethostname, sleep
+#include "auth.h"                    // for generate_private_key
+#include "portable_endian.h"         // for be16toh, htobe16
+#include "header_encryption.h"       // for packet_header_encrypt, packet_he...
+#include "n2n.h"                     // for n2n_edge_t, peer_info, n2n_edge_...
+#include "n2n_wire.h"                // for encode_mac, fill_sockaddr, decod...
+#include "network_traffic_filter.h"  // for create_network_traffic_filter
+#include "pearson.h"                 // for pearson_hash_128, pearson_hash_64
+#include "random_numbers.h"          // for n2n_rand, n2n_rand_sqr
+#include "sn_selection.h"            // for sn_selection_criterion_common_da...
+#include "speck.h"                   // for speck_128_decrypt, speck_128_enc...
+#include "uthash.h"                  // for UT_hash_handle, HASH_COUNT, HASH...
+
+#ifdef WIN32
+#include <winsock.h>
+#include <ws2tcpip.h>
 #include "edge_utils_win32.h"
+#else
+#include <arpa/inet.h>               // for inet_ntoa, inet_addr, inet_ntop
+#include <netinet/in.h>              // for sockaddr_in, ntohl, IPPROTO_IP
+#include <netinet/tcp.h>             // for TCP_NODELAY
+#include <sys/select.h>              // for select, FD_SET, FD_ISSET, FD_ZERO
+#include <sys/socket.h>              // for setsockopt, AF_INET, connect
+#endif
 
 
 /* ************************************** */
diff --git a/src/example_edge_embed.c b/src/example_edge_embed.c
index 2784d78..2b32269 100644
--- a/src/example_edge_embed.c
+++ b/src/example_edge_embed.c
@@ -16,7 +16,12 @@
  *
  */
 
-#include "n2n.h"
+
+#include <stdbool.h>
+#include <stdio.h>   // for snprintf, NULL
+#include <stdlib.h>  // for exit
+#include "n2n.h"     // for n2n_edge_conf_t, edge_conf_add_supernode, edge_init
+
 
 static bool keep_running = true;
 
diff --git a/src/example_edge_embed_quick_edge_init.c b/src/example_edge_embed_quick_edge_init.c
index 65da193..525795c 100644
--- a/src/example_edge_embed_quick_edge_init.c
+++ b/src/example_edge_embed_quick_edge_init.c
@@ -16,7 +16,11 @@
  *
  */
 
-#include "n2n.h"
+
+#include <stdbool.h>
+#include "n2n.h"             // for quick_edge_init, setTraceLevel
+#include "random_numbers.h"  // for n2n_seed, n2n_srand
+
 
 /*
     This tool demonstrates how to easily embed
diff --git a/src/example_sn_embed.c b/src/example_sn_embed.c
index 52356be..713d068 100644
--- a/src/example_sn_embed.c
+++ b/src/example_sn_embed.c
@@ -16,7 +16,17 @@
  *
  */
 
-#include "n2n.h"
+
+#include <stdbool.h>
+#include <stdlib.h>      // for exit
+#include "n2n.h"         // for n2n_sn_t, open_socket, run_sn_loop, sn_init
+
+#ifdef WIN32
+#include <winsock.h>
+#else
+#include <netinet/in.h>  // for INADDR_ANY, INADDR_LOOPBACK
+#endif
+
 
 static bool keep_running = true;
 
diff --git a/src/header_encryption.c b/src/header_encryption.c
index 5511557..0cf2e02 100644
--- a/src/header_encryption.c
+++ b/src/header_encryption.c
@@ -17,7 +17,18 @@
  */
 
 
-#include "n2n.h"
+#include <stdint.h>             // for uint32_t, uint8_t, uint64_t, uint16_t
+#include <stdlib.h>             // for calloc
+#include <string.h>             // for memcpy
+#include "header_encryption.h"  // for packet_header_change_dynamic_key, pac...
+#include "n2n.h"                // for he_context_t, N2N_COMMUNITY_SIZE, TRA...
+#include "n2n_define.h"         // for N2N_COMMUNITY_SIZE
+#include "n2n_typedefs.h"       // for he_context_t, N2N_AUTH_CHALLENGE_SIZE
+#include "pearson.h"            // for pearson_hash_128, pearson_hash_64
+#include "portable_endian.h"    // for htobe32, be32toh, be64toh, htobe64
+#include "random_numbers.h"     // for n2n_rand
+#include "speck.h"              // for speck_init, speck_context_t, speck_ctr
+#include "uthash.h"             // for HASH_FIND_STR
 
 
 #define HASH_FIND_COMMUNITY(head, name, out) HASH_FIND_STR(head, name, out)
diff --git a/src/hexdump.c b/src/hexdump.c
index a9cbd00..3692a85 100644
--- a/src/hexdump.c
+++ b/src/hexdump.c
@@ -16,10 +16,11 @@
  *
  */
 
-#include <stdio.h>
 
-#include "n2n.h"
-#include "hexdump.h"
+#include <stdint.h>   // for uint8_t
+#include <stdio.h>    // for fprintf, FILE
+#include "hexdump.h"  // for fhexdump
+
 
 void fhexdump(unsigned int display_addr, void *in, int size, FILE *stream) {
   uint8_t *p = in;
diff --git a/src/json.c b/src/json.c
index d048b36..1aaab41 100644
--- a/src/json.c
+++ b/src/json.c
@@ -23,6 +23,8 @@
 // https://github.com/forkachild/C-Simple-JSON-Parser/issues/3#issuecomment-1073520808
 
