diff --git a/Cargo.lock b/Cargo.lock
index 7c0f4b68..f0ea773a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1879,7 +1879,7 @@ source = "git+https://github.com/oxidecomputer/dlpi-sys#1d587ea98cf2d36f1b1624b0
 [[package]]
 name = "libfalcon"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/falcon?branch=main#e665229882ff55977436d8ef7e329b0fbf0e76bd"
+source = "git+https://github.com/oxidecomputer/falcon?branch=main#84b8147e03290fa96d8693e5b668e6d032542907"
 dependencies = [
  "anstyle",
  "anyhow",
@@ -1920,7 +1920,7 @@ checksum = "4ec2a862134d2a7d32d7983ddcdd1c4923530833c9f2ea1a44fc5fa473989058"
 [[package]]
 name = "libnet"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/netadm-sys?branch=main#4ceaf96e02acb8258ea4aa403326c08932324835"
+source = "git+https://github.com/oxidecomputer/netadm-sys?branch=main#b76542f77c566690cda628b1f86bfb2021a1a066"
 dependencies = [
  "anyhow",
  "cfg-if",
@@ -1930,6 +1930,7 @@ dependencies = [
  "num_enum 0.5.11",
  "nvpair",
  "nvpair-sys",
+ "oxnet 0.1.0 (git+https://github.com/oxidecomputer/oxnet)",
  "rusty-doors",
  "socket2 0.4.10",
  "thiserror",
@@ -1939,7 +1940,7 @@ dependencies = [
 [[package]]
 name = "libnet"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/netadm-sys#4ceaf96e02acb8258ea4aa403326c08932324835"
+source = "git+https://github.com/oxidecomputer/netadm-sys#b76542f77c566690cda628b1f86bfb2021a1a066"
 dependencies = [
  "anyhow",
  "cfg-if",
@@ -1949,6 +1950,7 @@ dependencies = [
  "num_enum 0.5.11",
  "nvpair",
  "nvpair-sys",
+ "oxnet 0.1.0 (git+https://github.com/oxidecomputer/oxnet)",
  "rusty-doors",
  "socket2 0.4.10",
  "thiserror",
@@ -2332,7 +2334,7 @@ dependencies = [
  "omicron-passwords",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
- "oxnet",
+ "oxnet 0.1.0 (git+https://github.com/oxidecomputer/oxnet?branch=main)",
  "progenitor",
  "regress",
  "reqwest",
@@ -2366,7 +2368,7 @@ dependencies = [
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "openssl",
- "oxnet",
+ "oxnet 0.1.0 (git+https://github.com/oxidecomputer/oxnet?branch=main)",
  "parse-display",
  "schemars",
  "serde",
@@ -2576,7 +2578,7 @@ dependencies = [
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "once_cell",
- "oxnet",
+ "oxnet 0.1.0 (git+https://github.com/oxidecomputer/oxnet?branch=main)",
  "parse-display",
  "progenitor",
  "progenitor-client",
@@ -2833,7 +2835,18 @@ dependencies = [
 [[package]]
 name = "oxnet"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/oxnet?branch=main#5d09ba3c465337e29edc5830c950b8a77931fdfd"
+source = "git+https://github.com/oxidecomputer/oxnet?branch=main#2612d2203effcfdcbf83778a77f1bfd03fe6ed24"
+dependencies = [
+ "ipnetwork",
+ "schemars",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "oxnet"
+version = "0.1.0"
+source = "git+https://github.com/oxidecomputer/oxnet#2612d2203effcfdcbf83778a77f1bfd03fe6ed24"
 dependencies = [
  "ipnetwork",
  "schemars",
@@ -3132,7 +3145,7 @@ dependencies = [
 [[package]]
 name = "progenitor"
 version = "0.7.0"
-source = "git+https://github.com/oxidecomputer/progenitor?branch=main#55d8b98eac9ca85ba9770b608f7ef62d33140217"
+source = "git+https://github.com/oxidecomputer/progenitor?branch=main#1ca04dedc3227be7204e61982006c13a89b5a486"
 dependencies = [
  "progenitor-client",
  "progenitor-impl",
@@ -3143,7 +3156,7 @@ dependencies = [
 [[package]]
 name = "progenitor-client"
 version = "0.7.0"
-source = "git+https://github.com/oxidecomputer/progenitor?branch=main#55d8b98eac9ca85ba9770b608f7ef62d33140217"
