diff --git a/man/shadowsocks-libev.8 b/man/shadowsocks-libev.8
index 6945b480..aa0ae18f 100644
--- a/man/shadowsocks-libev.8
+++ b/man/shadowsocks-libev.8
@@ -1,7 +1,7 @@
 .ig
 . manual page for shadowsocks-libev
 .
-. Copyright (c) 2012-2015, by: Max Lv
+. Copyright (c) 2012-2016, by: Max Lv
 . All rights reserved.
 .
 . Permission is granted to copy, distribute and/or modify this document
@@ -25,7 +25,7 @@
 .ds Ma  \fBss-manager\fR
 .ds Me  \fBShadowsocks-libev\fR
 .
-.TH "SHADOWSOCKS-LIBEV" "8" "September 10, 2015" "SHADOWSOCKS-LIBEV"
+.TH "SHADOWSOCKS-LIBEV" "8" "April 19, 2016" "SHADOWSOCKS-LIBEV"
 .SH NAME
 shadowsocks-libev \- a lightweight and secure socks5 proxy
 
@@ -42,17 +42,18 @@ shadowsocks created by clowwindy. \*(Me is written in pure C and takes advantage
 of \fBlibev\fP to achieve both high performance and low resource consumption.
 .PP
 \*(Me consists of five components. One is \*(Se(1) that runs on a remote server
-to provide secured tunnel service. \*(Lo(1) and \*(Re(1) are clients on your local
-machines to proxy TCP traffic. \*(Tu(1) is a tool for local port forwarding.
+to provide secured tunnel service. \*(Lo(1) and \*(Re(1) are clients on your
+local machines to proxy TCP traffic. \*(Tu(1) is a tool for local port
+forwarding.
 .PP
-While \*(Lo(1) works as a standard socks5 proxy, \*(Re(1) works as a transparent proxy
-and requires netfilter's NAT module. For more information, check out the example
-section.
+While \*(Lo(1) works as a standard socks5 proxy, \*(Re(1) works as a transparent
+proxy and requires netfilter's NAT module. For more information, check out the
+example section.
 .PP
-\*(Ma(1) is a controller for multi-user management and traffic statistics, using UNIX
-domain socket to talk with \*(Se(1). Also, it provides a UNIX domain socket or IP based
-API for other software. About the details of this API, please refer to the protocol
-section.
+\*(Ma(1) is a controller for multi-user management and traffic statistics, using
+UNIX domain socket to talk with \*(Se(1). Also, it provides a UNIX domain socket
+or IP based API for other software. About the details of this API, please refer
+to the protocol section.
 
 .SH OPTIONS
 .TP
@@ -61,9 +62,13 @@ Set the server's hostname or IP.
 .TP
 .B \-p \fIserver_port\fP
 Set the server's port number.
+
+Not available in manager mode.
 .TP
 .B \-l \fIlocal_port\fP
 Set the local port number.
+
+Not available in server nor manager mode.
 .TP
 .B \-k \fIpassword\fP
 Set the password. The server and the client should use the same password.
@@ -71,26 +76,31 @@ Set the password. The server and the client should use the same password.
 .B \-m \fIencrypt_method\fP
 Set the cipher.
 
-\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
-aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
-camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
-seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
+\*(Me accepts 18 different ciphers: table, rc4, rc4-md5, aes-128-cfb,
+aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb, camellia-192-cfb,
+camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb, seed-cfb, salsa20,
+chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
 
 If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
 not work.
 .TP
+.B \-a \fIuser_name\fP
+Run as a specific user.
+.TP
 .B \-f \fIpid_file\fP
 Start shadowsocks as a daemon with specific pid file.
 .TP
 .B \-t \fItimeout\fP
-Set the socket timeout in seconds. The default value is 10.
+Set the socket timeout in seconds. The default value is 60.
 .TP
 .B \-c \fIconfig_file\fP
 Use a configuration file.
 .TP
-.B \-n \fInofile\fP
+.B \-n \fInumber\fP
 Specify max number of open files.
 
