diff --git a/.obsidian/workspace.json b/.obsidian/workspace.json
index 89750bd..795c379 100644
--- a/.obsidian/workspace.json
+++ b/.obsidian/workspace.json
@@ -13,12 +13,12 @@
             "state": {
               "type": "markdown",
               "state": {
-                "file": "cybersec/AD/Active Directory Basics.md",
+                "file": "cybersec/Network/tcpdump.md",
                 "mode": "source",
                 "source": false
               },
               "icon": "lucide-file",
-              "title": "Active Directory Basics"
+              "title": "tcpdump"
             }
           }
         ]
@@ -200,6 +200,8 @@
   },
   "active": "2dff01bd208bbc21",
   "lastOpenFiles": [
+    "cybersec/AD/Active Directory Basics.md",
+    "cybersec/Network/tcpdump.md",
     "cybersec/AD/AD.md",
     "cybersec/Network/Wireshark.md",
     "cybersec/Network/photoes/wire7.gif",
@@ -221,7 +223,6 @@
     "cybersec/Network/Протоколы/HTTP(S).md",
     "cybersec/Network/Протоколы/SMTP.md",
     "cybersec/Network/Firewall.md",
-    "cybersec/AD/Active Directory Basics.md",
     "cybersec/Network/Протоколы/FTP.md",
     "cybersec/AD/photoes",
     "cybersec/OS/Powershell commands.md",
diff --git a/cybersec/Network/Network.md b/cybersec/Network/Network.md
index 35042ba..797995c 100644
--- a/cybersec/Network/Network.md
+++ b/cybersec/Network/Network.md
@@ -2,6 +2,7 @@
  [[cybersec/Network/DHCP|DHCP]]
  [[cybersec/Network/Firewall|Firewall]]
  [[cybersec/Network/photoes/photoes|photoes]]
+ [[cybersec/Network/tcpdump|tcpdump]]
  [[cybersec/Network/Wireshark|Wireshark]]
  [[cybersec/Network/Введение в сети.|Введение в сети.]]
  [[cybersec/Network/Протоколы/Протоколы|Протоколы]]
diff --git a/cybersec/Network/tcpdump.md b/cybersec/Network/tcpdump.md
new file mode 100644
index 0000000..43d823d
--- /dev/null
+++ b/cybersec/Network/tcpdump.md
@@ -0,0 +1,9 @@
+tcpdump - консольная утилита для анализа трафика.
+
+`tcpdump -i INTERFACE` - выбор интерфейса для прослушки
+`tcpdump -w FILENAME` - запись в файл
+`tcpdump -r FILENAME` - чтение из файла
+`tcpdump -n` - не резолвить ip
+`tcpdump -nn` - не резолвить ip и не резолвить порты 
+`tcpdump -v` - Указывает вывод (-vv -vvv)
+