 
+#include <stdlib.h>  // for malloc, free, NULL, atof, realloc
+#include <string.h>  // for memcpy
 #include "json.h"
 
 
diff --git a/src/management.c b/src/management.c
index 73da48a..70a3b4f 100644
--- a/src/management.c
+++ b/src/management.c
@@ -3,21 +3,25 @@
  *
  */
 
-#include <stdio.h>
+
+#include <pearson.h>     // for pearson_hash_64
+#include <stdbool.h>
+#include <stdio.h>       // for snprintf, NULL, size_t
+#include <stdlib.h>      // for strtoul
+#include <string.h>      // for strtok, strlen, strncpy
+#include "management.h"
+#include "n2n.h"         // for TRACE_DEBUG, traceEvent
+
 #ifndef WIN32
-#include <sys/socket.h>
-#include <netdb.h>
+#include <netdb.h>       // for getnameinfo, NI_NUMERICHOST, NI_NUMERICSERV
+#include <sys/socket.h>  // for sendto, sockaddr
 #endif
 
+
 // TODO: move logging defs in their own header and include that
 void setTraceLevel (int level);
 int getTraceLevel ();
 
-#include <pearson.h>
-#include "management.h"
-
-#include "n2n.h"    // for traceEvent and friends
-
 ssize_t send_reply (mgmt_req_t *req, strbuf_t *buf, size_t msg_len) {
     // TODO: better error handling (counters?)
     return sendto(req->mgmt_sock, buf->str, msg_len, 0,
diff --git a/src/management.h b/src/management.h
index 9932df1..3e95458 100644
--- a/src/management.h
+++ b/src/management.h
@@ -8,10 +8,20 @@
 #ifndef MANAGEMENT_H
 #define MANAGEMENT_H 1
 
-#include <n2n_typedefs.h>   // For the n2n_edge_t and n2n_sn_t defs
-
+#include <n2n_typedefs.h>  // For the n2n_edge_t and n2n_sn_t defs
+#include <stdbool.h>
+#include <stddef.h>        // for size_t
+#include <stdint.h>        // for uint64_t
+#include <sys/types.h>     // for ssize_t
+#include "n2n_define.h"    // for n2n_event_topic
 #include "strbuf.h"
 
+#ifdef WIN32
+#include <winsock.h>
+#else
+#include <sys/socket.h>    // for sockaddr, sockaddr_storage, socklen_t
+#endif
+
 enum n2n_mgmt_type {
     N2N_MGMT_UNKNOWN = 0,
     N2N_MGMT_READ = 1,
diff --git a/src/n2n.c b/src/n2n.c
index 99d2a26..c5a65ad 100644
--- a/src/n2n.c
+++ b/src/n2n.c
@@ -16,14 +16,30 @@
  *
  */
 
+
+#include <errno.h>           // for errno
+#include <stdarg.h>          // for va_end, va_list, va_start
+#include <stdbool.h>
+#include <stdlib.h>          // for free, atoi, calloc, strtol
+#include <string.h>          // for memcmp, memcpy, memset, strlen, strerror
+#include <sys/time.h>        // for gettimeofday, timeval
+#include <time.h>            // for time, localtime, strftime
+#include "config.h"          // for PACKAGE_BUILDDATE, PACKAGE_OSNAME, PACKA...
 #include "n2n.h"
+#include "random_numbers.h"  // for n2n_rand
+#include "sn_selection.h"    // for sn_selection_criterion_default
+#include "uthash.h"          // for UT_hash_handle, HASH_DEL, HASH_ITER, HAS...
 
-#include "sn_selection.h"
-
-#include "minilzo.h"
-
-#include <assert.h>
-
+#ifdef WIN32
+#include <winsock.h>
+#include <ws2def.h>
+#include <ws2tcpip.h>
+#else
+#include <arpa/inet.h>       // for inet_ntop
+#include <netdb.h>           // for addrinfo, freeaddrinfo, gai_strerror
+#include <sys/socket.h>      // for AF_INET, PF_INET, bind, setsockopt, shut...
+#include <syslog.h>          // for closelog, openlog, syslog, LOG_DAEMON
+#endif
 
 
 /* ************************************** */
diff --git a/src/n2n_port_mapping.c b/src/n2n_port_mapping.c
index 35d1670..a5a057f 100644
--- a/src/n2n_port_mapping.c
+++ b/src/n2n_port_mapping.c
@@ -54,7 +54,8 @@
  */
 
 
-#include "n2n.h"
+#include <stdint.h>            // for uint16_t
+#include "n2n_port_mapping.h"  // for n2n_del_port_mapping, n2n_set_port_map...
 
