diff --git a/engine/swarm/ingress.md b/engine/swarm/ingress.md
index 97cbf6b536..00203aa1ca 100644
--- a/engine/swarm/ingress.md
+++ b/engine/swarm/ingress.md
@@ -72,15 +72,46 @@ $ docker service update \
 You can use `docker service inspect` to view the service's published port. For
 instance:
 
-```bash{% raw %}
+```bash
+{% raw %}
 $ docker service inspect --format="{{json .Endpoint.Spec.Ports}}" my-web
 
 [{"Protocol":"tcp","TargetPort":80,"PublishedPort":8080}]
-{% endraw %}```
+{% endraw %}
+```
 
 The output shows the `<TARGET-PORT>` from the containers and the
 `<PUBLISHED-PORT>` where nodes listen for requests for the service.
 
+### Publish a port for TCP only or UCP only
+
+By default, when you publish a port, it is a TCP port. You can
+specifically publish a UDP port instead of or in addition to a TCP port. When
+you publish both TCP and UDP ports, Docker 1.12.2 and earlier require you to
+add the suffix `/tcp` for TCP ports. Otherwise it is optional.
+
+#### TCP only
+
+The following two commands are equivalent.
+
+```bash
+$ docker service create --name dns-cache -p 53:53 dns-cache
+
+$ docker service create --name dns-cache -p 53:53/tcp dns-cache
+```
+
+#### TCP and UDP
+
+```bash
+$ docker service create --name dns-cache -p 53:53/tcp -p 53:53/udp dns-cache
+```
+
+#### UDP only
+
+```bash
+$ docker service create --name dns-cache -p 53:53/udp dns-cache
+```
+
 ## Configure an external load balancer
 
 You can configure an external load balancer to route requests to a swarm