diff --git a/_gtfobins/tcpdump.md b/_gtfobins/tcpdump.md
index 2b9cd53..862519d 100644
--- a/_gtfobins/tcpdump.md
+++ b/_gtfobins/tcpdump.md
@@ -1,5 +1,8 @@
 ---
-description: These require some traffic to be actually captured. Also note that the subprocess is immediately sent to the background.
+description: |
+  These require some traffic to be actually captured. Also note that the subprocess is immediately sent to the background.
+
+  In recent distributions (e.g., Debian 10 and Ubuntu 18) AppArmor limits the `postrotate-command` to a small subset of predefined commands thus preventing the execution of the following.
 functions:
   command:
     - code: |