diff --git a/cli/documentation/en_US/host/host b/cli/documentation/en_US/host/host
new file mode 100755
index 0000000..6ee832a
--- /dev/null
+++ b/cli/documentation/en_US/host/host
@@ -0,0 +1,23 @@
+The host command enters a submode which
+allows configuration for the identified device.  The command's
+parameters identify a unique device, which may require
+the use of the optional address-space and vlan parameters.
+
+The identified device does not
+currently need to be known to the controller, providing
+for pre-configuraion of hosts.
+
+Various host configuration within the submode includes
+host-alias, and host security associations.
+
+If completion is requested for the hosts, the resulting 
+entries shown are the collection of currently known hosts,
+and the collection of configured hosts.
+
+The mac address identifying the specific host is
+case insensitive.
+
+The 'no' variation of the host command will remove all configured
+details for the identified device.  If a 'show host' is issued
+afterwards, the host will still appear if the controller has any
+operational state assocaited with the host.
diff --git a/cli/documentation/en_US/host/host-address-space b/cli/documentation/en_US/host/host-address-space
new file mode 100755
index 0000000..c628606
--- /dev/null
+++ b/cli/documentation/en_US/host/host-address-space
@@ -0,0 +1,6 @@
+The optional address-space association for host allows the
+identified mac to be bound to a specific isolated address
+space. 
+
+When this optional parameter is not included, the mac
+is associated with the address-space named 'default'.
diff --git a/cli/documentation/en_US/host/host-alias b/cli/documentation/en_US/host/host-alias
new file mode 100755
index 0000000..4e9dda9
--- /dev/null
+++ b/cli/documentation/en_US/host/host-alias
@@ -0,0 +1,9 @@
+The host-alias command allows associating a more identifiable
+name with the host identified by entering the host submode.
+Host aliases must start with an alphabetic character, and
+can continue with alphanumerics, '_', or '-'.  The maximum length of a
+host alias is 255 characters.
+
+Once an alias is associated with a host, various show commands
+will provide the alias along with, or instead of the mac
+address to identify the host.
diff --git a/cli/documentation/en_US/host/host-alias-example b/cli/documentation/en_US/host/host-alias-example
new file mode 100755
index 0000000..8bae8dd
--- /dev/null
+++ b/cli/documentation/en_US/host/host-alias-example
@@ -0,0 +1,5 @@
+host-alias my-mac-book
+  Associate a friendly name with the current host definition
+
+no host-alias my-mac-book
+  Remove a hostname association from this host
diff --git a/cli/documentation/en_US/host/host-example b/cli/documentation/en_US/host/host-example
new file mode 100755
index 0000000..8cfd89f
--- /dev/null
+++ b/cli/documentation/en_US/host/host-example
@@ -0,0 +1,13 @@
+host 00:00:00:00:00:01
+  Define a host with a specific MAC, and enter its configuration sub-mode
+
+no host 00:00:00:00:00:01
+  Delete a definition for a specific host
+
+host address-space default 00:00:00:00:00:02
+  Define a host and bind it to a specific address space
+
+host vlan 42 00:00:00:00:00:03
+  Define a host and bind it to a specific VLAN.
+  Note here that VLAN associations are only valid with the 'default' address space.
+
diff --git a/cli/documentation/en_US/host/host-vlan b/cli/documentation/en_US/host/host-vlan
new file mode 100755
index 0000000..ef17d3b
--- /dev/null
+++ b/cli/documentation/en_US/host/host-vlan
@@ -0,0 +1,8 @@
+The optional vlan parameter allows the identified mac
+address to be associated with a specific vlan.
+
+When this optional parameter isn't included, no vlan
+is associated with the mac.   
+
+Currently, the vlan may only be associated with a mac
+for the associated address-space 'default'.
diff --git a/cli/documentation/en_US/host/security b/cli/documentation/en_US/host/security
new file mode 100755
index 0000000..0f88358
--- /dev/null
+++ b/cli/documentation/en_US/host/security
@@ -0,0 +1,16 @@
+The security command within the host submode is used to
+bind ip address and attachment points for the hosts
+identified by the submode.
+
+What a host is presented to the controller, the attachment
+point of the host is also identified.   When the security
+command is used to constrain the attachment point, the
+controller can use the configured details to choose whether
+it will allow the host to join the network.
