diff --git a/docs/DEBUG.md b/docs/DEBUG.md
new file mode 100644
index 00000000..4cdc584a
--- /dev/null
+++ b/docs/DEBUG.md
@@ -0,0 +1,4 @@
+How to collect data for debugging netflow:
+```bash
+tcpdump -w ipfix_example_ipt_netflow_syn_flood.pcap -n 'udp dst port 2055' 
+```