+Not available in manager mode.
+
 Only available on Linux.
 .TP
 .B \-i \fIinterface\fP
@@ -101,48 +111,55 @@ Not available in redir mode.
 .B \-b \fIlocal_address\fP
 Specify local address to bind.
 
-Not available in server mode.
-.TP
-.B \-a \fIuser_name\fP
-Run as a specific user.
+Not available in server nor manager mode.
 .TP
 .B \-u
 Enable UDP relay.
+
 TPROXY is required in redir mode.
 .TP
 .B \-U
 Enable UDP relay and disable TCP relay.
+
 Not available in local mode.
 .TP
 .B \-A
 Enable onetime authentication.
 .TP
+.B \-w
+Enable white list mode (when ACL enabled).
+
+Only available in server mode.
+.TP
 .B \-L \fIaddr\fR:\fIport\fP
 Specify destination server address and port for local port forwarding.
 
 Only available in tunnel mode.
 .TP
 .B \-d \fIaddr\fP
-Setup name servers for internal DNS resolver (libudns). The default server
-is fetched from /etc/resolv.conf.
+Setup name servers for internal DNS resolver (libudns). The default server is
+fetched from /etc/resolv.conf.
 
-Only available in server mode.
+Only available in server and manager mode.
 .TP
 .B \--fast-open
 Enable TCP fast open.
 
-Only available in local and server mode, with Linux kernel > 3.7.0.
+Not available in redir nor tunnel mode, with Linux kernel > 3.7.0.
 .TP
 .B \--acl \fIacl_config\fP
 Enable ACL (Access Control List) and specify config file.
-Only available in local and server mode.
+
+Not available in redir nor tunnel mode.
 .TP
 .B \--manager-address \fIpath_to_unix_domain\fP
 Specify UNIX domain socket address.
+
 Only available in server and manager mode.
 .TP
 .B \--executable \fIpath_to_server_executable\fP
 Specify the executable path of ss-server.
+
 Only available in manager mode.
 .TP
 .B \-v
@@ -151,8 +168,10 @@ Enable verbose mode.
 .SH EXAMPLE
 \*(Re requires netfilter's NAT function. Here is an example:
 
+.nf
     # Create new chain
     root@Wrt:~# iptables -t nat -N SHADOWSOCKS
+    root@Wrt:~# iptables -t mangle -N SHADOWSOCKS
 
     # Ignore your shadowsocks server's addresses
     # It's very IMPORTANT, just be careful.
@@ -184,29 +203,32 @@ Enable verbose mode.
 
     # Start the shadowsocks-redir
     root@Wrt:~# ss-redir -u -c /etc/config/shadowsocks.json -f /var/run/shadowsocks.pid
+.fi
 
 .SH PROTOCOL
 \*(Ma(1) provides several APIs through UDP protocol:
 
-    Send UDP commands in the following format to the manager-address provided to \*(Ma(1).
+.in +4n
+Send UDP commands in the following format to the manager-address provided to
+\*(Ma(1).
 
-        command: [JSON data]
+    command: [JSON data]
 
-    To add a port:
+To add a port:
 
-        add: {"server_port": 8001, "password":"7cd308cc059"}
+    add: {"server_port": 8001, "password":"7cd308cc059"}
 
-    To remove a port:
+To remove a port:
 
-        remove: {"server_port": 8001}
+    remove: {"server_port": 8001}
 
-    To receive a pong:
+To receive a pong:
 
-        ping
+    ping
 
-    Then \*(Ma(1) will send back the traffic statistics:
+Then \*(Ma(1) will send back the traffic statistics:
 
