diff --git a/ping.proto b/ping.proto
index 421566a..0b47248 100644
--- a/ping.proto
+++ b/ping.proto
@@ -17,8 +17,9 @@ message Ping {
 
   // Per-peer probe-failure counters accumulated since the previous
   // Ping. The key is the peer Node's IPv4 address in dotted form
-  // ("203.0.113.7"); the value is the number of probes that failed
-  // (timeouts, refusals, etc.). Forwarded to the Hub so that
-  // unreachable Nodes can be retired.
+  // ("203.0.113.7"), derived from the four raw bytes of Peer.ip
+  // or Property.ip_bytes; the value is the number of probes that
+  // failed (timeouts, refusals, etc.). Forwarded to the Hub so
+  // that unreachable Nodes can be retired.
   map<string, uint32> canaries = 2;
 }
diff --git a/pong.proto b/pong.proto
index 6220922..58c197d 100644
--- a/pong.proto
+++ b/pong.proto
@@ -32,8 +32,17 @@ message Property {
   // Public IPv4 of the Node currently backing this slot, in dotted
   // form ("203.0.113.7"). Empty / "0.0.0.0" while the slot is
   // detached.
+  //
+  // Deprecated: use ip_bytes (field 9). Kept on the wire until all
+  // consumers — iOS, Android, Huawei, and Node — have migrated.
   string ip = 4;
 
+  // Public IPv4 of the Node currently backing this slot, as four
+  // raw bytes in network byte order. Matches the encoding of
+  // Peer.ip and Welcome.ip so that clients can compare addresses
+  // without a format conversion.
+  bytes ip_bytes = 9;
+
   // TCP port to dial on the backing Node. Always 443 in production
   // but kept explicit so a Node may move to a different port
   // without a client release.