diff --git a/go/cmd/zerotier/cli/help.go b/go/cmd/zerotier/cli/help.go
index ca988224d..b41920954 100644
--- a/go/cmd/zerotier/cli/help.go
+++ b/go/cmd/zerotier/cli/help.go
@@ -40,35 +40,41 @@ Commands:
   selftest                             Run internal tests
   service                              Start as service
   status                               Show ZeroTier status and config
-  peers                                Show VL1 peers
-  roots                                Show configured VL1 root servers
-  addroot <identity> [IP/port]         Add VL1 root
+  peers                                Show VL1 peers and link information
+  join <network ID>                    Join a virtual network
+  leave <network ID>                   Leave a virtual network
+  networks                             List joined VL2 virtual networks
+  network <network ID>                 Show verbose network info
+  addroot <identity> [IP/port]         Add VL1 root with optional bootstrap IP
   removeroot <identity|address>        Remove VL1 root server
+  roots                                Show configured VL1 root servers
+  set <network ID> [option] [value]    Get or set a network config option
+    manageips <boolean>                Is IP management allowed?
+    manageroutes <boolean>             Is route management allowed?
+    globalips <boolean>                Allow assignment of global IPs?
+    globalroutes <boolean>             Can global IP space routes be set?
+    defaultroute <boolean>             Can default route be overridden?
+  set [option] [value]                 Get or set a service config option
+    phy <IP/bits> blacklist <boolean>  Set or clear blacklist for CIDR
+    phy <IP/bits> trust <path ID/0>    Set or clear trusted path ID for CIDR
+  * port <port>                        Set primary port for P2P links
+  * secondaryport <port/0>             Set secondary P2P port (0 disables)
+    portsearch <boolean>               Enable/disable port search on startup
+    portmapping <boolean>              Enable/disable use of uPnP/NAT-PMP
   identity <command> [args]            Identity management commands
     new [c25519|p384]                  Create identity (including secret)
     getpublic <identity>               Extract only public part of identity
     validate <identity>                Locally validate an identity
     sign <identity> <file>             Sign a file with an identity's key
     verify <identity> <file> <sig>     Verify a signature
-  networks                             List joined VL2 virtual networks
-  network <network ID>                 Show verbose network info
-  join <network ID>                    Join a virtual network
-  leave <network ID>                   Leave a virtual network
-  set <network ID> <option> <value>    Set a network local config option
-    manageips <boolean>                Is IP management allowed?
-    manageroutes <boolean>             Is route management allowed?
-    globalips <boolean>                Allow assignment of global IPs?
-    globalroutes <boolean>             Can global IP space routes be set?
-    defaultroute <boolean>             Can default route be overridden?
-  set <local config option> <value>    Set a local configuration option
-    phy <IP/bits> blacklist <boolean>  Set or clear blacklist for CIDR
-    phy <IP/bits> trust <path ID/0>    Set or clear trusted path ID for CIDR
-    virt <address> try <IP/port> [...] Set explicit IPs for reaching a peer
-    port <port>                        Set primary local port for VL1 P2P
-    secondaryport <port/0>             Set or disable secondary VL1 P2P port
-    tertiaryport <port/0>              Set or disable tertiary VL1 P2P port
-    portsearch <boolean>               Set or disable port search on startup
-    portmapping <boolean>              Set or disable use of uPnP/NAT-PMP
+
+The 'service' command does not exit until the service receives a signal.
+This is typically run from launchd (Mac), systemd or init (Linux), etc.
+
+If 'set' is followed by a 16-digit hex number it will get/set network config
+options. Otherwise it will get/set service options. Run with no arguments to
+see all options. Settings with a '*' alongside require a service restart.
+A few rarely used options require manual editing of local.conf and restart.
 
