diff --git a/dns-cache-tracking.drawio b/dns-cache-tracking.drawio
new file mode 100644
index 0000000..6360173
--- /dev/null
+++ b/dns-cache-tracking.drawio
@@ -0,0 +1 @@
+<mxfile host="app.diagrams.net" modified="2020-08-26T11:06:51.963Z" agent="5.0 (X11)" etag="AP6S11VMiwLlB7sJHuog" version="13.6.5" type="device"><diagram id="hJAP7GdB_jyjzNftMr9Q" name="Page-1">5VxLc9s2EP41mmkP5RAAn8fYjttDmnTiziQ9dWgSkjChCJWELCm/vqAESSSWtmiZT1k6WFwCIPF9u9hdPDwht4vN72mwnP/JIxpPsBltJuRugjFyfFf+ySVbJbEdspfMUhYp2UnwwH5SJTSVdMUimpUKCs5jwZZlYciThIaiJAvSlK/LxaY8Lj91GcwoEDyEQQyl31gk5nspIaZ5uvEHZbO5erTleKrKIjiUVkWzeRDxdUFEPk7Ibcq52P9abG5pnMN3AGZf7/6Zu8c3S2ki6lT47/Nd8iX8bgarNIk+f7IJS/79TbXyFMQr1WP1smJ7gCDlqySieSPmhNys50zQh2UQ5nfXknUpm4tFLK+Q/Kmao6mgm2ffEx17LxWH8gUV6VYWURU8hde2fLkuwO8o2byAPLaVMFCUz44tn0CRPxQur8AIA4xuY5Z3Bpu/fHn4FQAmuy7KqGQi5T/oLY95KiUJT2TJmymLY00UxGyWyMtQtk6l/CYHkklt/KBuLFgU5Y+ppKFMVANMSExLVDiQCreKibaIIMNTVmSWtRUhiBHCFSAhvy2ULIDSTT4OSn26WkVFVpkFH5Jgdamo9vAUlVyqqF5bIDkApAexepSSlGY8frpmfSVYI8OCZHhdKqw7fIXFFRhVKqzTFkjeeYU1wyCc0/ejuFUhQaeKexjFCqQgQ17/nQbhD5bMch4StlxSMVBSpjwRh+YnmNzfm/LTkFfUwjfk24CsTuM3BEMTwApNog953pbDGwdZxsKqkYVGIG07i0pK40Cwp3K9qj6qqn9xtovxj8GwNmZ7frmJjK/SkKpaxTxMawh4Ykd7FxGkMypAQzvIj/15AwswOqmgQQL8KXiU6bxUWJqxn8Hj7pZZZqO+JUyKabpqbHLE9Iyev6BNzfF8KMKn04y2gzwMeXp3s5Y3tLgQDTAY0VHqPxhBMBr5mochK8F4kvdNGsGUp4vrj0ksv+zmqmISv1M359el5lopsXUX13d+g2GYOJ7Iw3ouW3xt5AHGer2hliOPQ9fHHnkUpu8v4/ltugzjN2tEyqzroO4hayuzbhV6Q88os4Ql2BaKLfMCWSvqXiOQGSxPIEvx0GU86XkTNv1aPDXGAgyUKsxlBIOO2yzP7ac7GMZBrem/bHSnjy+8jho29+r2QrmGcT7YE9Lsyb/UnohmT6hbeyIwlBqnPfljsydSY7G+Q3s6zGacNSjUkkW5umO5MJIADek7Cdq2KHwdFkUajkQ6sKgaOwoyyb6ANjVEQyN2K4bm6pH2pYbmOOWG3I7tDC4/kFHaGXkjzW/bhFNjc8OZCdkgW+736k3ZJp92amLKSVfSim1jVTNOrc1ikxpz/QOACblwTbBbnGokya/FqTxr2vCqqo7gcRTrDUGY4I7aiTmtODEHmYZZ+OCyGdjI8FDh617m4VzsG37h45WfQmzDsk9fu1v3B9Pxcbo/r0/3Z8H0d9TW1k5u5uAXrc1pyNrIi9Zm9WltFkzWR2ltVq9rHRZMjb/mByaw+dl4MACeV7OA6mobmqt2ZXS6o9mCmbIR8sW7IwL3TgRMYg26eZdcHJeoeuOi6X3+rSYuWFvRIxX7ZCyzAr/2Tqo0vR+uXfx09as4ZVKV+OmbLJqDr+mNcq3CR5yhwVcjbx4OfPq+iSr4DnM53cAH00mZYiMDGzDOvRoXhHUlrpj86fakWcX5B9OwDNtwrpcFottC7yzAZE+y4Bqe4V8vC5bvGvbAeIDp4tMO5PMkjORMjz4AWX3HwDZMDHPIoSsdLeT6aNM/5DAFzCGv43ZHAjkcWvoHHeZ6hTOGa5qfA81oKrudXe+QT/QUqO4xmPZogSmkDfC/cD6ebpj4noMndXF/9U/hzt1G4bq72JZAbmQOX9nz2Sl8q51dH2cWzFzXcHHhq82uN7NghhExiusEiJSfcvEcvrw8/eOdffHTPzAiH/8H</diagram></mxfile>
\ No newline at end of file
diff --git a/figures/dns-cache-tracking.png b/figures/dns-cache-tracking.png
new file mode 100644
index 0000000..e9e8c9f
Binary files /dev/null and b/figures/dns-cache-tracking.png differ
diff --git a/methods.tex b/methods.tex
index cb9cfae..9336478 100644
--- a/methods.tex
+++ b/methods.tex
@@ -818,7 +818,18 @@ servers with a domain name under the control of the tracker. The tracking
 process starts once a user agent requests a web site which loads a script from
 one of the web servers the attacker is controlling. The process can then be
 sketched out as follows (see \cite[p.~5]{kleinDNSCacheBasedUser2019} for a
-detailed description).
+detailed description). Figure~\ref{fig:dns-cache-tracking} shows the process as
+well.
+
+\begin{figure}
+    \begin{center}
+        \includegraphics[width=1\textwidth]{figures/dns-cache-tracking.png}
+        \caption{DNS cache tracking example performed by malicious web site
+        \texttt{ex.com}. The figure is adapted from \citet[Figure
+    1]{kleinDNSCacheBasedUser2019}.}
+        \label{fig:dns-cache-tracking}
+    \end{center}
+\end{figure}
 
 \begin{enumerate}
 	\item The snippet loads a resource from muliple domains (\texttt{1.ex.com},