-        stat: {"8001":11370}
+    stat: {"8001":11370}
 
 .SH SEE ALSO
 .BR \*(Lo (1),
diff --git a/man/ss-local.1 b/man/ss-local.1
index 04ec5209..3c7007c6 100644
--- a/man/ss-local.1
+++ b/man/ss-local.1
@@ -1,7 +1,7 @@
 .ig
 . manual page for shadowsocks-libev
 .
-. Copyright (c) 2012-2015, by: Max Lv
+. Copyright (c) 2012-2016, by: Max Lv
 . All rights reserved.
 .
 . Permission is granted to copy, distribute and/or modify this document
@@ -25,7 +25,7 @@
 .ds Ma  \fBss-manager\fR
 .ds Me  \fBShadowsocks-libev\fR
 .
-.TH "SS-LOCAL" "1" "September 10, 2015" "SHADOWSOCKS-LIBEV"
+.TH "SS-LOCAL" "1" "April 19, 2016" "SHADOWSOCKS-LIBEV"
 .SH NAME
 ss-local \- shadowsocks client as socks5 proxy, libev port
 
@@ -43,7 +43,8 @@ shadowsocks created by clowwindy. \*(Me is written in pure C and takes advantage
 of \fBlibev\fP to achieve both high performance and low resource consumption.
 .PP
 \*(Me consists of five components. \*(Lo(1) works as a standard socks5 proxy
-on local machines to proxy TCP traffic. For more information, check out \fBshadowsocks-libev\fR(8).
+on local machines to proxy TCP traffic. For more information, check out
+\fBshadowsocks-libev\fR(8).
 
 .SH OPTIONS
 .TP
@@ -62,24 +63,27 @@ Set the password. The server and the client should use the same password.
 .B \-m \fIencrypt_method\fP
 Set the cipher.
 
-\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
-aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
-camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
-seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
+\*(Me accepts 18 different ciphers: table, rc4, rc4-md5, aes-128-cfb,
+aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb, camellia-192-cfb,
+camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb, seed-cfb, salsa20,
+chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
 
 If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
 not work.
 .TP
+.B \-a \fIuser_name\fP
+Run as a specific user.
+.TP
 .B \-f \fIpid_file\fP
 Start shadowsocks as a daemon with specific pid file.
 .TP
 .B \-t \fItimeout\fP
-Set the socket timeout in seconds. The default value is 10.
+Set the socket timeout in seconds. The default value is 60.
 .TP
 .B \-c \fIconfig_file\fP
 Use a configuration file.
 .TP
-.B \-n \fInofile\fP
+.B \-n \fInumber\fP
 Specify max number of open files.
 
 Only avaliable on Linux.
@@ -90,9 +94,6 @@ Specify network interface to bind.
 .B \-b \fIlocal_address\fP
 Specify local address to bind.
 .TP
-.B \-a \fIuser_name\fP
-Run as a specific user.
-.TP
 .B \-u
 Enable UDP relay.
 .TP
@@ -111,7 +112,8 @@ Enable ACL (Access Control List) and specify config file.
 Enable verbose mode.
 
 .SH EXAMPLE
-\*(Lo(1) can be started from command line and run in foreground. Here is an example:
+\*(Lo(1) can be started from command line and run in foreground. Here is an
+example:
 
     # Start ss-local with given parameters
     ss-local -s example.com -p 12345 -l 1080 -k foobar -m aes-256-cfb
diff --git a/man/ss-manager.1 b/man/ss-manager.1
index 9480fb06..00902398 100644
--- a/man/ss-manager.1
+++ b/man/ss-manager.1
@@ -1,7 +1,7 @@
 .ig
 . manual page for shadowsocks-libev
 .
-. Copyright (c) 2012-2015, by: Max Lv
+. Copyright (c) 2012-2016, by: Max Lv
 . All rights reserved.
 .
 . Permission is granted to copy, distribute and/or modify this document
@@ -25,9 +25,10 @@
 .ds Ma  \fBss-manager\fR
 .ds Me  \fBShadowsocks-libev\fR
 .
-.TH "SS-MANAGER" "1" "September 10, 2015" "SHADOWSOCKS-LIBEV"
+.TH "SS-MANAGER" "1" "April 19, 2016" "SHADOWSOCKS-LIBEV"
 .SH NAME
-ss-manager \- ss-server controller for multi-user management and traffic statistics
+ss-manager \- ss-server controller for multi-user management and traffic
+statistics
 