 
 #ifdef HAVE_MINIUPNP
diff --git a/src/n2n_regex.c b/src/n2n_regex.c
index 6539451..49e6965 100644
--- a/src/n2n_regex.c
+++ b/src/n2n_regex.c
@@ -49,8 +49,12 @@
  */
 
 
-#include "n2n.h"
-#include "n2n_regex.h"
+#include <stdio.h>         // for printf
+#include <stdlib.h>        // for calloc, free
+#include <string.h>        // for memcpy
+#include "n2n_typedefs.h"  // for re_t
+#include "n2n_regex.h"     // for re_compile, re_match, re_matchp
+
 
 /* Definitions: */
 
diff --git a/src/network_traffic_filter.c b/src/network_traffic_filter.c
index dfdb54d..fc8b4c1 100644
--- a/src/network_traffic_filter.c
+++ b/src/network_traffic_filter.c
@@ -16,9 +16,22 @@
  *
  */
 
-#include "n2n.h"
-#include "network_traffic_filter.h"
-#include "uthash.h"
+
+#include <stdint.h>                  // for uint8_t, uint16_t, uint32_t
+#include <stdio.h>                   // for sprintf
+#include <stdlib.h>                  // for free, malloc, atoi
+#include <string.h>                  // for memcpy, strcpy, NULL, memset
+#include "n2n.h"                     // for filter_rule_t, filter_rule_pair_...
+#include "network_traffic_filter.h"  // for create_network_traffic_filter
+#include "uthash.h"                  // for UT_hash_handle, HASH_ITER, HASH_DEL
+
+#ifdef WIN32
+#include <winsock.h>
+#include <ws2tcpip.h>
+#else
+#include <arpa/inet.h>               // for inet_ntoa, inet_addr
+#include <netinet/in.h>              // for in_addr, in_addr_t, ntohs, ntohl
+#endif
 
 // cache that hit less than 10 while 10000 package processed will be delete;
 #define CLEAR_CACHE_EVERY_X_COUNT 10000
diff --git a/src/pearson.c b/src/pearson.c
index 4852b43..bf0273a 100644
--- a/src/pearson.c
+++ b/src/pearson.c
@@ -22,6 +22,7 @@
 
 
 #include "pearson.h"
+#include "portable_endian.h"  // for le64toh, htobe64
 
 
 // Christopher Wellons' triple32 from https://github.com/skeeto/hash-prospector
diff --git a/src/random_numbers.c b/src/random_numbers.c
index 0828f22..ed6ca8c 100644
--- a/src/random_numbers.c
+++ b/src/random_numbers.c
@@ -17,6 +17,11 @@
  */
 
 
+#include <errno.h>   // for errno, EAGAIN
+#include <stddef.h>  // for NULL, size_t
+#include <time.h>    // for clock, time
+#include <unistd.h>  // for syscall
+#include "n2n.h"     // for TRACE_ERROR, traceEvent
 #include "random_numbers.h"
 
 
diff --git a/src/sn_management.c b/src/sn_management.c
index b84db5a..3dae672 100644
--- a/src/sn_management.c
+++ b/src/sn_management.c
@@ -21,11 +21,27 @@
  * code.  In the fullness of time, they should both be merged
  */
 
-#include "n2n.h"
-#include "edge_utils_win32.h"
 
-#include "strbuf.h"
-#include "management.h"
+#include <errno.h>       // for errno
+#include <stdbool.h>
+#include <stdint.h>      // for uint8_t, uint32_t
+#include <stdio.h>       // for snprintf, size_t, sprintf, NULL
+#include <string.h>      // for memcmp, memcpy, strerror, strncpy
+#include <sys/types.h>   // for ssize_t, time_t
+#include "management.h"  // for mgmt_req_t, send_reply, mgmt_handler_t, mgmt...
+#include "n2n.h"         // for n2n_sn_t, sn_community, peer_info, N2N_SN_PK...
+#include "n2n_define.h"    // for N2N_SN_PKTBUF_SIZE, UNPURGEABLE
+#include "n2n_typedefs.h"  // for n2n_sn_t, sn_community, peer_info, sn_stats_t
+#include "strbuf.h"      // for strbuf_t, STRBUF_INIT
+#include "uthash.h"      // for UT_hash_handle, HASH_ITER, HASH_COUNT
+
+#ifdef WIN32
+#include <winsock.h>
+#include "edge_utils_win32.h"
+#else
+#include <sys/socket.h>  // for sendto, socklen_t
+#endif
+
 
 int load_allowed_sn_community (n2n_sn_t *sss); /* defined in sn_utils.c */
 
diff --git a/src/sn_selection.c b/src/sn_selection.c
index 0c865ee..6ad3962 100644
--- a/src/sn_selection.c
+++ b/src/sn_selection.c
@@ -17,7 +17,13 @@
  */
 
 
-#include "n2n.h"
+#include <stdint.h>           // for UINT64_MAX, uint32_t, int64_t, uint64_t
+#include <stdio.h>            // for snprintf, NULL
+#include <string.h>           // for memcpy, memset
+#include "n2n.h"              // for peer_info_t, n2n_edge_t, SN_SELECTION_CRIT...
+#include "portable_endian.h"  // for be32toh, be64toh, htobe64
+#include "sn_selection.h"     // for selection_criterion_str_t, sn_selection_cr...
+#include "uthash.h"           // for UT_hash_handle, HASH_COUNT, HASH_ITER, HAS...
 
 
 static SN_SELECTION_CRITERION_DATA_TYPE sn_selection_criterion_common_read (n2n_edge_t *eee);
diff --git a/src/sn_utils.c b/src/sn_utils.c
index 8bba52b..9b57f58 100644
--- a/src/sn_utils.c
+++ b/src/sn_utils.c
@@ -16,7 +16,41 @@
  *
  */
 
