diff --git a/README.md b/README.md
index bb35bbc..9d4aa34 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@
 - **Ethernet Frame Size**: Includes 14 bytes Ethernet header + 4 bytes FCS. Minimum frame size is 64 bytes, maximum is 1518 bytes (without VLAN tagging).
 - **URG Flag**: The URG flag is rarely used in modern protocols and should be closely monitored for potential misuse.
 
-# TCP 3-Way Handshake
+# TCP 3-Way Handshake in Normal case
 
 ```mermaid
 sequenceDiagram
@@ -33,7 +33,6 @@ sequenceDiagram
     Note left of Client: Client receives SYN-ACK
     Client->>Server: ACK
     Note right of Server: Connection established
-```
 
 # TCP 3-Way Handshake with Mitigation
 
@@ -47,6 +46,5 @@ sequenceDiagram
     Server-->>Client: SYN-ACK (seq = y, ack = x+1, cookie in seq)
     Note left of Client: Client receives SYN-ACK
     Client->>Server: ACK (seq = x+1, ack = y+1)
-    Note right of Server: Server validates cookie<br>If valid, reconstructs state and establishes connection
-    Note right of Server: Connection established
-```
\ No newline at end of file
+    Note right of Server: Server validates cookie<br>If valid, reconstructs state and establishes connection and save the IP for auto whitelisting
+    Note right of Server: Connection established
\ No newline at end of file