diff --git a/src/capture_traffic.c b/src/capture_traffic.c
index a5ab0fa..544f11c 100644
--- a/src/capture_traffic.c
+++ b/src/capture_traffic.c
@@ -1,11 +1,55 @@
 #include "capture_traffic.h"
+
+void dynbuf_init(struct dynbuf* db) {
+  db->content = malloc(MEGABYTE);
+  if (db->content == NULL) {
+    perror("malloc dynbuf failed");
+    exit(EXIT_FAILURE);
+  }
+  db->written = 0;
+  db->alloced = MEGABYTE;
+}
+
+void dynbuf_check_alloc(struct dynbuf* db, size_t len) {
+    if (db->written + len > db->alloced) {
+    size_t new_alloced = db->written + len > 2 * db->alloced ? db->written + len : 2 * db->alloced;
+    db->content = realloc(db->content, new_alloced);
+    if (db->content == NULL) {
+      perror("realloc dynbuf failed");
+      exit(EXIT_FAILURE);
+    }
+    db->alloced = new_alloced;
+  }
+}
+
+void dynbuf_append(struct dynbuf* db, char* ptr, size_t len) {
+  dynbuf_check_alloc(db, len);
+
+  memcpy(db->content + db->written, ptr, len);
+  db->written += len;
+}
+
 void traffic_capture_init(struct capture_ctx* ctx, char* filename) {
   ctx->activated = filename == NULL ? 0 : 1;
   if (!ctx->activated) return;
 
   ctx->filename = strdup(filename);
-  ctx->capture_in = g_queue_new ();
-  ctx->capture_out = g_queue_new ();
+  dynbuf_init (&ctx->in);
+  dynbuf_init (&ctx->out);
+}
+
+void traffic_capture_notify(struct capture_ctx* ctx, struct buffer_packet *bp, char* dest) {
+  if (!ctx->activated) return;
+
+  if (clock_gettime(CLOCK_MONOTONIC, &bp->seen) == -1){
+    perror("clock_gettime error");
+    exit(EXIT_FAILURE);
+  }
+
+  dynbuf_append (
+    strcmp(dest, "in") == 0 ? &ctx->in : &ctx->out,
+    (char*)&bp,
+    sizeof(struct buffer_packet) - sizeof(struct internet_packet) + bp->ip.ap.fmt.headers.size);
 }
 
 void traffic_capture_stop(struct capture_ctx* ctx) {
diff --git a/src/capture_traffic.h b/src/capture_traffic.h
index 6210b14..df4ee89 100644
--- a/src/capture_traffic.h
+++ b/src/capture_traffic.h
@@ -6,22 +6,32 @@
 #include <glib-2.0/gmodule.h>
 #include <glib-2.0/glib-object.h>
 #include <errno.h>
+#include "packet.h"
 #include "evt_core.h"
 
+#define KILOBYTE 1024l
+#define MEGABYTE 1024l * KILOBYTE
+#define GIGABYTE 1024l * MEGABYTE
+
 struct captured_packet {
   struct timeval* captured_time;
   char* pkt;
 };
 
+struct dynbuf {
+  char* content;
+  size_t written;
+  size_t alloced;
+};
+
 struct capture_ctx {
   uint8_t activated;
   char* filename;
   struct timeval* start_time;
-  GQueue* capture_in;
-  GQueue* capture_out;
+  struct dynbuf in;
+  struct dynbuf out;
 };
 
 void traffic_capture_init(struct capture_ctx* ctx, char* filename);
 void traffic_capture_stop(struct capture_ctx* ctx);
-void traffic_capture_notify_in(struct capture_ctx* ctx);
-void traffic_capture_notify_out(struct capture_ctx* ctx);
+void traffic_capture_notify(struct capture_ctx* ctx, struct buffer_packet *bp, char* dest);
diff --git a/src/packet.h b/src/packet.h
index 6f161e2..a8e78a8 100644
--- a/src/packet.h
+++ b/src/packet.h
@@ -70,6 +70,7 @@ struct buffer_packet {
   uint8_t ap_count;
   uint16_t aread;
   uint16_t awrite;
+  struct timespec seen;
   struct internet_packet ip;
 };
 
diff --git a/src/proxy.c b/src/proxy.c
index 45df7bf..afe9772 100644
--- a/src/proxy.c
+++ b/src/proxy.c
@@ -77,7 +77,10 @@ int main_on_udp_read(struct evt_core_ctx* ctx, struct evt_core_fdinfo* fdinfo) {
   if (read_res == FDS_ERR) goto co_error;
   if (read_res == FDS_AGAIN) return 1;
 
-  // 3. Apply logic
+  // 3. Notify helpers
+  traffic_capture_notify (&app_ctx->cap, bp, "in");
+
+  // 4. Apply logic
   return app_ctx->desc->on_datagram(ctx, fdinfo, bp);
 
 co_error:
@@ -132,7 +135,10 @@ int main_on_udp_write (struct evt_core_ctx* ctx, struct evt_core_fdinfo* fdinfo)
   if (write_res == FDS_ERR) goto co_error;
   if (write_res == FDS_AGAIN) return 1;
 
-  // 3. A whole packet has been written
+  // 3. Notify helpers
+  traffic_capture_notify (&app_ctx->cap, bp, "out");
+
+  // 4. A whole packet has been written
   // Release the buffer and notify
   mv_buffer_wtof(&app_ctx->br, fdinfo);
   notify_read(ctx, &app_ctx->br);