 Most commands require a secret token to permit control of a running ZeroTier
 service. The CLI will automatically try to read this token from the
diff --git a/go/go.mod b/go/go.mod
index 5629b10cb..0bc31d136 100644
--- a/go/go.mod
+++ b/go/go.mod
@@ -5,5 +5,5 @@ go 1.13
 require (
 	github.com/Microsoft/go-winio v0.4.14
 	github.com/hectane/go-acl v0.0.0-20190604041725-da78bae5fc95
-	golang.org/x/sys v0.0.0-20200107162124-548cf772de50 // indirect
+	golang.org/x/sys v0.0.0-20200120151820-655fe14d7479 // indirect
 )
diff --git a/go/go.sum b/go/go.sum
index 89556cb2e..af2098006 100644
--- a/go/go.sum
+++ b/go/go.sum
@@ -15,3 +15,5 @@ golang.org/x/sys v0.0.0-20190529164535-6a60838ec259 h1:so6Hr/LodwSZ5UQDu/7PmQiDe
 golang.org/x/sys v0.0.0-20190529164535-6a60838ec259/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200107162124-548cf772de50 h1:YvQ10rzcqWXLlJZ3XCUoO25savxmscf4+SC+ZqiCHhA=
 golang.org/x/sys v0.0.0-20200107162124-548cf772de50/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200120151820-655fe14d7479 h1:LhLiKguPgZL+Tglay4GhVtfF0kb8cvOJ0dHTCBO8YNI=
+golang.org/x/sys v0.0.0-20200120151820-655fe14d7479/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
diff --git a/go/pkg/zerotier/localconfig.go b/go/pkg/zerotier/localconfig.go
index f9995612b..fbb7a41f3 100644
--- a/go/pkg/zerotier/localconfig.go
+++ b/go/pkg/zerotier/localconfig.go
@@ -51,9 +51,6 @@ type LocalConfigSettings struct {
 	// SecondaryPort is the secondary UDP port, set to 0 to disbale (picked at random by default)
 	SecondaryPort int `json:"secondaryPort"`
 
-	// TertiaryPort is a third UDP port, set to 0 to disable (picked at random by default)
-	TertiaryPort int `json:"tertiaryPort"`
-
 	// PortSearch causes ZeroTier to try other ports automatically if it can't bind to configured ports
 	PortSearch bool `json:"portSearch"`
 
@@ -105,7 +102,6 @@ func (lc *LocalConfig) Read(p string, saveDefaultsIfNotExist bool,isTotallyNewNo
 			lc.Settings.PrimaryPort = 9993
 		}
 		lc.Settings.SecondaryPort = unassignedPrivilegedPorts[randomUInt() % uint(len(unassignedPrivilegedPorts))]
-		lc.Settings.TertiaryPort = int(32768 + (randomUInt() % 16384))
 		lc.Settings.PortSearch = true
 		lc.Settings.PortMapping = true
 		lc.Settings.LogSizeMax = 128
diff --git a/go/pkg/zerotier/node.go b/go/pkg/zerotier/node.go
index 568085cde..4be766f2b 100644
--- a/go/pkg/zerotier/node.go
+++ b/go/pkg/zerotier/node.go
@@ -191,26 +191,6 @@ func NewNode(basePath string) (n *Node, err error) {
 			}
 		}
 
