diff --git a/.gitignore b/.gitignore
index a2b647f6..8277a2f7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -42,7 +42,6 @@ prog/weavewait/weavewait
 prog/weavewait/weavewait_noop
 prog/weavewait/weavewait_nomcast
 prog/weaveutil/weaveutil
-prog/netcheck/netcheck
 prog/docker_tls_args/docker_tls_args
 prog/plugin/plugin
 testing/cover/cover
@@ -61,7 +60,6 @@ prog/weaveexec/weavewait_noop
 prog/weaveexec/weavewait_nomcast
 prog/weaveexec/sigproxy
 prog/weaveexec/weaveutil
-prog/weaveexec/netcheck
 prog/weaveexec/docker_tls_args
 prog/weaveexec/docker*.tgz
 Vagrantfile.local
diff --git a/Makefile b/Makefile
index b44bd237..321a6740 100644
--- a/Makefile
+++ b/Makefile
@@ -16,13 +16,12 @@ WEAVEWAIT_EXE=prog/weavewait/weavewait
 WEAVEWAIT_NOOP_EXE=prog/weavewait/weavewait_noop
 WEAVEWAIT_NOMCAST_EXE=prog/weavewait/weavewait_nomcast
 WEAVEUTIL_EXE=prog/weaveutil/weaveutil
-NETCHECK_EXE=prog/netcheck/netcheck
 DOCKERTLSARGS_EXE=prog/docker_tls_args/docker_tls_args
 DOCKERPLUGIN_EXE=prog/plugin/plugin
 RUNNER_EXE=tools/runner/runner
 TEST_TLS_EXE=test/tls/tls
 
-EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE) $(DOCKERPLUGIN_EXE) $(TEST_TLS_EXE)
+EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(DOCKERTLSARGS_EXE) $(DOCKERPLUGIN_EXE) $(TEST_TLS_EXE)
 
 WEAVER_UPTODATE=.weaver.uptodate
 WEAVEEXEC_UPTODATE=.weaveexec.uptodate
@@ -71,7 +70,7 @@ else
 endif
 	$(NETGO_CHECK)
 
-$(WEAVEUTIL_EXE) $(NETCHECK_EXE): common/*.go common/*/*.go net/*.go
+$(WEAVEUTIL_EXE): common/*.go common/*/*.go net/*.go
 	go get -tags netgo ./$(@D)
 	go build $(BUILD_FLAGS) -o $@ ./$(@D)
 	$(NETGO_CHECK)
@@ -79,7 +78,6 @@ $(WEAVEUTIL_EXE) $(NETCHECK_EXE): common/*.go common/*/*.go net/*.go
 $(WEAVER_EXE): router/*.go mesh/*.go ipam/*.go ipam/*/*.go nameserver/*.go prog/weaver/*.go
 $(WEAVEPROXY_EXE): proxy/*.go prog/weaveproxy/*.go
 $(WEAVEUTIL_EXE): prog/weaveutil/*.go
-$(NETCHECK_EXE): prog/netcheck/*.go
 
 # These next programs need separate rules as they fail the netgo check in
 # the main build stanza due to not importing net package
@@ -108,7 +106,7 @@ $(WEAVER_UPTODATE): prog/weaver/Dockerfile $(WEAVER_EXE)
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -t $(WEAVER_IMAGE) prog/weaver
 	touch $@
 
