diff --git a/doc/zzuf.1 b/doc/zzuf.1
index bd486d1..1da5de0 100644
--- a/doc/zzuf.1
+++ b/doc/zzuf.1
@@ -6,9 +6,9 @@ zzuf \- multiple purpose fuzzer
 .br
        [\fB\-f\fR \fIfuzzing\fR] [\fB\-D\fR \fIdelay\fR] [\fB\-F\fR \fIforks\fR] [\fB\-C\fR \fIcrashes\fR] [\fB\-B\fR \fIbytes\fR]
 .br
-       [\fB\-t\fR \fIseconds\fR] [\fB\-T\fR \fIseconds\fR] [\fB\-M\fR \fImegabytes\fR] [\fB\-b\fR \fIranges\fR]
+       [\fB\-t\fR \fIseconds\fR] [\fB\-T\fR \fIseconds\fR] [\fB\-M\fR \fImegabytes\fR] [\fB\-b\fR \fIranges\fR] [\fB\-p\fR \fIports\fR]
 .br
-       [\fB\-P\fR \fIprotect\fR] [\fB\-R\fR \fIrefuse\fR] [\fB\-p\fR \fIpick\fR] [\fB\-I\fR \fIinclude\fR] [\fB\-E\fR \fIexclude\fR]
+       [\fB\-P\fR \fIprotect\fR] [\fB\-R\fR \fIrefuse\fR] [\fB\-l\fR \fIlist\fR] [\fB\-I\fR \fIinclude\fR] [\fB\-E\fR \fIexclude\fR]
 .br
        [\fIPROGRAM\fR [\fB\-\-\fR] [\fIARGS\fR]...]
 .br
@@ -133,6 +133,21 @@ and you only want specific files to be fuzzed.
 Multiple \fB\-I\fR flags can be specified, in which case files matching any one
 of the regular expressions will be fuzzed. See also the \fB\-c\fR flag.
 .TP
+\fB\-l\fR, \fB\-\-list\fR=\fIlist\fR
+Cherry-pick the list of file descriptors that get fuzzed. The Nth descriptor
+will really be fuzzed only if N is in \fIlist\fR.
+
+Values start at one and ranges are inclusive. Use dashes between values and
+commas between ranges. If the right-hand part of a range is ommited, it means
+all subsequent file descriptors. For instance, to restrict fuzzing to the
+first opened descriptor and all descriptors starting from the 10th, use
+\(oq\fB\-p1,10-\fR\(cq.
+
+Note that this option only affects file descriptors that would otherwise be
+fuzzed. Even if 10 write-only descriptors are opened at the beginning of the
+program, only the next descriptor with a read flag will be the first one
+considered by the \fB\-p\fR flag.
+.TP
 \fB\-m\fR, \fB\-\-md5\fR
 Instead of displaying the program's \fIstandard output\fR, just print its MD5
 digest to \fBzzuf\fR's standard output. The standard error channel is left
@@ -150,20 +165,18 @@ relies on the operating system's ability to enforce such limitations.
 \fB\-n\fR, \fB\-\-network\fR
 Fuzz the application's network input. By default \fBzzuf\fR only fuzzes files.
 .TP
-\fB\-p\fR, \fB\-\-pick\fR=\fIlist\fR
-Cherry-pick the file descriptors that get fuzzed. The Nth descriptor will
-really be fuzzed only if N is in \fIlist\fR.
+\fB\-p\fR, \fB\-\-ports\fR=\fIranges\fR
+Only fuzz network ports that are in \fIranges\fR. By default \fBzzuf\fR
+fuzzes all ports. The port considered is the listening port if the socket
+is listening and the destination port if the socket is connecting, because
+most of the time the source port cannot be predicted.
 
-Values start at one and ranges are inclusive. Use dashes between values and
-commas between ranges. If the right-hand part of a range is ommited, it means
-all subsequent file descriptors. For instance, to restrict fuzzing to the
-first opened descriptor and all descriptors starting from the 10th, use
-\(oq\fB\-p1,10-\fR\(cq.
+Range values start at zero and are inclusive. Use dashes between range values
+and commas between ranges. If the right-hand part of a range is ommited, it
+means end of file. For instance, to restrict fuzzing to the HTTP and HTTPS
+ports and to all unprivileged ports, use \(oq\fB\-p80,443,1024-\fR\(cq.
 
-Note that this option only affects file descriptors that would otherwise be
-fuzzed. Even if 10 write-only descriptors are opened at the beginning of the
-program, the next read-write or read-only descriptor will be the first one
-considered by the \fB\-p\fR flag.
+This option requires network fuzzing to be activated using \fB\-n\fR.
 .TP
 \fB\-P\fR, \fB\-\-protect\fR=\fIlist\fR
 Protect a list of characters so that if they appear in input data that would