diff --git a/ping.proto b/ping.proto
index 86ca23d..5e495af 100644
--- a/ping.proto
+++ b/ping.proto
@@ -22,5 +22,9 @@ message Ping {
   // unreachable Nodes can be retired. MUST NOT contain more entries
   // than the fleet size (dozens); the Node SHOULD discard or
   // truncate a Ping whose canaries map exceeds that bound to prevent
-  // unbounded map allocation per session.
+  // unbounded map allocation per session. When producing keys from
+  // Peer.ip (four raw bytes, network byte order), the client MUST
+  // convert each byte to its decimal representation and join with
+  // dots before inserting into this map.
+  map<string, uint32> canaries = 2;
 }
diff --git a/pong.proto b/pong.proto
index 7606fa2..ee16b81 100644
--- a/pong.proto
+++ b/pong.proto
@@ -70,6 +70,8 @@ message Property {
 // Node nears expiry.
 message Peer {
   // Public IPv4 of the peer as four raw bytes (network byte order).
+  // Clients MUST convert this to dotted-decimal form
+  // ("203.0.113.7") when using the address as a Ping.canaries key.
   bytes ip = 1;
 
   // TCP port on which the peer accepts client connections. Valid