-#include "n2n.h"
+
+#include <errno.h>              // for errno, EAFNOSUPPORT
+#include <stdbool.h>
+#include <stdint.h>             // for uint8_t, uint32_t, uint16_t, uint64_t
+#include <stdio.h>              // for sscanf, snprintf, fclose, fgets, fopen
+#include <stdlib.h>             // for free, calloc, getenv
+#include <string.h>             // for memcpy, NULL, memset, size_t, strerror
+#include <sys/param.h>          // for MAX
+#include <sys/time.h>           // for timeval
+#include <sys/types.h>          // for ssize_t
+#include <time.h>               // for time_t, time
+#include "auth.h"               // for ascii_to_bin, calculate_dynamic_key
+#include "config.h"             // for PACKAGE_VERSION
+#include "header_encryption.h"  // for packet_header_encrypt, packet_header_...
+#include "n2n.h"                // for sn_community, n2n_sn_t, peer_info
+#include "n2n_regex.h"          // for re_matchp, re_compile
+#include "n2n_wire.h"           // for encode_buf, encode_PEER_INFO, encode_...
+#include "pearson.h"            // for pearson_hash_128, pearson_hash_32
+#include "portable_endian.h"    // for be16toh, htobe16
+#include "random_numbers.h"     // for n2n_rand, n2n_rand_sqr, n2n_seed, n2n...
+#include "sn_selection.h"       // for sn_selection_criterion_gather_data
+#include "speck.h"              // for speck_128_encrypt, speck_context_t
+#include "uthash.h"             // for UT_hash_handle, HASH_ITER, HASH_DEL
+
+#ifdef WIN32
+#include <winsock.h>
+#include <ws2tcpip.h>
+#else
+#include <arpa/inet.h>          // for inet_addr, inet_ntoa
+#include <netinet/in.h>         // for ntohl, in_addr_t, sockaddr_in, INADDR...
+#include <netinet/tcp.h>        // for TCP_NODELAY
+#include <sys/select.h>         // for FD_ISSET, FD_SET, select, FD_SETSIZE
+#include <sys/socket.h>         // for recvfrom, shutdown, sockaddr_storage
+#endif
+
 
 #define HASH_FIND_COMMUNITY(head, name, out) HASH_FIND_STR(head, name, out)
 
diff --git a/src/speck.c b/src/speck.c
index 4c43003..1a2574a 100644
--- a/src/speck.c
+++ b/src/speck.c
@@ -23,7 +23,12 @@
 
 
 #include "speck.h"
+#include "portable_endian.h"  // for htole64, le64toh
+#include <stdlib.h>     // for size_t, malloc, free
 
+#if defined (SPECK_ALIGNED_CTX)
+#include <mm_malloc.h>  // for _mm_free, _mm_malloc
+#endif
 
 #if defined (__AVX512F__)  // AVX512 support ----------------------------------------------------------------------
 
diff --git a/src/supernode.c b/src/supernode.c
index 595c0bd..1c640f1 100644
--- a/src/supernode.c
+++ b/src/supernode.c
@@ -18,8 +18,32 @@
 
 /* Supernode for n2n-2.x */
 
-#include "n2n.h"
-#include "header_encryption.h"
+
+#include <ctype.h>             // for isspace
+#include <errno.h>             // for errno
+#include <getopt.h>            // for required_argument, getopt_long, no_arg...
+#include <signal.h>            // for signal, SIGHUP, SIGINT, SIGPIPE, SIGTERM
+#include <stdbool.h>
+#include <stdint.h>            // for uint8_t, uint32_t
+#include <stdio.h>             // for printf, NULL, fclose, fgets, fopen
+#include <stdlib.h>            // for exit, atoi, calloc, free
+#include <string.h>            // for strerror, strlen, memcpy, strncpy, str...
+#include <sys/types.h>         // for time_t, u_char, u_int
+#include <time.h>              // for time
+#include <unistd.h>            // for _exit, daemon, getgid, getuid, setgid
+#include "n2n.h"               // for n2n_sn_t, sn_community, traceEvent
+#include "pearson.h"           // for pearson_hash_64
+#include "uthash.h"            // for UT_hash_handle, HASH_ITER, HASH_ADD_STR
+
+#ifdef WIN32
+#include <winsock.h>
+#include <ws2tcpip.h>
+#else
+#include <arpa/inet.h>         // for inet_addr
+#include <netinet/in.h>        // for ntohl, INADDR_ANY, INADDR_NONE, in_addr_t
+#include <pwd.h>               // for getpwnam, passwd
+#include <sys/socket.h>        // for listen, AF_INET
+#endif
 
 #define HASH_FIND_COMMUNITY(head, name, out) HASH_FIND_STR(head, name, out)
 
diff --git a/src/tf.c b/src/tf.c
index 793c527..f27e903 100644
--- a/src/tf.c
+++ b/src/tf.c
@@ -48,6 +48,8 @@
 
 
 #include "tf.h"
+#include "portable_endian.h"  // for le32toh, htole32
+#include <string.h>  // for memcpy
 
 
 const uint8_t RS[4][8] = { { 0x01, 0xA4, 0x55, 0x87, 0x5A, 0x58, 0xDB, 0x9E, },
diff --git a/src/transform_aes.c b/src/transform_aes.c
index 3a285c7..4abf686 100644
--- a/src/transform_aes.c
+++ b/src/transform_aes.c
@@ -17,7 +17,15 @@
  */
 
