-.TP
-\fB\-d\fR
-Increase debug level.
-.TP
-\fB\-k\fR, \fB\-\-kill\fR
-Attempt to kill a running tincd and exit.
-.TP
-\fB\-n\fR, \fB\-\-net\fR=\fINETNAME\fR
-Connect to net NETNAME.
-.TP
-\fB\-t\fR, \fB\-\-timeout\fR=\fITIMEOUT\fR
-Seconds to wait before giving a timeout.
-.TP
-\fB\-\-help\fR
-Display this help and exit.
-.TP
-\fB\-\-version\fR
+This will also disable the automatic restart mechanism for fatal errors.
+.It Fl d, -debug Ns Op = Ns Ar LEVEL
+Increase debug level or set it to
+.Ar LEVEL
+(see below).
+.It Fl k, -kill Ns Op = Ns Ar SIGNAL
+Attempt to kill a running
+.Nm
+(optionally with the specified
+.Ar SIGNAL
+instead of SIGTERM) and exit.
+.It Fl n, -net Ns = Ns Ar NETNAME
+Connect to net
+.Ar NETNAME .
+.It Fl K, -generate-keys Ns Op = Ns Ar BITS
+Generate public/private RSA keypair and exit.
+If
+.Ar BITS
+is omitted, the default length will be 1024 bits.
+.It Fl L, -mlock
+Lock tinc into main memory.
+This will prevent sensitive data like shared private keys to be written to the system swap files/partitions.
+.It Fl -logfile Ns Op = Ns Ar FILE
+Write log entries to a file instead of to the system logging facility.
+If
+.Ar FILE
+is omitted, the default is
+.Pa /var/log/tinc. Ns Ar NETNAME Ns Pa .log.
+.It Fl -pidfile Ns = Ns Ar FILE
+Write PID to
+.Ar FILE
+instead of
+.Pa /var/run/tinc. Ns Ar NETNAME Ns Pa .pid.
+.It Fl -bypass-security
+Disables encryption and authentication of the meta protocol.
+Only useful for debugging.
+.It Fl -help
+Display short list of options.
+.It Fl -version