diff --git a/doc/nethogs.8 b/doc/nethogs.8
index 2aad6e2..efa5f1e 100644
--- a/doc/nethogs.8
+++ b/doc/nethogs.8
@@ -6,71 +6,84 @@ nethogs \- Net top tool grouping bandwidth per process
 .SH SYNOPSIS
 .ft B
 .B nethogs
-.RB [ "\-h" ]
 .RB [ "\-V" ]
-.RB [ "\-d" ]
-.RB [ "\-v" ]
+.RB [ "\-h" ]
+.RB [ "\-b" ]
+.RB [ "\-d seconds" ]
+.RB [ "\-v mode" ]
+.RB [ "\-c count" ]
 .RB [ "\-t" ]
-.RB [ "\-c" ]
 .RB [ "\-p" ]
-.RB [ "\-a" ]
 .RB [ "\-s" ]
+.RB [ "\-a" ]
 .RB [ "\-l" ]
+.RB [ "\-f filter" ]
+.RB [ "\-C" ]
 .RI [device(s)]
 .SH DESCRIPTION
 NetHogs is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most such tools do, it groups bandwidth by process - and does not rely on a special kernel module to be loaded. So if there's suddenly a lot of network traffic, you can fire up NetHogs and immediately see which PID is causing this, and if it's some kind of spinning process, kill it.
 
 .SS Options
 .TP
-\fB-h\fP
-display available commands usage
-.TP
 \fB-V\fP
-print version info
+prints version.
+.TP
+\fB-h\fP
+prints available commands usage.
+.TP
+\fB-b\fP
+bughunt mode - implies tracemode.
 .TP
 \fB-d\fP
-delay for refresh rate
+delay for update refresh rate in seconds. default is 1.
 .TP
 \fB-v\fP
-select view mode
-.TP
-\fB-p\fP
-sniff in promiscuous mode (not recommended)
-.TP
-\fB-a\fP
-monitor all devices, even loopback/stopped ones
-.TP
-\fB-t\fP
-tracemode
+view mode (0 = KB/s, 1 = total KB, 2 = total B, 3 = total MB, 4 = MB/s, 5 = GB/s). default is 0.
 .TP
 \fB-c\fP
-limit number of refreshes
+number of updates. default is 0 (unlimited).
+.TP
+\fB-t\fP
+tracemode.
+.TP
+\fB-p\fP
+sniff in promiscuous mode (not recommended).
 .TP
 \fB-s\fP
-sort by traffic sent
+sort output by sent column.
 .TP
 \fB-l\fP
-display command line
+display command line.
+.TP
+\fB-a\fP
+monitor all devices, even loopback/stopped ones.
+.TP
+\fB-C\fP
+capture TCP and UDP.
+.TP
+\fB-f\fP
+EXPERIMENTAL: specify string pcap filter (like tcpdump). This may be removed or changed in a future version.
+.TP
 .PP
 .I device(s)
-to monitor. By default eth0 is being used
+to monitor. default is all interfaces up and running excluding loopback
 
 .SH "INTERACTIVE CONTROL"
 .TP
-m
-cycle between display modes (KB/s, KB, B, MB, MB/s, GB/s)
+q
+quit
+.TP
+s
+sort by SENT traffic
+.TP
+r
+sort by RECEIVED traffic
 .TP
 l
 display command line
 .TP
-r
-sort by 'received'
-.TP
-s
-sort by 'sent'
-.TP
-q
-quit
+m
+switch between total (KB, B, MB) and throughput (KB/s, MB/s, GB/s) mode
 .RE
 
 .SH "RUNNING WITHOUT ROOT"