diff --git a/docs/workshop/1-passsive-ddos/flags.tex b/docs/workshop/1-passsive-ddos/flags.tex
new file mode 100644
index 0000000..cba7cd8
--- /dev/null
+++ b/docs/workshop/1-passsive-ddos/flags.tex
@@ -0,0 +1,12 @@
+\lstset{%
+    backgroundcolor=\color{gray!25},
+    basicstyle=\ttfamily,
+    breaklines=true,
+    columns=fullflexible
+}
+
+\begin{lstlisting}
+tshark -n -r  capture-20170916110006.cap.gz -T fields -e frame.time_epoch  -e ip.src -e tcp.flags
+1505552542.807286000 x.45.177.71 0x00000010
+1505552547.514922000 x.45.177.71 0x00000010
+\end{lstlisting}