add reference doc

 from: http://www.bandwidthco.com/whitepapers/netforensics/sniff/Basic%20Packet%20Sniffer%20Construction.pdf