diff --git a/pelab/libnetmon/libnetmon-format3.txt b/pelab/libnetmon/libnetmon-format3.txt
new file mode 100644
index 0000000000000000000000000000000000000000..f285c7469d60b1f948eaeb0a35a84b939ca40b3c
--- /dev/null
+++ b/pelab/libnetmon/libnetmon-format3.txt
@@ -0,0 +1,24 @@
+Line format 3 for libnetmon:
+
+<Command>: <Key> <Timestamp> <Value>
+
+<Command> describes the kind of connection
+<Key> is a unique key for the connection
+<Timestamp> is a decimal number representing absolute time
+<Value> is a command-dependent string
+
+Possible commands and their values:
+
+New (no value)
+Protocol (value is 'TCP' or 'UDP')
+DestIP (value is a dotted quadruplet describing destination IP address)
+RemotePort (value is a number representing the remote port of the connection)
+LocalPort (value is a number representing the local port of the connection)
+TCP_NODELAY (int)
+TCP_MAXSEG (int)
+SO_RCVBUF (int)
+SO_SNDBUF (int)
+Connected (no value)
+Write (value is the size of the write or sendto)
+Closed (no value)
+