 
-#include "n2n.h"
+#include <stdint.h>          // for uint8_t
+#include <stdlib.h>          // for calloc, free
+#include <string.h>          // for memcpy, size_t, memset, memcmp, strlen
+#include <sys/types.h>       // for u_char, ssize_t, time_t
+#include "aes.h"             // for AES_BLOCK_SIZE, aes_cbc_decrypt, aes_cbc...
+#include "n2n.h"             // for n2n_trans_op_t, traceEvent, TRACE_ERROR
+#include "n2n_wire.h"        // for encode_uint64, encode_buf
+#include "pearson.h"         // for pearson_hash_256
+#include "random_numbers.h"  // for n2n_rand
 
 
 // size of random value prepended to plaintext defaults to AES BLOCK_SIZE;
diff --git a/src/transform_cc20.c b/src/transform_cc20.c
index fe6eb8b..6cc8c8e 100644
--- a/src/transform_cc20.c
+++ b/src/transform_cc20.c
@@ -17,7 +17,15 @@
  */
 
 
-#include "n2n.h"
+#include <stdint.h>          // for uint8_t
+#include <stdlib.h>          // for size_t, calloc, free
+#include <string.h>          // for memset, strlen
+#include <sys/types.h>       // for u_char, ssize_t, time_t
+#include "cc20.h"            // for CC20_IV_SIZE, cc20_crypt, cc20_deinit
+#include "n2n.h"             // for n2n_trans_op_t, traceEvent, TRACE_ERROR
+#include "n2n_wire.h"        // for encode_uint64
+#include "pearson.h"         // for pearson_hash_256
+#include "random_numbers.h"  // for n2n_rand
 
 
 // ChaCha20 plaintext preamble
diff --git a/src/transform_lzo.c b/src/transform_lzo.c
index 69a1eff..ef6af55 100644
--- a/src/transform_lzo.c
+++ b/src/transform_lzo.c
@@ -17,7 +17,12 @@
  */
 
 
-#include "n2n.h"
+#include <stdint.h>     // for uint8_t
+#include <stdlib.h>     // for size_t, calloc, free, NULL
+#include <string.h>     // for memset
+#include <sys/types.h>  // for time_t
+#include "minilzo.h"    // for lzo1x_1_compress, lzo1x_decompress, LZO1X_1_M...
+#include "n2n.h"        // for n2n_trans_op_t, TRACE_ERROR, traceEvent, N2N_...
 
 
 /* heap allocation for compression as per lzo example doc  */
diff --git a/src/transform_null.c b/src/transform_null.c
index cc3cbf3..50e06a8 100644
--- a/src/transform_null.c
+++ b/src/transform_null.c
@@ -17,7 +17,10 @@
  */
 
 
-#include "n2n.h"
+#include <stdint.h>     // for uint8_t
+#include <string.h>     // for memcpy, size_t, memset
+#include <sys/types.h>  // for time_t
+#include "n2n.h"        // for n2n_trans_op_t, TRACE_DEBUG, traceEvent, N2N_...
 
 
 static int transop_deinit_null (n2n_trans_op_t *arg ) {
diff --git a/src/transform_speck.c b/src/transform_speck.c
index a633844..7e79367 100644
--- a/src/transform_speck.c
+++ b/src/transform_speck.c
@@ -17,7 +17,15 @@
  */
 
 
-#include "n2n.h"
+#include <stdint.h>          // for uint8_t
+#include <stdlib.h>          // for size_t, calloc, free
+#include <string.h>          // for memset, strlen
+#include <sys/types.h>       // for u_char, ssize_t, time_t
+#include "n2n.h"             // for n2n_trans_op_t, traceEvent, TRACE_DEBUG
+#include "n2n_wire.h"        // for encode_uint64
+#include "pearson.h"         // for pearson_hash_256
+#include "random_numbers.h"  // for n2n_rand
+#include "speck.h"           // for N2N_SPECK_IVEC_SIZE, speck_ctr, speck_de...
 
 
 // Speck plaintext preamble
diff --git a/src/transform_tf.c b/src/transform_tf.c
index 2900639..478fed7 100644
--- a/src/transform_tf.c
+++ b/src/transform_tf.c
@@ -17,7 +17,15 @@
  */
 
 
-#include "n2n.h"
+#include <stdint.h>          // for uint8_t
+#include <stdlib.h>          // for calloc, free
+#include <string.h>          // for memcpy, size_t, memset, memcmp, strlen
+#include <sys/types.h>       // for u_char, ssize_t, time_t
+#include "n2n.h"             // for n2n_trans_op_t, traceEvent, TRACE_ERROR
+#include "n2n_wire.h"        // for encode_uint64, encode_buf
+#include "pearson.h"         // for pearson_hash_256
+#include "random_numbers.h"  // for n2n_rand
+#include "tf.h"              // for TF_BLOCK_SIZE, tf_cbc_decrypt, tf_cbc_en...
 