+source = "git+https://github.com/oxidecomputer/progenitor?branch=main#1ca04dedc3227be7204e61982006c13a89b5a486"
 dependencies = [
  "bytes",
  "futures-core",
@@ -3157,7 +3170,7 @@ dependencies = [
 [[package]]
 name = "progenitor-impl"
 version = "0.7.0"
-source = "git+https://github.com/oxidecomputer/progenitor?branch=main#55d8b98eac9ca85ba9770b608f7ef62d33140217"
+source = "git+https://github.com/oxidecomputer/progenitor?branch=main#1ca04dedc3227be7204e61982006c13a89b5a486"
 dependencies = [
  "getopts",
  "heck 0.5.0",
@@ -3179,7 +3192,7 @@ dependencies = [
 [[package]]
 name = "progenitor-macro"
 version = "0.7.0"
-source = "git+https://github.com/oxidecomputer/progenitor?branch=main#55d8b98eac9ca85ba9770b608f7ef62d33140217"
+source = "git+https://github.com/oxidecomputer/progenitor?branch=main#1ca04dedc3227be7204e61982006c13a89b5a486"
 dependencies = [
  "openapiv3",
  "proc-macro2",
@@ -3991,7 +4004,7 @@ dependencies = [
  "omicron-common",
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
- "oxnet",
+ "oxnet 0.1.0 (git+https://github.com/oxidecomputer/oxnet?branch=main)",
  "progenitor",
  "regress",
  "reqwest",
@@ -5527,7 +5540,7 @@ dependencies = [
 [[package]]
 name = "ztest"
 version = "0.1.0"
-source = "git+https://github.com/oxidecomputer/falcon?branch=main#e665229882ff55977436d8ef7e329b0fbf0e76bd"
+source = "git+https://github.com/oxidecomputer/falcon?branch=main#84b8147e03290fa96d8693e5b668e6d032542907"
 dependencies = [
  "anyhow",
  "libnet 0.1.0 (git+https://github.com/oxidecomputer/netadm-sys?branch=main)",
diff --git a/ddm/src/sys.rs b/ddm/src/sys.rs
index da4a4fc2..63c12597 100644
--- a/ddm/src/sys.rs
+++ b/ddm/src/sys.rs
@@ -11,7 +11,7 @@ use dendrite_common::ports::RearPort;
 use dpd_client::types;
 use dpd_client::Client;
 use dpd_client::ClientState;
-use libnet::{IpPrefix, Ipv4Prefix, Ipv6Prefix};
+use libnet::{IpNet, Ipv4Net, Ipv6Net};
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use slog::Logger;
@@ -94,17 +94,11 @@ impl From<Route> for libnet::route::Route {
     }
 }
 
-impl From<Route> for IpPrefix {
-    fn from(r: Route) -> IpPrefix {
+impl From<Route> for IpNet {
+    fn from(r: Route) -> IpNet {
         match r.dest {
-            IpAddr::V4(a) => IpPrefix::V4(Ipv4Prefix {
-                addr: a,
-                mask: r.prefix_len,
-            }),
-            IpAddr::V6(a) => IpPrefix::V6(Ipv6Prefix {
-                addr: a,
-                mask: r.prefix_len,
-            }),
+            IpAddr::V4(a) => Ipv4Net::new(a, r.prefix_len).unwrap().into(),
+            IpAddr::V6(a) => Ipv6Net::new(a, r.prefix_len).unwrap().into(),
         }
     }
 }
diff --git a/mg-lower/src/dendrite.rs b/mg-lower/src/dendrite.rs
index 4aa7036e..8517c165 100644
--- a/mg-lower/src/dendrite.rs
+++ b/mg-lower/src/dendrite.rs
@@ -14,8 +14,7 @@ use dpd_client::Client as DpdClient;
 use dpd_client::Ipv4Cidr;
 use dpd_client::Ipv6Cidr;
 use http::StatusCode;
-use libnet::Ipv6Prefix;
-use libnet::{get_route, IpPrefix, Ipv4Prefix};
+use libnet::{get_route, IpNet};
 use rdb::Path;
 use rdb::Prefix;
 use slog::{error, warn, Logger};
@@ -333,10 +332,7 @@ fn test_tfport_parser() {
 fn get_port_and_link(
     nexthop: IpAddr,
 ) -> Result<(PortId, types::LinkId), Error> {
-    let prefix = match nexthop {
-        IpAddr::V4(addr) => IpPrefix::V4(Ipv4Prefix { addr, mask: 32 }),
-        IpAddr::V6(addr) => IpPrefix::V6(Ipv6Prefix { addr, mask: 128 }),
-    };
+    let prefix = IpNet::host_net(nexthop);
     let sys_route = get_route(prefix, Some(Duration::from_secs(1)))?;
 
     let ifname = match sys_route.ifx {