-$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile prog/weaveexec/symlink $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(NETCHECK_EXE) $(DOCKERTLSARGS_EXE)
+$(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile prog/weaveexec/symlink $(DOCKER_DISTRIB) weave $(SIGPROXY_EXE) $(WEAVEPROXY_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(DOCKERTLSARGS_EXE)
 	cp weave prog/weaveexec/weave
 	cp $(SIGPROXY_EXE) prog/weaveexec/sigproxy
 	cp $(WEAVEPROXY_EXE) prog/weaveexec/weaveproxy
@@ -116,7 +114,6 @@ $(WEAVEEXEC_UPTODATE): prog/weaveexec/Dockerfile prog/weaveexec/symlink $(DOCKER
 	cp $(WEAVEWAIT_NOOP_EXE) prog/weaveexec/weavewait_noop
 	cp $(WEAVEWAIT_NOMCAST_EXE) prog/weaveexec/weavewait_nomcast
 	cp $(WEAVEUTIL_EXE) prog/weaveexec/weaveutil
-	cp $(NETCHECK_EXE) prog/weaveexec/netcheck
 	cp $(DOCKERTLSARGS_EXE) prog/weaveexec/docker_tls_args
 	cp $(DOCKER_DISTRIB) prog/weaveexec/docker.tgz
 	$(SUDO) DOCKER_HOST=$(DOCKER_HOST) docker build -t $(WEAVEEXEC_IMAGE) prog/weaveexec
diff --git a/prog/netcheck/main.go b/prog/netcheck/main.go
deleted file mode 100644
index fe822f2e..00000000
--- a/prog/netcheck/main.go
+++ /dev/null
@@ -1,54 +0,0 @@
-/* netcheck: check whether a given network or address overlaps with any existing routes */
-package main
-
-import (
-	"fmt"
-	"net"
-	"os"
-
-	"github.com/docker/docker/pkg/mflag"
-	weavenet "github.com/weaveworks/weave/net"
-)
-
-func fatal(err error) {
-	fmt.Fprintln(os.Stderr, err)
-	os.Exit(1)
-}
-
-type stringList map[string]struct{}
-
-func (ss *stringList) Set(value string) error {
-	(*ss)[value] = struct{}{}
-	return nil
-}
-
-func (ss *stringList) String() string {
-	return fmt.Sprintf("%v", *ss)
-}
-
-func main() {
-	ignoreIfaceNames := make(stringList)
-
-	mflag.Var(&ignoreIfaceNames, []string{"-ignore-iface"}, "name of interface to ignore)")
-	mflag.Parse()
-
-	if len(mflag.Args()) < 1 {
-		fmt.Fprintln(os.Stderr, "usage: netcheck [--ignore-iface <iface-name>] network-cidr")
-		os.Exit(1)
-	}
-
-	cidrStr := mflag.Args()[0]
-	addr, ipnet, err := net.ParseCIDR(cidrStr)
-	if err != nil {
-		fatal(err)
-	}
-	if ipnet.IP.Equal(addr) {
-		err = weavenet.CheckNetworkFree(ipnet, ignoreIfaceNames)
-	} else {
-		err = weavenet.CheckAddressOverlap(addr, ignoreIfaceNames)
-	}
-	if err != nil {
-		fatal(err)
-	}
-	os.Exit(0)
-}
diff --git a/prog/weaveexec/Dockerfile b/prog/weaveexec/Dockerfile
index fd367dcd..353018f2 100644
--- a/prog/weaveexec/Dockerfile
+++ b/prog/weaveexec/Dockerfile
@@ -20,7 +20,7 @@ RUN apk add --update \
   && rm -rf /var/cache/apk/*
 
 ADD ./weave ./sigproxy ./weaveproxy ./symlink /home/weave/
-ADD ./weaveutil ./netcheck ./docker_tls_args /usr/bin/
+ADD ./weaveutil ./docker_tls_args /usr/bin/
 ADD ./weavewait /w/w
 ADD ./weavewait_noop /w-noop/w
 ADD ./weavewait_nomcast /w-nomcast/w
diff --git a/prog/weaveutil/main.go b/prog/weaveutil/main.go
index be58423e..0fe4b4d1 100644
--- a/prog/weaveutil/main.go
+++ b/prog/weaveutil/main.go
@@ -4,17 +4,14 @@ package main
 import (
 	"fmt"
 	"os"
-
-	weavenet "github.com/weaveworks/weave/net"
 )
 
-var f = weavenet.EnsureInterface // placeholder to force inclusion of 'net'
-
 var commands map[string]func([]string) error
 
 func init() {
 	commands = map[string]func([]string) error{
-		"help": help,
+		"help":     help,
+		"netcheck": netcheck,
 	}
 }
 
diff --git a/prog/weaveutil/netcheck.go b/prog/weaveutil/netcheck.go
new file mode 100644
index 00000000..843fab22
--- /dev/null
+++ b/prog/weaveutil/netcheck.go
@@ -0,0 +1,28 @@
+/* netcheck: check whether a given network or address overlaps with any existing routes */
+package main
+
+import (
+	"net"
+
+	weavenet "github.com/weaveworks/weave/net"
+)
+
+func netcheck(args []string) error {
+	if len(args) < 1 {
+		cmdUsage("netcheck", "<cidr> [<interface-to-ignore> ...]")
+	}
+	addr, ipnet, err := net.ParseCIDR(args[0])
+	if err != nil {
+		return err
+	}
+	ignoreIfaceNames := make(map[string]struct{})
+	for _, ifName := range args[1:] {
+		ignoreIfaceNames[ifName] = struct{}{}
+	}
+	if ipnet.IP.Equal(addr) {
+		err = weavenet.CheckNetworkFree(ipnet, ignoreIfaceNames)
+	} else {
+		err = weavenet.CheckAddressOverlap(addr, ignoreIfaceNames)
+	}
+	return err
+}
diff --git a/weave b/weave
index 089b0153..ffe8571b 100755
--- a/weave
+++ b/weave
@@ -1251,7 +1251,7 @@ collect_dns_add_remove_args() {
 ######################################################################
 
 check_overlap() {
-    ! command_exists netcheck || netcheck --ignore-iface=$BRIDGE $1
+    ! command_exists weaveutil || weaveutil netcheck $1 $BRIDGE
 }
 
 # Claim addresses for a container in IPAM.  Expects to be called from