+
+When an ip address is bound to the host, no other host
+may use the indicated ip address.   This is implemented
+by snooping arp's and the dhcp protocol.  It is still
+possible for the host to send frames with spoofed
+src ip address, but the destination will not be able
+to reply to these frames.
diff --git a/cli/documentation/en_US/host/security-attachment-point b/cli/documentation/en_US/host/security-attachment-point
new file mode 100755
index 0000000..d3e67cb
--- /dev/null
+++ b/cli/documentation/en_US/host/security-attachment-point
@@ -0,0 +1,3 @@
+The attachment point portion is intended to
+identify the switch or interface name, otherwise
+the host cannot transmit or receive network traffic.
diff --git a/cli/documentation/en_US/host/security-attachment-point-interface b/cli/documentation/en_US/host/security-attachment-point-interface
new file mode 100755
index 0000000..3aa1379
--- /dev/null
+++ b/cli/documentation/en_US/host/security-attachment-point-interface
@@ -0,0 +1,3 @@
+This field is a regular expression, which is used to
+match against an interface name associated with the
+switch.
diff --git a/cli/documentation/en_US/host/security-attachment-point-switch b/cli/documentation/en_US/host/security-attachment-point-switch
new file mode 100755
index 0000000..23b895a
--- /dev/null
+++ b/cli/documentation/en_US/host/security-attachment-point-switch
@@ -0,0 +1,3 @@
+The switch is part of the attachment point description.
+This can be a switch dpid, or an alias identifying a
+single switch.
diff --git a/cli/documentation/en_US/host/security-bind b/cli/documentation/en_US/host/security-bind
new file mode 100755
index 0000000..677df32
--- /dev/null
+++ b/cli/documentation/en_US/host/security-bind
@@ -0,0 +1,3 @@
+The bind keywork of the security policy command 
+is used to configure various associations 
+restricting the behavior of the host.
diff --git a/cli/documentation/en_US/host/security-example b/cli/documentation/en_US/host/security-example
new file mode 100755
index 0000000..e7df254
--- /dev/null
+++ b/cli/documentation/en_US/host/security-example
@@ -0,0 +1,21 @@
+security policy bind ip-address 10.10.10.1
+  When the host sends any ip frames, the src address
+  of these frames must be 10.10.10.1.  
+
+no security policy bind ip-address 10.10.10.1
+  Remove a source-address binding requirement for this host
+
+security policy bind attachment-point ntgr-7328-3
+  The host identified by this submode can only send
+  and receive traffic when it attached to this switch.
+
+no security policy bind attachment-point ntgr-7328-3
+  Remove an attachment point requirement for this host
+
+security policy bind attachment-point ntgr-7328-3 12
+  The host identified by this submode can only send
+  and receive traffic when it attached to this switch and
+  interface named '12'
+
+no security policy bind attachment-point ntgr-7328-3 12
+  Remove an attachment point/interface requirement for this host
diff --git a/cli/documentation/en_US/host/security-ip-address b/cli/documentation/en_US/host/security-ip-address
new file mode 100755
index 0000000..bd7ebcd
--- /dev/null
+++ b/cli/documentation/en_US/host/security-ip-address
@@ -0,0 +1,2 @@
+This identifies an ip address, it will prevent other host's
+from using any other ip address.
diff --git a/cli/documentation/en_US/host/security-policy b/cli/documentation/en_US/host/security-policy
new file mode 100755
index 0000000..7f59bae
--- /dev/null
+++ b/cli/documentation/en_US/host/security-policy
@@ -0,0 +1,2 @@
+The policy keyword is used to configure security
+policies associated with this host.
diff --git a/cli/documentation/en_US/host/show b/cli/documentation/en_US/host/show
new file mode 100755
index 0000000..9c80b0c
--- /dev/null
+++ b/cli/documentation/en_US/host/show
@@ -0,0 +1,8 @@
+The 'show host' command displays details for hosts,
+including the mac address, the associated host alias,
+the address space, ip address, attachment point,
+configured tags and the last time the host was
+serviced by the controller.
