add tcpdump
mac study