 
 // size of random value prepended to plaintext defaults to TF_BLOCK_SIZE;
diff --git a/src/transform_zstd.c b/src/transform_zstd.c
index c39ec3b..33aef23 100644
--- a/src/transform_zstd.c
+++ b/src/transform_zstd.c
@@ -17,12 +17,15 @@
  */
 
 
-#include "n2n.h"
+#include "config.h"  // for HAVE_ZSTD
 
 
 #ifdef HAVE_ZSTD
 
 
+#include "n2n.h"
+
+
 typedef struct transop_zstd {
     // no local data
 } transop_zstd_t;
diff --git a/src/tuntap_linux.c b/src/tuntap_linux.c
index 75bda23..863684f 100644
--- a/src/tuntap_linux.c
+++ b/src/tuntap_linux.c
@@ -20,7 +20,23 @@
 #ifdef __linux__
 
 
-#include "n2n.h"
+#include <arpa/inet.h>                // for inet_addr, inet_pton
+#include <sys/uio.h>                  // for iovec
+#include <errno.h>                    // for errno
+#include <fcntl.h>                    // for open, O_RDWR
+#include <linux/if_tun.h>             // for IFF_NO_PI, IFF_TAP, TUNSETIFF
+#include <linux/netlink.h>            // for sockaddr_nl, nlmsghdr, NETLINK_...
+#include <linux/rtnetlink.h>          // for ifinfomsg, RTMGRP_LINK
+#include <net/if.h>                   // for ifreq, IFNAMSIZ, ifr_name, ifr_...
+#include <net/if_arp.h>               // for ARPHRD_ETHER
+#include <netinet/in.h>               // for sockaddr_in, IPPROTO_IP, in_addr
+#include <stdint.h>                   // for uint8_t
+#include <string.h>                   // for strerror, memset, strncpy, memcpy
+#include <sys/ioctl.h>                // for ioctl, SIOCGIFADDR, SIOCGIFFLAGS
+#include <sys/param.h>                // for MIN
+#include <sys/socket.h>               // for socket, msghdr, AF_INET, sockaddr
+#include <unistd.h>                   // for close, getpid, read, write, ssi...
+#include "n2n.h"                      // for tuntap_dev, traceEvent, TRACE_E...
 
 
 static int setup_ifname (int fd, const char *ifname, const char *ipaddr,
diff --git a/src/tuntap_osx.c b/src/tuntap_osx.c
index 6d4092d..e46755d 100644
--- a/src/tuntap_osx.c
+++ b/src/tuntap_osx.c
@@ -17,6 +17,7 @@
  */
 
 
+#include <fcntl.h>
 #include "n2n.h"
 
 
diff --git a/src/wire.c b/src/wire.c
index 332c2d2..af1011f 100644
--- a/src/wire.c
+++ b/src/wire.c
@@ -26,7 +26,21 @@
  *  example.
  */
 
-#include "n2n.h"
+
+#include <stdint.h>      // for uint8_t, uint16_t, uint32_t, uint64_t
+#include <string.h>      // for size_t, memset, memcpy
+#include "portable_endian.h"  // for be64toh, htobe64
+#include "n2n.h"         // for n2n_sock_t, n2n_common_t, n2n_auth_t, n2n_RE...
+#include "n2n_wire.h"    // for decode_PACKET, decode_PEER_INFO, decode_QUER...
+
+#ifdef WIN32
+#include <winsock.h>
+#include <ws2tcpip.h>
+#else
+#include <netinet/in.h>  // for sockaddr_in, sockaddr_in6, in6_addr, in_addr
+#include <sys/socket.h>  // for AF_INET, AF_INET6, SOCK_STREAM, SOCK_DGRAM
+#include <sys/un.h>      // for sa_family_t
+#endif
 
 
 int encode_uint8 (uint8_t * base,
diff --git a/tools/n2n-benchmark.c b/tools/n2n-benchmark.c
index b4a3c95..8a4f8fd 100644
--- a/tools/n2n-benchmark.c
+++ b/tools/n2n-benchmark.c
@@ -16,13 +16,22 @@
  *
  */
 
+
+#include <stdint.h>      // for uint8_t, uint64_t
+#include <stdio.h>       // for printf, fflush, size_t, NULL, stdout
+#include <string.h>      // for memset, memcpy, memcmp, strncpy
+#include <sys/types.h>   // for ssize_t
+#include "curve25519.h"  // for curve25519
+#include "n2n.h"         // for n2n_trans_op_t, n2n_common_t, n2n_edge_conf_t
+#include "n2n_wire.h"    // for decode_PACKET, decode_common, encode_PACKET
+#include "pearson.h"     // for pearson_hash_64, pearson_hash_init
+
 #ifndef _MSC_VER
 /* MinGW has undefined function gettimeofday() warnings without this header
  * but Visual C++ doesnt even have the header */
-#include <sys/time.h>
+#include <sys/time.h>    // for gettimeofday, timeval
 #endif
 
-#include "n2n.h"
 
 #define DURATION                2.5   // test duration per algorithm
 #define PACKETS_BEFORE_GETTIME  2047  // do not check time after every packet but after (2 ^ n - 1)
diff --git a/tools/n2n-decode.c b/tools/n2n-decode.c
index 94b14d6..cf5844b 100644
--- a/tools/n2n-decode.c
+++ b/tools/n2n-decode.c
@@ -16,8 +16,11 @@
  *
  */
 
+#include <errno.h>             // for errno
 #include <pcap.h>
+#include <signal.h>            // for signal, SIGINT, SIGTERM
 #include "n2n.h"
+#include "n2n_wire.h"
 
