diff --git a/node/Network.cpp b/node/Network.cpp
index 43cd83a20..ad85cd775 100644
--- a/node/Network.cpp
+++ b/node/Network.cpp
@@ -142,6 +142,9 @@ void Network::requestConfiguration()
 
 void Network::addMembershipCertificate(const CertificateOfMembership &cert)
 {
+	if (!cert) // sanity check
+		return;
+
 	Mutex::Lock _l(_lock);
 
 	// We go ahead and accept certs provisionally even if _isOpen is true, since
@@ -149,8 +152,10 @@ void Network::addMembershipCertificate(const CertificateOfMembership &cert)
 	// These will be purged on clean() for open networks eventually.
 
 	CertificateOfMembership &old = _membershipCertificates[cert.issuedTo()];
-	if (cert.timestamp() >= old.timestamp())
+	if (cert.timestamp() >= old.timestamp()) {
+		TRACE("got new certificate for %s on network %.16llx",cert.issuedTo().toString().c_str(),cert.networkId());
 		old = cert;
+	}
 }
 
 bool Network::isAllowed(const Address &peer) const
@@ -230,6 +235,7 @@ void Network::_pushMembershipCertificate(const Address &peer,bool force,uint64_t
 	uint64_t &lastPushed = _lastPushedMembershipCertificate[peer];
 	if ((force)||((now - lastPushed) > pushTimeout)) {
 		lastPushed = now;
+		TRACE("pushing membership cert for %.16llx to %s",(unsigned long long)_id,peer.toString().c_str());
 
 		Packet outp(peer,_r->identity.address(),Packet::VERB_NETWORK_MEMBERSHIP_CERTIFICATE);
 		_config->com().serialize(outp);
diff --git a/node/Network.hpp b/node/Network.hpp
index ecee77c13..696aa84b8 100644
--- a/node/Network.hpp
+++ b/node/Network.hpp
@@ -322,6 +322,8 @@ public:
 	}
 
 	/**
+	 * Get current network config or return NULL
+	 *
 	 * @return Network configuration -- may be NULL
 	 */
 	inline SharedPtr<NetworkConfig> config2() const
diff --git a/node/PacketDecoder.cpp b/node/PacketDecoder.cpp
index 9f348bedf..43ac8c29e 100644
--- a/node/PacketDecoder.cpp
+++ b/node/PacketDecoder.cpp
@@ -847,8 +847,10 @@ bool PacketDecoder::_doNETWORK_CONFIG_REFRESH(const RuntimeEnvironment *_r,const
 		while ((ptr + sizeof(uint64_t)) <= size()) {
 			uint64_t nwid = at<uint64_t>(ptr); ptr += sizeof(uint64_t);
 			SharedPtr<Network> nw(_r->nc->network(nwid));
-			if ((nw)&&(source() == nw->controller())) // only respond to requests from controller
+			if ((nw)&&(source() == nw->controller())) { // only respond to requests from controller
+				TRACE("NETWORK_CONFIG_REFRESH from %s, refreshing network %.16llx",source().toString().c_str(),nwid);
 				nw->requestConfiguration();
+			}
 		}
 	} catch (std::exception &exc) {
 		TRACE("dropped NETWORK_CONFIG_REFRESH from %s(%s): unexpected exception: %s",source().toString().c_str(),_remoteAddress.toString().c_str(),exc.what());