add tcpdump notes