update tcpdump notes