diff --git a/ESPFirewall/lib/Firewall/docs/bib/online.bib b/ESPFirewall/lib/Firewall/docs/bib/online.bib
index 6169752..b6b7591 100644
--- a/ESPFirewall/lib/Firewall/docs/bib/online.bib
+++ b/ESPFirewall/lib/Firewall/docs/bib/online.bib
@@ -28,4 +28,12 @@
   urldate = {2022-07-19},
   year    = {2022},
   url     = {https://docs.arduino.cc/learn/built-in-libraries/eeprom}
+}
+
+@online{espressif-wifi,
+  author  = {Espressif},
+  title   = {Wi-Fi Driver},
+  urldate = {2022-07-20},
+  year    = {2022},
+  url     = {https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-guides/wifi.html#wi-fi-driver}
 }
\ No newline at end of file
diff --git a/ESPFirewall/lib/Firewall/docs/firewall/firewall.tex b/ESPFirewall/lib/Firewall/docs/firewall/firewall.tex
index 5943822..a830a25 100644
--- a/ESPFirewall/lib/Firewall/docs/firewall/firewall.tex
+++ b/ESPFirewall/lib/Firewall/docs/firewall/firewall.tex
@@ -55,4 +55,34 @@ After analyzing existing solutions following firewall parameters were implemente
 
 A port can be a maximum of 65565, therefore cannot be of type \verb|uint16_t| but \verb|uint32_t|. Target as well as protocol are enums for the available options. To block a range of ports, there is a \verb|port_from| and \verb|port_to|. The firewall will store all the rules as linked list to dynamically add and remove rules.
 
+\subsection{WiFi Events}
+
+To intercept network packages there is a need to somehow get notified when a new package arrived that needs to be analyzed. Based on the firewall rules, it can pass, gets dropped or rejected.
+
+Available ESP32 WiFi Events can be seen in figure \ref*{fig:WiFi Events}. None of those events support reading incoming packages.
+
+\begin{figure}[H]
+    \begin{center} 
+        \includegraphics[height=0.9\textheight]{wifi-events}
+        \caption{WiFi Events}
+        \label{fig:WiFi Events}
+    \end{center}
+\end{figure}
+
+\cite[cf.][]{espressif-wifi}
+
+\subsection{WiFi Buffer Usage}
+
+Looking at the usage of the DMA buffer (Figure \ref{fig:WiFi Buffer}) of the driver we can see where we have to check for received packages.
+
+\begin{figure}[H]
+    \begin{center} 
+        \includegraphics[width=0.8\textwidth]{wifi-buffer}
+        \caption{WiFi Buffer}
+        \label{fig:WiFi Buffer}
+    \end{center}
+\end{figure}
+
+\cite[cf.][]{espressif-wifi}
+
 \subsection{Benchmark}
diff --git a/ESPFirewall/lib/Firewall/docs/images/wifi-buffer.png b/ESPFirewall/lib/Firewall/docs/images/wifi-buffer.png
new file mode 100644
index 0000000..0e2b74c
Binary files /dev/null and b/ESPFirewall/lib/Firewall/docs/images/wifi-buffer.png differ
diff --git a/ESPFirewall/lib/Firewall/docs/images/wifi-events.png b/ESPFirewall/lib/Firewall/docs/images/wifi-events.png
new file mode 100644
index 0000000..74a48d4
Binary files /dev/null and b/ESPFirewall/lib/Firewall/docs/images/wifi-events.png differ