diff --git a/snort/README.md b/snort/README.md
index c8a4e40..dd1c893 100644
--- a/snort/README.md
+++ b/snort/README.md
@@ -29,9 +29,14 @@ alert icmp any any -> any any (msg:"ICMP Echo Reply"; itype:0; sid:10001;)
 
 ```bash
 $ docker-compose up -d
+
 $ docker-compose logs --tail 10 -f
 snort_1  | 08/26-06:47:35.460754  [**] [1:10000:0] ICMP Echo Request [**] [Priority: 0] {ICMP} x.x.x.x -> y.y.y.y
 snort_1  | 08/26-06:47:35.460835  [**] [1:10001:0] ICMP Echo Reply [**] [Priority: 0] {ICMP} y.y.y.y -> x.x.x.x
+
+$ tcpdump -n -r data/log/snort.log.xxx
+06:47:35.460754 IP x.x.x.x > y.y.y.y: ICMP echo request, id 17767, seq 933, length 12
+06:47:35.460835 IP y.y.y.y > x.x.x.x: ICMP echo reply, id 17767, seq 933, length 12
 ```
 
 [1]: https://snort.org/