 .SH SYNOPSIS
 \*(Ma
@@ -45,41 +46,38 @@ shadowsocks created by clowwindy. \*(Me is written in pure C and takes advantage
 of \fBlibev\fP to achieve both high performance and low resource consumption.
 .PP
 \*(Me consists of five components.
-\*(Ma(1) is a controller for multi-user management and traffic statistics, using UNIX
-domain socket to talk with \*(Se(1). Also, it provides a UNIX domain socket or IP based
-API for other software. About the details of this API, please refer to the following
-\fBPROTOCOL\fR section.
+\*(Ma(1) is a controller for multi-user management and traffic statistics, using
+UNIX domain socket to talk with \*(Se(1). Also, it provides a UNIX domain socket
+or IP based API for other software. About the details of this API, please refer
+to the following \fBPROTOCOL\fR section.
 
 .SH OPTIONS
 .TP
 .B \-s \fIserver_host\fP
 Set the server's hostname or IP.
 .TP
-.B \-p \fIserver_port\fP
-Set the server's port number.
-.TP
-.B \-l \fIlocal_port\fP
-Set the local port number.
-.TP
 .B \-k \fIpassword\fP
 Set the password. The server and the client should use the same password.
 .TP
 .B \-m \fIencrypt_method\fP
 Set the cipher.
 
-\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
-aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
-camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
-seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
+\*(Me accepts 18 different ciphers: table, rc4, rc4-md5, aes-128-cfb,
+aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb, camellia-192-cfb,
+camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb, seed-cfb, salsa20,
+chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
 
 If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
 not work.
 .TP
+.B \-a \fIuser_name\fP
+Run as a specific user.
+.TP
 .B \-f \fIpid_file\fP
 Start shadowsocks as a daemon with specific pid file.
 .TP
 .B \-t \fItimeout\fP
-Set the socket timeout in seconds. The default value is 10.
+Set the socket timeout in seconds. The default value is 60.
 .TP
 .B \-c \fIconfig_file\fP
 Use a configuration file.
@@ -87,12 +85,6 @@ Use a configuration file.
 .B \-i \fIinterface\fP
 Specify network interface to bind.
 .TP
-.B \-b \fIlocal_address\fP
-Specify local address to bind.
-.TP
-.B \-a \fIuser_name\fP
-Run as a specific user.
-.TP
 .B \-u
 Enable UDP relay.
 .TP
@@ -102,9 +94,21 @@ Enable UDP relay and disable TCP relay.
 .B \-A
 Enable onetime authentication.
 .TP
+.B \-d \fIaddr\fP
+Setup name servers for internal DNS resolver (libudns). The default server is
+fetched from /etc/resolv.conf.
+.TP
+.B \--fast-open
+Enable TCP fast open.
+
+Only available with Linux kernel > 3.7.0.
+.TP
+.B \--acl \fIacl_config\fP
+Enable ACL (Access Control List) and specify config file.
+.TP
 .B \--manager-address \fIpath_to_unix_domain\fP
-Specify UNIX domain socket address for the communication between ss-manager and
-ss-server.
+Specify UNIX domain socket address for the communication between \*(Ma(1) and
+\*(Se(1).
 
 Only available in server and manager mode.
 .TP
@@ -119,25 +123,27 @@ Enable verbose mode.
 .SH PROTOCOL
 \*(Ma(1) provides several APIs through UDP protocol:
 
-    Send UDP commands in the following format to the manager-address provided to \*(Ma(1).
+.in +4n
+Send UDP commands in the following format to the manager-address provided to
+\*(Ma(1).
 
-        command: [JSON data]
+    command: [JSON data]
 
-    To add a port:
+To add a port:
 
-        add: {"server_port": 8001, "password":"7cd308cc059"}
+    add: {"server_port": 8001, "password":"7cd308cc059"}
 
-    To remove a port:
+To remove a port:
 
-        remove: {"server_port": 8001}
+    remove: {"server_port": 8001}
 
-    To receive a pong:
+To receive a pong:
 
-        ping
+    ping
 
-    Then \*(Ma(1) will send back the traffic statistics:
+Then \*(Ma(1) will send back the traffic statistics:
 
