diff --git a/README.md b/README.md
index 134b95a..d088b65 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,14 @@ make
 ## How to run:
 
 ```
-sudo tcpdump -n -l dst net 1.2.3.4/32 $(for a in $(jq .prefixes < goog.json  | grep ipv4Prefix | cut -f2 -d: | sed s/\"//g); do echo or dst net $a; done)  |  ./teller 
+sudo tcpdump -n -l dst net 192.0.2.1/32 $(for a in $(jq .prefixes < goog.json  | grep ipv4Prefix | cut -f2 -d: | sed s/\"//g); do echo or dst net $a; done)  |  ./teller 
 ```
 
 And then cry.
+
+## Data source
+The list of Google services IP addresses can be found on [this Google
+support page](https://support.google.com/a/answer/10026322?hl=en).
+
+Note that this splits out Google services and Google cloud user IP
+addresses.