diff --git a/.gitignore b/.gitignore
index 4d5f7002..a2b647f6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -41,6 +41,7 @@ prog/sigproxy/sigproxy
 prog/weavewait/weavewait
 prog/weavewait/weavewait_noop
 prog/weavewait/weavewait_nomcast
+prog/weaveutil/weaveutil
 prog/netcheck/netcheck
 prog/docker_tls_args/docker_tls_args
 prog/plugin/plugin
@@ -59,6 +60,7 @@ prog/weaveexec/weavewait
 prog/weaveexec/weavewait_noop
 prog/weaveexec/weavewait_nomcast
 prog/weaveexec/sigproxy
+prog/weaveexec/weaveutil
 prog/weaveexec/netcheck
 prog/weaveexec/docker_tls_args
 prog/weaveexec/docker*.tgz
diff --git a/Makefile b/Makefile
index 29190932..b44bd237 100644
--- a/Makefile
+++ b/Makefile
@@ -15,13 +15,14 @@ SIGPROXY_EXE=prog/sigproxy/sigproxy
 WEAVEWAIT_EXE=prog/weavewait/weavewait
 WEAVEWAIT_NOOP_EXE=prog/weavewait/weavewait_noop
 WEAVEWAIT_NOMCAST_EXE=prog/weavewait/weavewait_nomcast
+WEAVEUTIL_EXE=prog/weaveutil/weaveutil
 NETCHECK_EXE=prog/netcheck/netcheck
 DOCKERTLSARGS_EXE=prog/docker_tls_args/docker_tls_args
 DOCKERPLUGIN_EXE=prog/plugin/plugin
 RUNNER_EXE=tools/runner/runner
 TEST_TLS_EXE=test/tls/tls
 
-EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE) $(DOCKERPLUGIN_EXE) $(TEST_TLS_EXE)
+EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE) $(DOCKERPLUGIN_EXE) $(TEST_TLS_EXE)
 
 WEAVER_UPTODATE=.weaver.uptodate
 WEAVEEXEC_UPTODATE=.weaveexec.uptodate
@@ -70,13 +71,14 @@ else
 endif
 	$(NETGO_CHECK)
 
-$(NETCHECK_EXE): common/*.go common/*/*.go net/*.go
+$(WEAVEUTIL_EXE) $(NETCHECK_EXE): common/*.go common/*/*.go net/*.go
 	go get -tags netgo ./$(@D)
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)
 	$(NETGO_CHECK)
 
 $(WEAVER_EXE): router/*.go mesh/*.go ipam/*.go ipam/*/*.go nameserver/*.go prog/weaver/*.go
 $(WEAVEPROXY_EXE): proxy/*.go prog/weaveproxy/*.go
+$(WEAVEUTIL_EXE): prog/weaveutil/*.go
 $(NETCHECK_EXE): prog/netcheck/*.go
 
 # These next programs need separate rules as they fail the netgo check in
@@ -106,13 +108,14 @@ $(WEAVER_UPTODATE): prog/weaver/Dockerfile $(WEAVER_EXE)
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -t $(WEAVER_IMAGE) prog/weaver
 	touch $@
 
-$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile prog/weaveexec/symlink $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE)
+$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile prog/weaveexec/symlink $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE)
 	cp weave prog/weaveexec/weave
 	cp $(SIGPROXY_EXE) prog/weaveexec/sigproxy
 	cp $(WEAVEPROXY_EXE) prog/weaveexec/weaveproxy
 	cp $(WEAVEWAIT_EXE) prog/weaveexec/weavewait
 	cp $(WEAVEWAIT_NOOP_EXE) prog/weaveexec/weavewait_noop
 	cp $(WEAVEWAIT_NOMCAST_EXE) prog/weaveexec/weavewait_nomcast
+	cp $(WEAVEUTIL_EXE) prog/weaveexec/weaveutil
 	cp $(NETCHECK_EXE) prog/weaveexec/netcheck
 	cp $(DOCKERTLSARGS_EXE) prog/weaveexec/docker_tls_args
 	cp $(DOCKER_DISTRIB) prog/weaveexec/docker.tgz
diff --git a/prog/weaveexec/Dockerfile b/prog/weaveexec/Dockerfile
index f700f20a..fd367dcd 100644
--- a/prog/weaveexec/Dockerfile
+++ b/prog/weaveexec/Dockerfile
@@ -20,7 +20,7 @@ RUN apk add --update \
   && rm -rf /var/cache/apk/*
 
 ADD ./weave ./sigproxy ./weaveproxy ./symlink /home/weave/
-ADD ./netcheck ./docker_tls_args /usr/bin/
+ADD ./weaveutil ./netcheck ./docker_tls_args /usr/bin/
 ADD ./weavewait /w/w
 ADD ./weavewait_noop /w-noop/w
 ADD ./weavewait_nomcast /w-nomcast/w
diff --git a/prog/weaveutil/main.go b/prog/weaveutil/main.go
new file mode 100644
index 00000000..be58423e
--- /dev/null
+++ b/prog/weaveutil/main.go
@@ -0,0 +1,58 @@
+/* weaveutil: collection of operations required by weave script */
+package main
+
+import (
+	"fmt"
+	"os"
+
+	weavenet "github.com/weaveworks/weave/net"
+)
+
+var f = weavenet.EnsureInterface // placeholder to force inclusion of 'net'
+
+var commands map[string]func([]string) error
+
+func init() {
+	commands = map[string]func([]string) error{
+		"help": help,
+	}
+}
+
+func main() {
+	if len(os.Args) < 2 {
+		usage()
+		os.Exit(1)
+	}
+	cmd, found := commands[os.Args[1]]
+	if !found {
+		usage()
+		os.Exit(1)
+	}
+	if err := cmd(os.Args[2:]); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func help(args []string) error {
+	if len(args) > 0 {
+		cmdUsage("help", "")
+	}
+	usage()
+	return nil
+}
+
+func usage() {
+	fmt.Fprintln(os.Stderr, "usage: weaveutil <command> <arg>...")
+	fmt.Fprintln(os.Stderr)
+	fmt.Fprintln(os.Stderr, "where <command> is one of:")
+	fmt.Fprintln(os.Stderr)
+	for cmd := range commands {
+		fmt.Fprintln(os.Stderr, cmd)
+	}
+}
+
+func cmdUsage(cmd string, usage string) {
+	fmt.Fprintf(os.Stderr, "usage: weaveutil %s %s\n", cmd, usage)
+	os.Exit(1)
+}