-        stat: {"8001":11370}
+    stat: {"8001":11370}
 
 .SH EXAMPLE
 To use \*(Ma(1), First start it and specify necessary information.
diff --git a/man/ss-redir.1 b/man/ss-redir.1
index e3f5045f..244798ac 100644
--- a/man/ss-redir.1
+++ b/man/ss-redir.1
@@ -1,7 +1,7 @@
 .ig
 . manual page for shadowsocks-libev
 .
-. Copyright (c) 2012-2015, by: Max Lv
+. Copyright (c) 2012-2016, by: Max Lv
 . All rights reserved.
 .
 . Permission is granted to copy, distribute and/or modify this document
@@ -25,7 +25,7 @@
 .ds Ma  \fBss-manager\fR
 .ds Me  \fBShadowsocks-libev\fR
 .
-.TH "SS-REDIR" "1" "September 10, 2015" "SHADOWSOCKS-LIBEV"
+.TH "SS-REDIR" "1" "April 19, 2016" "SHADOWSOCKS-LIBEV"
 .SH NAME
 ss-redir \- shadowsocks client as transparent proxy, libev port
 
@@ -42,10 +42,10 @@ ss-redir \- shadowsocks client as transparent proxy, libev port
 shadowsocks created by clowwindy. \*(Me is written in pure C and takes advantage
 of \fBlibev\fP to achieve both high performance and low resource consumption.
 .PP
-\*(Me consists of five components. \*(Re(1) works as a transparent proxy on local
-machines to proxy TCP traffic and requires netfilter's NAT module. For more
-information, check out \fBshadowsocks-libev\fR(8) and the following \fBEXAMPLE\fR
-section.
+\*(Me consists of five components. \*(Re(1) works as a transparent proxy on
+local machines to proxy TCP traffic and requires netfilter's NAT module. For
+more information, check out \fBshadowsocks-libev\fR(8) and the following
+\fBEXAMPLE\fR section.
 
 .SH OPTIONS
 .TP
@@ -64,24 +64,27 @@ Set the password. The server and the client should use the same password.
 .B \-m \fIencrypt_method\fP
 Set the cipher.
 
-\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
-aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
-camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
-seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
+\*(Me accepts 18 different ciphers: table, rc4, rc4-md5, aes-128-cfb,
+aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb, camellia-192-cfb,
+camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb, seed-cfb, salsa20,
+chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
 
 If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
 not work.
 .TP
+.B \-a \fIuser_name\fP
+Run as a specific user.
+.TP
 .B \-f \fIpid_file\fP
 Start shadowsocks as a daemon with specific pid file.
 .TP
 .B \-t \fItimeout\fP
-Set the socket timeout in seconds. The default value is 10.
+Set the socket timeout in seconds. The default value is 60.
 .TP
 .B \-c \fIconfig_file\fP
 Use a configuration file.
 .TP
-.B \-n \fInofile\fP
+.B \-n \fInumber\fP
 Specify max number of open files.
 
 Only avaliable on Linux.
@@ -89,11 +92,9 @@ Only avaliable on Linux.
 .B \-b \fIlocal_address\fP
 Specify local address to bind.
 .TP
-.B \-a \fIuser_name\fP
-Run as a specific user.
-.TP
 .B \-u
 Enable UDP relay.
+
 TPROXY is required in redir mode.
 .TP
 .B \-U
@@ -108,6 +109,7 @@ Enable verbose mode.
 .SH EXAMPLE
 \*(Re requires netfilter's NAT function. Here is an example:
 
+.nf
     # Create new chain
     root@Wrt:~# iptables -t nat -N SHADOWSOCKS
 
@@ -141,6 +143,7 @@ Enable verbose mode.
 