 #define SNAPLEN 1500
 #define TIMEOUT 200
diff --git a/tools/n2n-keygen.c b/tools/n2n-keygen.c
index 3ce25f9..233256d 100644
--- a/tools/n2n-keygen.c
+++ b/tools/n2n-keygen.c
@@ -17,7 +17,11 @@
  */
 
 
-#include "n2n.h"
+#include <stdint.h>  // for uint8_t
+#include <stdio.h>   // for fprintf, stdout, stderr
+#include <string.h>  // for memset, strcmp
+#include "auth.h"    // for bin_to_ascii, bind_private_key_to_username, gene...
+#include "n2n.h"     // for n2n_private_public_key_t, N2N_USER_KEY_LINE_STARTER
 
 
 int main(int argc, char * argv[]) {
diff --git a/tools/n2n-portfwd.c b/tools/n2n-portfwd.c
index a52fdbf..89dabcc 100644
--- a/tools/n2n-portfwd.c
+++ b/tools/n2n-portfwd.c
@@ -17,8 +17,30 @@
  */
 
 
-#include "n2n.h"
+#include <getopt.h>            // for getopt_long
+#include <unistd.h>            // for optarg
+#include <signal.h>            // for signal, SIGINT, SIGPIPE, SIGTERM, SIG_IGN
+#include <stdbool.h>
+#include <stdint.h>            // for uint16_t, uint32_t, uint8_t
+#include <stdio.h>             // for printf, snprintf
+#include <stdlib.h>            // for NULL, atoi, exit, size_t
+#include <string.h>            // for strchr, strcmp
+#include <sys/time.h>          // for timeval
+#include <time.h>              // for time, time_t
+#include <unistd.h>            // for STDIN_FILENO, _exit
+#include "json.h"              // for _jsonpair, json_object_t, json_free
+#include "n2n.h"               // for traceEvent, setTraceLevel, getTraceLevel
+#include "n2n_port_mapping.h"  // for n2n_del_port_mapping, n2n_set_port_map...
+#include "random_numbers.h"    // for n2n_rand, n2n_seed, n2n_srand
 
+#ifdef WIN32
+#include <winsock.h>
+#include <ws2tcpip.h>
+#else
+#include <netinet/in.h>        // for sockaddr_in, htonl, htons, INADDR_LOOP...
+#include <sys/select.h>        // for select, FD_ISSET, FD_SET, FD_ZERO, fd_set
+#include <sys/socket.h>        // for connect, recv, send, socket, AF_INET
+#endif
 
 #define WITH_PORT               1
 #define CORRECT_TAG             2
diff --git a/tools/n2n-route.c b/tools/n2n-route.c
index 9898f5d..a7d3cdd 100644
--- a/tools/n2n-route.c
+++ b/tools/n2n-route.c
@@ -17,8 +17,39 @@
  */
 
 
-#include "n2n.h"
+#include <errno.h>             // for errno
+#include <getopt.h>            // for getopt_long, optind, optarg
+#include <signal.h>            // for signal, SIGINT, SIGPIPE, SIGTERM, SIG_IGN
+#include <stdbool.h>
+#include <stdint.h>            // for uint8_t, uint16_t, uint32_t
+#include <stdio.h>             // for snprintf, printf, sscanf
+#include <stdlib.h>            // for calloc, free, atoi, EXIT_FAILURE, exit
+#include <string.h>            // for memset, NULL, memcmp, strchr, strcmp
+#include <sys/time.h>          // for timeval
+#include <time.h>              // for time, time_t
+#include <unistd.h>            // for getpid, STDIN_FILENO, _exit, geteuid
+#include "json.h"              // for _jsonpair, json_object_t, _jsonvalue
+#include "n2n.h"               // for inaddrtoa, traceEvent, TRACE_WARNING
+#include "random_numbers.h"    // for n2n_rand, n2n_seed, n2n_srand
+#include "uthash.h"            // for UT_hash_handle, HASH_ADD, HASH_DEL
 
+#ifdef __linux__
+#include <linux/netlink.h>     // for nlmsghdr, NLMSG_OK, NETLINK_ROUTE, NLM...
+#include <linux/rtnetlink.h>   // for RTA_DATA, rtmsg, RTA_GATEWAY, RTA_NEXT
+#endif
+
+#ifdef WIN32
+#include <winsock.h>
+#include <ws2tcpip.h>
+#else
+#include <arpa/inet.h>         // for inet_pton
+#include <net/if.h>            // for if_indextoname
+#include <net/route.h>         // for rtentry, RTF_GATEWAY, RTF_UP
+#include <netinet/in.h>        // for in_addr, sockaddr_in, htonl, htons, ntohl
+#include <sys/ioctl.h>         // for ioctl, SIOCADDRT, SIOCDELRT
+#include <sys/select.h>        // for select, FD_ISSET, FD_SET, FD_ZERO, fd_set
+#include <sys/socket.h>        // for send, socket, AF_INET, recv, connect
+#endif
 
 #if defined (__linux__) || defined(WIN32)  /*  currently, Linux and Windows only */
 
diff --git a/tools/tests-auth.c b/tools/tests-auth.c
index 232df6e..060cfc2 100644
--- a/tools/tests-auth.c
+++ b/tools/tests-auth.c
@@ -16,10 +16,13 @@
  *
  */
 