+
+The tag column here only displays a synopsis
+of the associated tags.
diff --git a/cli/documentation/en_US/host/show-host b/cli/documentation/en_US/host/show-host
new file mode 100755
index 0000000..6ec8c2a
--- /dev/null
+++ b/cli/documentation/en_US/host/show-host
@@ -0,0 +1,4 @@
+This command variation allows filtering based on
+the provided mac address.  In addition, the hosts
+can be selected either by the switch of their
+attachment point, or the host's associated ip address
diff --git a/cli/documentation/en_US/host/show-host-address-space b/cli/documentation/en_US/host/show-host-address-space
new file mode 100755
index 0000000..e44c026
--- /dev/null
+++ b/cli/documentation/en_US/host/show-host-address-space
@@ -0,0 +1,2 @@
+This positional parameter allows filtering on the
+address space associated with the hosts.
diff --git a/cli/documentation/en_US/host/show-host-all b/cli/documentation/en_US/host/show-host-all
new file mode 100755
index 0000000..df1f462
--- /dev/null
+++ b/cli/documentation/en_US/host/show-host-all
@@ -0,0 +1,3 @@
+The 'all' keyword is a positional parameter replacement
+which allows additional parameters to be included.  
+'all' may not be used as a host alias.
diff --git a/cli/documentation/en_US/host/show-host-by-host-last-seen b/cli/documentation/en_US/host/show-host-by-host-last-seen
new file mode 100755
index 0000000..ea61e5a
--- /dev/null
+++ b/cli/documentation/en_US/host/show-host-by-host-last-seen
@@ -0,0 +1 @@
+Order the output by the time the host was last seen by the controller
diff --git a/cli/documentation/en_US/host/show-host-by-last-seen b/cli/documentation/en_US/host/show-host-by-last-seen
new file mode 100755
index 0000000..d6acdc7
--- /dev/null
+++ b/cli/documentation/en_US/host/show-host-by-last-seen
@@ -0,0 +1 @@
+Order the output by the last seen time of the attachment point
diff --git a/cli/documentation/en_US/host/show-host-by-network-address b/cli/documentation/en_US/host/show-host-by-network-address
new file mode 100755
index 0000000..0aeb157
--- /dev/null
+++ b/cli/documentation/en_US/host/show-host-by-network-address
@@ -0,0 +1 @@
+Order the output by the host's associated ip addresses
diff --git a/cli/documentation/en_US/host/show-host-ipv4 b/cli/documentation/en_US/host/show-host-ipv4
new file mode 100755
index 0000000..729cb28
--- /dev/null
+++ b/cli/documentation/en_US/host/show-host-ipv4
@@ -0,0 +1,7 @@
+The 'ip-address <ip-address>' keyword pair can be used to 
+restrict the host's displayed by the ip-address associaited
+with the currently known hosts.
+
+If completion is requested after the ip-address keyword, the
+list of ip-addresses displayed are the ip-addresses currently
+associated with the known hosts.
diff --git a/cli/documentation/en_US/host/show-host-items b/cli/documentation/en_US/host/show-host-items
new file mode 100755
index 0000000..fe2960f
--- /dev/null
+++ b/cli/documentation/en_US/host/show-host-items
@@ -0,0 +1,10 @@
+This 'show host' variant allows the selection of 
+particular related host details, for example the
+attachment point or the ip address.  
+
+The variant exists to more completely list the
+host's associated attributes.  In the more basic
+version of the command, these columns may have
+abbreviated information (displaying only one
+ip address, for example), to provide a more 
+concise display.
diff --git a/cli/documentation/en_US/host/show-host-mac b/cli/documentation/en_US/host/show-host-mac
new file mode 100755
index 0000000..f8ff48a
--- /dev/null
+++ b/cli/documentation/en_US/host/show-host-mac
@@ -0,0 +1 @@
+This positional parameter allows filtering on the mac address.
diff --git a/cli/documentation/en_US/host/show-host-switch b/cli/documentation/en_US/host/show-host-switch
new file mode 100755
index 0000000..ffac535
--- /dev/null
+++ b/cli/documentation/en_US/host/show-host-switch
@@ -0,0 +1,8 @@
+The 'switch <dpid>' keyword pair can be used to restrict the
+hosts displayed by the identified <dpid>.  The hosts displayed
+will all have attachement points associated with the requested
+<dpid>.
+
+If completion is requested after the 'switch' keyword, the
+list of switches displayed are the switches associated with
+the active attachment points of the known hosts.