-		if n.localConfig.Settings.TertiaryPort > 0 {
-			portCheckCount = 0
-			origPort = n.localConfig.Settings.TertiaryPort
-			for portCheckCount < 256 {
-				portCheckCount++
-				if checkPort(n.localConfig.Settings.TertiaryPort) {
-					if n.localConfig.Settings.TertiaryPort != origPort {
-						n.log.Printf("tertiary port %d unavailable, found port %d (port search enabled)", origPort, n.localConfig.Settings.TertiaryPort)
-					}
-					break
-				}
-				n.log.Printf("tertiary port %d unavailable, trying a random port (port search enabled)", n.localConfig.Settings.TertiaryPort)
-				n.localConfig.Settings.TertiaryPort = int(32768 + (randomUInt() % 16384))
-				portsChanged = true
-			}
-			if portCheckCount == 256 {
-				n.localConfig.Settings.TertiaryPort = 0
-			}
-		}
-
 		if portsChanged {
 			_ = n.localConfig.Write(n.localConfigPath)
 		}
@@ -307,9 +287,6 @@ func NewNode(basePath string) (n *Node, err error) {
 				if n.localConfig.Settings.SecondaryPort > 0 && n.localConfig.Settings.SecondaryPort < 65536 {
 					ports = append(ports, n.localConfig.Settings.SecondaryPort)
 				}
-				if n.localConfig.Settings.TertiaryPort > 0 && n.localConfig.Settings.TertiaryPort < 65536 {
-					ports = append(ports, n.localConfig.Settings.TertiaryPort)
-				}
 
 				// Open or close locally bound UDP ports for each local interface address.
 				// This opens ports if they are not already open and then closes ports if
@@ -452,7 +429,7 @@ func (n *Node) SetLocalConfig(lc *LocalConfig) (restartRequired bool, err error)
 		}
 	}
 
-	if n.localConfig.Settings.PrimaryPort != lc.Settings.PrimaryPort || n.localConfig.Settings.SecondaryPort != lc.Settings.SecondaryPort || n.localConfig.Settings.TertiaryPort != lc.Settings.TertiaryPort {
+	if n.localConfig.Settings.PrimaryPort != lc.Settings.PrimaryPort || n.localConfig.Settings.SecondaryPort != lc.Settings.SecondaryPort {
 		restartRequired = true
 	}
 	if lc.Settings.LogSizeMax < 0 {
diff --git a/go/vendor/golang.org/x/sys/windows/types_windows.go b/go/vendor/golang.org/x/sys/windows/types_windows.go
index aefb7fc39..809fff0b4 100644
--- a/go/vendor/golang.org/x/sys/windows/types_windows.go
+++ b/go/vendor/golang.org/x/sys/windows/types_windows.go
@@ -681,19 +681,26 @@ const (
 	AF_UNSPEC  = 0
 	AF_UNIX    = 1
 	AF_INET    = 2
-	AF_INET6   = 23
 	AF_NETBIOS = 17
+	AF_INET6   = 23
+	AF_IRDA    = 26
+	AF_BTH     = 32
 
 	SOCK_STREAM    = 1
 	SOCK_DGRAM     = 2
 	SOCK_RAW       = 3
+	SOCK_RDM       = 4
 	SOCK_SEQPACKET = 5
 
-	IPPROTO_IP   = 0
-	IPPROTO_ICMP = 1
-	IPPROTO_IPV6 = 0x29
-	IPPROTO_TCP  = 6
-	IPPROTO_UDP  = 17
+	IPPROTO_IP      = 0
+	IPPROTO_ICMP    = 1
+	IPPROTO_IGMP    = 2
+	BTHPROTO_RFCOMM = 3
+	IPPROTO_TCP     = 6
+	IPPROTO_UDP     = 17
+	IPPROTO_IPV6    = 41
+	IPPROTO_ICMPV6  = 58
+	IPPROTO_RM      = 113
 
 	SOL_SOCKET                = 0xffff
 	SO_REUSEADDR              = 4
diff --git a/go/vendor/modules.txt b/go/vendor/modules.txt
index 0bfd12bd2..1227b62ee 100644
--- a/go/vendor/modules.txt
+++ b/go/vendor/modules.txt
@@ -4,5 +4,5 @@ github.com/Microsoft/go-winio/pkg/guid
 # github.com/hectane/go-acl v0.0.0-20190604041725-da78bae5fc95
 github.com/hectane/go-acl
 github.com/hectane/go-acl/api
-# golang.org/x/sys v0.0.0-20200107162124-548cf772de50
+# golang.org/x/sys v0.0.0-20200120151820-655fe14d7479
 golang.org/x/sys/windows