-#include <inttypes.h>
 
-#include "n2n.h"
-#include "hexdump.h"
+#include <stdint.h>   // for uint8_t
+#include <stdio.h>    // for printf, fprintf, stdout, stderr
+#include <string.h>   // for memset
+#include "auth.h"     // for ascii_to_bin, bin_to_ascii, generate_private_key
+#include "hexdump.h"  // for fhexdump
+#include "n2n.h"      // for n2n_private_public_key_t
 
 
 uint8_t PKT_CONTENT1[]={
diff --git a/tools/tests-compress.c b/tools/tests-compress.c
index dded8bc..273d0f1 100644
--- a/tools/tests-compress.c
+++ b/tools/tests-compress.c
@@ -16,12 +16,17 @@
  *
  */
 
-#include <inttypes.h>
 
-#include <assert.h>
+#include <assert.h>    // for assert
+#include <inttypes.h>  // for PRIx64
+#include <stdint.h>    // for uint8_t
+#include <stdio.h>     // for printf, fprintf, stderr, stdout, NULL
+#include <stdlib.h>    // for exit
+#include <string.h>    // for memcmp
+#include "hexdump.h"   // for fhexdump
+#include "minilzo.h"   // for lzo1x_1_compress, lzo1x_decompress, LZO1X_1_ME...
+#include "n2n.h"       // for N2N_PKT_BUF_SIZE, TRACE_ERROR, traceEvent
 
-#include "n2n.h"
-#include "hexdump.h"
 
 /* heap allocation for compression as per lzo example doc */
 #define HEAP_ALLOC(var,size) lzo_align_t __LZO_MMODEL var [ ((size) + (sizeof(lzo_align_t) - 1)) / sizeof(lzo_align_t) ]
diff --git a/tools/tests-elliptic.c b/tools/tests-elliptic.c
index eb96365..25ac471 100644
--- a/tools/tests-elliptic.c
+++ b/tools/tests-elliptic.c
@@ -16,8 +16,12 @@
  *
  */
 
-#include "n2n.h"
-#include "hexdump.h"
+
+#include <stdio.h>       // for printf, fprintf, stdout, stderr
+#include <string.h>      // for memset
+#include "curve25519.h"  // for curve25519
+#include "hexdump.h"     // for fhexdump
+
 
 void test_curve25519 (unsigned char *pkt_input, unsigned char *key) {
     char *test_name = "curve25519";
diff --git a/tools/tests-hashing.c b/tools/tests-hashing.c
index dbbbbb8..1781744 100644
--- a/tools/tests-hashing.c
+++ b/tools/tests-hashing.c
@@ -16,10 +16,13 @@
  *
  */
 
-#include <inttypes.h>
 
+#include <inttypes.h>  // for PRIx64, PRIx16, PRIx32
+#include <stdint.h>    // for uint8_t, uint16_t, uint32_t, uint64_t
+#include <stdio.h>     // for printf, fprintf, stderr, stdout
 #include "n2n.h"
-#include "hexdump.h"
+#include "hexdump.h"   // for fhexdump
+#include "pearson.h"   // for pearson_hash_128, pearson_hash_16, pearson_has...
 
 
 uint8_t PKT_CONTENT[]={
diff --git a/tools/tests-transform.c b/tools/tests-transform.c
index 11f0deb..4a48924 100644
--- a/tools/tests-transform.c
+++ b/tools/tests-transform.c
@@ -16,10 +16,17 @@
  *
  */
 
-#include <inttypes.h>
 
-#include "n2n.h"
-#include "hexdump.h"
+#include <inttypes.h>   // for PRIx64
+#include <stdint.h>     // for uint8_t
+#include <stdio.h>      // for printf, fprintf, size_t, stderr, stdout
+#include <stdlib.h>     // for exit
+#include <string.h>     // for memcpy, memset, memcmp, strncpy
+#include <sys/types.h>  // for ssize_t
+#include "hexdump.h"    // for fhexdump
+#include "n2n.h"        // for n2n_trans_op_t, n2n_edge_conf_t, n2n_common_t
+#include "n2n_wire.h"   // for decode_PACKET, decode_common, encode_PACKET
+
 
 #define DURATION                2.5   // test duration per algorithm
 #define PACKETS_BEFORE_GETTIME  2047  // do not check time after every packet but after (2 ^ n - 1)
diff --git a/tools/tests-wire.c b/tools/tests-wire.c
index e194f72..b6d7e18 100644
--- a/tools/tests-wire.c
+++ b/tools/tests-wire.c
@@ -16,10 +16,15 @@
  *
  */
 
-#include <inttypes.h>
 
-#include "n2n.h"
-#include "hexdump.h"
+#include <inttypes.h>  // for PRIx64, PRIi32
+#include <stdint.h>    // for uint8_t
+#include <stdio.h>     // for printf, fprintf, size_t, stderr, stdout
+#include <string.h>    // for memset, strcpy, strncpy
+#include "hexdump.h"   // for fhexdump
+#include "n2n.h"       // for n2n_common_t, n2n_REGISTER_SUPER_t, n2n_REGIST...
+#include "n2n_wire.h"  // for encode_REGISTER, encode_REGISTER_SUPER, encode...
+
 
 void init_ip_subnet (n2n_ip_subnet_t * d) {
     d->net_addr = 0x20212223;