diff --git a/backend/Dockerfile b/backend/Dockerfile
index c8b0b9f..824e8dd 100755
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -19,10 +19,11 @@ COPY . ./
 #RUN npm install -g nodemon
 
 RUN mkdir /uploads && chown appuser:appgroup /uploads
+RUN mkdir /pcaps
+
+RUN apt-get install tcpdump -y
 
 EXPOSE 3000
 
-USER appuser
-
 CMD ["node", "server.js"]
 # CMD ["nodemon", "server.js"]
\ No newline at end of file
diff --git a/backend/cycle_tcpdump.sh b/backend/cycle_tcpdump.sh
new file mode 100644
index 0000000..754c19e
--- /dev/null
+++ b/backend/cycle_tcpdump.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+packet=$((9000))
+
+while true
+do
+        tcpdump -c 1000 -i any -w "/pcaps/traffic-2$packet.pcap"
+        packet=$((packet + 1))
+done
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index d6b19ce..3eacc8a 100755
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,6 +7,7 @@ services:
       - db
     volumes:
       - "vol-uploads:/uploads"
+      - "/pcaps_s3:/pcaps"
     restart: on-failure
   frontend:
     build: ./frontend