     # Start the shadowsocks-redir
     root@Wrt:~# ss-redir -u -c /etc/config/shadowsocks.json -f /var/run/shadowsocks.pid
+.fi
 
 .SH SEE ALSO
 .BR \*(Lo (1),
diff --git a/man/ss-server.1 b/man/ss-server.1
index b6dd09a8..9b699cbd 100644
--- a/man/ss-server.1
+++ b/man/ss-server.1
@@ -1,7 +1,7 @@
 .ig
 . manual page for shadowsocks-libev
 .
-. Copyright (c) 2012-2015, by: Max Lv
+. Copyright (c) 2012-2016, by: Max Lv
 . All rights reserved.
 .
 . Permission is granted to copy, distribute and/or modify this document
@@ -25,7 +25,7 @@
 .ds Ma  \fBss-manager\fR
 .ds Me  \fBShadowsocks-libev\fR
 .
-.TH "SS-SERVER" "1" "September 10, 2015" "SHADOWSOCKS-LIBEV"
+.TH "SS-SERVER" "1" "April 19, 2016" "SHADOWSOCKS-LIBEV"
 .SH NAME
 ss-server \- shadowsocks server, libev port
 
@@ -45,7 +45,8 @@ shadowsocks created by clowwindy. \*(Me is written in pure C and takes advantage
 of \fBlibev\fP to achieve both high performance and low resource consumption.
 .PP
 \*(Me consists of five components. \*(Se(1) runs on a remote server to provide
-secured tunnel service. For more information, check out \fBshadowsocks-libev\fR(8).
+secured tunnel service. For more information, check out
+\fBshadowsocks-libev\fR(8).
 
 .SH OPTIONS
 .TP
@@ -55,33 +56,33 @@ Set the server's hostname or IP.
 .B \-p \fIserver_port\fP
 Set the server's port number.
 .TP
-.B \-l \fIlocal_port\fP
-Set the local port number.
-.TP
 .B \-k \fIpassword\fP
 Set the password. The server and the client should use the same password.
 .TP
 .B \-m \fIencrypt_method\fP
 Set the cipher.
 
-\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
-aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
-camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
-seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
+\*(Me accepts 18 different ciphers: table, rc4, rc4-md5, aes-128-cfb,
+aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb, camellia-192-cfb,
+camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb, seed-cfb, salsa20,
+chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
 
 If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
 not work.
 .TP
+.B \-a \fIuser_name\fP
+Run as a specific user.
+.TP
 .B \-f \fIpid_file\fP
 Start shadowsocks as a daemon with specific pid file.
 .TP
 .B \-t \fItimeout\fP
-Set the socket timeout in seconds. The default value is 10.
+Set the socket timeout in seconds. The default value is 60.
 .TP
 .B \-c \fIconfig_file\fP
 Use a configuration file.
 .TP
-.B \-n \fInofile\fP
+.B \-n \fInumber\fP
 Specify max number of open files.
 
 Only avaliable on Linux.
@@ -89,9 +90,6 @@ Only avaliable on Linux.
 .B \-i \fIinterface\fP
 Specify network interface to bind.
 .TP
-.B \-a \fIuser_name\fP
-Run as a specific user.
-.TP
 .B \-u
 Enable UDP relay.
 .TP
@@ -101,9 +99,12 @@ Enable UDP relay and disable TCP relay.
 .B \-A
 Enable onetime authentication.
 .TP
+.B \-w
+Enable white list mode (when ACL enabled).
+.TP
 .B \-d \fIaddr\fP
-Setup name servers for internal DNS resolver (libudns). The default server
-is fetched from /etc/resolv.conf.
+Setup name servers for internal DNS resolver (libudns). The default server is
+fetched from /etc/resolv.conf.
 .TP
 .B \--fast-open
 Enable TCP fast open.
@@ -114,8 +115,8 @@ Only available with Linux kernel > 3.7.0.
 Enable ACL (Access Control List) and specify config file.
 .TP
 .B \--manager-address \fIpath_to_unix_domain\fP
-Specify UNIX domain socket address for the communication between ss-manager and
-ss-server.
+Specify UNIX domain socket address for the communication between \*(Ma(1) and
+\*(Se(1).
 
 Only available in server and manager mode.
 .TP
@@ -124,16 +125,17 @@ Enable verbose mode.
 
 .SH EXAMPLE
 It is recommended to use a config file when starting \*(Se(1).
-The config file is written in JSON and is easy to edit. Check out the
-\fBSEE ALSO\fR section for the default path of config file.
+
+The config file is written in JSON and is easy to edit. Check out the \fBSEE
+ALSO\fR section for the default path of config file.
 
