diff --git a/docs/refguide.xml b/docs/refguide.xml
index 5d7d1f97e..dac87bd56 100644
--- a/docs/refguide.xml
+++ b/docs/refguide.xml
@@ -187,8 +187,11 @@ address, you can specify a comma-separated list of numbers or ranges
for each octet. For example, 192.168.0-255.1-254 will skip all
addresses in the range that end in .0 or .255, and 192.168.3-5,7.1 will
scan the four addresses 192.168.3.1, 192.168.4.1, 192.168.5.1, and
-192.168.7.1. Ranges need not be
-limited to the final octets: the specifier
+192.168.7.1. Either side of a range may be omitted; the default values
+are 0 on the left and 255 on the right. Using - by
+itself is the same as 0-255, but remember to use 0- in the first octet
+so the target specification doesn't look like a command-line option.
+Ranges need not be limited to the final octets: the specifier
0-255.0-255.13.37 will perform an Internet-wide scan for all IP
addresses ending in 13.37. This sort of broad sampling can be useful
for Internet surveys and research.
@@ -199,7 +202,7 @@ IPv6 because they are rarely useful.
Nmap accepts multiple host specifications on the command line,
and they don't need to be the same type. The command nmap
-scanme.nmap.org 192.168.0.0/8 10.0.0,1,3-7.0-255 does what
+scanme.nmap.org 192.168.0.0/8 10.0.0,1,3-7.- does what
you would expect.
While targets are usually specified on the command lines, the following options are also available to control target selection: