diff --git a/site/ipam.md b/site/ipam.md
index f9f595f4..cfc9d841 100644
--- a/site/ipam.md
+++ b/site/ipam.md
@@ -22,6 +22,22 @@ You can see which address was allocated with
     host1# weave ps $C
     a7aff7249393 7a:51:d1:09:21:78 10.2.3.1/24
 
+The `-iprange` parameter is given in [CIDR
+notation](http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing)
+format - in this example "/24" means the first 24 bits of the address
+form the network address and the allocator is to allocate container
+addresses that all start 10.2.3. The ".0" and ".-1" addresses in a
+subnet are not used, as required by [RFC
+1122](https://tools.ietf.org/html/rfc1122#page-29).
+
+Once you have given a range of addresses to the IP allocator, you must
+not use any addresses in that range for anything else.  If, in our
+example, you subsequently did `weave run 10.2.3.x/24`, you run the
+risk that that address will be allocated to another container, which
+will make network traffic delivery intermittent or non-existent for
+the containers that share the same IP address. No diagnostic message
+is output by weave if you break this rule.
+
 Weave will automatically learn when a container has exited
 and hence can release its IP address.