     # Start the ss-server
     ss-server -c /etc/shadowsocks-libev/config.json
 
 .SH BUGS
-The config file of shadowsocks-libev is slightly different from original
-shadowsocks. In order to listen to both ipv4/ipv6 address, use the following
-grammar in your config json file:
+The config file of \fBshadowsocks-libev\fR(8) is slightly different from
+original shadowsocks. In order to listen to both IPv4/IPv6 address, use the
+following grammar in your config json file:
 
     {
         "server":["[::0]","0.0.0.0"],
diff --git a/man/ss-tunnel.1 b/man/ss-tunnel.1
index a4116284..89f0d579 100644
--- a/man/ss-tunnel.1
+++ b/man/ss-tunnel.1
@@ -1,7 +1,7 @@
 .ig
 . manual page for shadowsocks-libev
 .
-. Copyright (c) 2012-2015, by: Max Lv
+. Copyright (c) 2012-2016, by: Max Lv
 . All rights reserved.
 .
 . Permission is granted to copy, distribute and/or modify this document
@@ -25,7 +25,7 @@
 .ds Ma  \fBss-manager\fR
 .ds Me  \fBShadowsocks-libev\fR
 .
-.TH "SS-TUNNEL" "1" "September 10, 2015" "SHADOWSOCKS-LIBEV"
+.TH "SS-TUNNEL" "1" "April 19, 2016" "SHADOWSOCKS-LIBEV"
 .SH NAME
 ss-tunnel \- shadowsocks tools for local port forwarding, libev port
 
@@ -44,8 +44,8 @@ shadowsocks created by clowwindy. \*(Me is written in pure C and takes advantage
 of \fBlibev\fP to achieve both high performance and low resource consumption.
 .PP
 \*(Me consists of five components. \*(Tu(1) is a tool for local port forwarding.
-See \fBOPTIONS\fR section for special option needed by \*(Tu(1).
-For more information, check out \fBshadowsocks-libev\fR(8).
+See \fBOPTIONS\fR section for special option needed by \*(Tu(1). For more
+information, check out \fBshadowsocks-libev\fR(8).
 
 .SH OPTIONS
 .TP
@@ -64,24 +64,27 @@ Set the password. The server and the client should use the same password.
 .B \-m \fIencrypt_method\fP
 Set the cipher.
 
-\*(Me accepts 18 different ciphers: table, rc4, rc4-md5,
-aes-128-cfb, aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb,
-camellia-192-cfb, camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb,
-seed-cfb, salsa20, chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
+\*(Me accepts 18 different ciphers: table, rc4, rc4-md5, aes-128-cfb,
+aes-192-cfb, aes-256-cfb, bf-cfb, camellia-128-cfb, camellia-192-cfb,
+camellia-256-cfb, cast5-cfb, des-cfb, idea-cfb, rc2-cfb, seed-cfb, salsa20,
+chacha20 and chacha20-ietf. The default cipher is \fItable\fP.
 
 If built with PolarSSL or custom OpenSSL libraries, some of these ciphers may
 not work.
 .TP
+.B \-a \fIuser_name\fP
+Run as a specific user.
+.TP
 .B \-f \fIpid_file\fP
 Start shadowsocks as a daemon with specific pid file.
 .TP
 .B \-t \fItimeout\fP
-Set the socket timeout in seconds. The default value is 10.
+Set the socket timeout in seconds. The default value is 60.
 .TP
 .B \-c \fIconfig_file\fP
 Use a configuration file.
 .TP
-.B \-n \fInofile\fP
+.B \-n \fInumber\fP
 Specify max number of open files.
 
 Only avaliable on Linux.
@@ -92,9 +95,6 @@ Specify network interface to bind.
 .B \-b \fIlocal_address\fP
 Specify local address to bind.
 .TP
-.B \-a \fIuser_name\fP
-Run as a specific user.
-.TP
 .B \-u
 Enable UDP relay.
 .TP