diff --git a/README.md b/README.md
index a75c9a3..497c59b 100644
--- a/README.md
+++ b/README.md
@@ -4,15 +4,31 @@ This tool uses the 3-way TCP handshake to measure the real RTT of a TCP connecti
 
 ### Usage
 
+###### Use case 1: collect probing measurements
+
 Run TCP SYN/ACK probes to measure round-trip-time (RTT):
 
     ./netem probe 8.8.8.8 > probing.dat
 
+###### Use case 2: convert measurements into delay distribution table
+
+Collect measurements to build a tc-netem(8) delay distribution table
+
+###### Use case 3
+
 The output of this command and be stored in a file or directly passed to the `emulate` subcommand:
 
     ./netem probe 8.8.8.8 | ./netem emulate
     ./netem emulate < probing.dat
 
+To apply the network emulation only to a limit stream of packets, you can use the `mark` tool:
+
+    sudo LD_PRELOAD=${PWD}/mark.so MARK=0xCD ping google.de
+
+Please make sure the specify the environmental variables after the sudo command!
+This is necessary, as `ping` is a SUID program.
+The dynamic linker strips certain enviromental variables (as `LD_PRELOAD`) for security reasons!
+
 ### Building
 
 ##### Install libnl
@@ -46,6 +62,7 @@ For building libnl (make libnl)
 
 - http://www.infradead.org/~tgr/libnl/
 - https://www.kernel.org/doc/Documentation/networking/timestamping.txt
+- https://github.com/shemminger/iproute2/tree/master/netem
 - [tc-netem(8)](http://man7.org/linux/man-pages/man8/tc-netem.8.html)
 
 ### Author