diff --git a/netconf-service/netconf-master.js b/netconf-service/netconf-master.js
index fd6aae55d..f5c0d223a 100644
--- a/netconf-service/netconf-master.js
+++ b/netconf-service/netconf-master.js
@@ -527,13 +527,24 @@ function doNetconfRequest(message)
 					response.data['error'] = 'ACCESS_DENIED'; // unable to generate certificate
 				} else {
 					var netconf = new Dictionary();
+
 					netconf.data[ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES] = network['etherTypes'];
 					netconf.data[ZT_NETWORKCONFIG_DICT_KEY_NETWORK_ID] = nwid;
 					netconf.data[ZT_NETWORKCONFIG_DICT_KEY_TIMESTAMP] = Date.now().toString(16);
 					netconf.data[ZT_NETWORKCONFIG_DICT_KEY_ISSUED_TO] = peerId.address();
-					//netconf.data[ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_PREFIX_BITS] = 0;
-					//netconf.data[ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_DEPTH] = 0;
-					//netconf.data[ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_RATES] = '';
+					if (network['p5MulticastPrefixBits'])
+						netconf.data[ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_PREFIX_BITS] = network['p5MulticastPrefixBits'];
+					if (network['p5MulticastDepth'])
+						netconf.data[ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_DEPTH] = network['p5MulticastDepth'];
+					if (network['multicastRates']) {
+						var ratesD = new Dictionary();
+						var ratesJ = JSON.parse(network['multicastRates']);
+						for(var k in ratesJ) {
+							if ((k)&&(ratesJ[k]))
+								ratesD.data[k] = ratesJ[k];
+						}
+						netconf.data[ZT_NETWORKCONFIG_DICT_KEY_MULTICAST_RATES] = ratesD.toString();
+					}
 					netconf.data[ZT_NETWORKCONFIG_DICT_KEY_PRIVATE] = privateNetwork ? '1' : '0';
 					if (network['name'])
 						netconf.data[ZT_NETWORKCONFIG_DICT_KEY_NAME] = network['name'];
@@ -549,6 +560,7 @@ function doNetconfRequest(message)
 					netconf.data[ZT_NETWORKCONFIG_DICT_KEY_ALLOW_PASSIVE_BRIDGING] = ztDbTrue(network['allowPassiveBridging']) ? '1' : '0';
 					if ((activeBridges)&&(activeBridges.length > 0))
 						netconf.data[ZT_NETWORKCONFIG_DICT_KEY_ACTIVE_BRIDGES] = activeBridges; // comma-delimited list
+
 					response.data['netconf'] = netconf.toString();
 				}
 
diff --git a/netconf-service/redis-schema.md b/netconf-service/redis-schema.md
index 4d1fc2c3a..4a1dff9a7 100644
--- a/netconf-service/redis-schema.md
+++ b/netconf-service/redis-schema.md
@@ -52,7 +52,7 @@ Network records are used by the netconf master to issue network configuration in
 
 ### zt1:network:\<nwid\>:~
 
-Each network has a network record indexed by its 64-bit network ID in lower-case hexadecimal.
+Each network has a network record indexed by its 64-bit network ID in lower-case hexadecimal. Unless otherwise indicated all integer values are in hexadecimal.
 
 - !R id :: must be \<nwid\>
 - !M name :: network's globally unique short name, which can contain only characters valid in an e-mail address. It's the job of the code that populates this DB to ensure that this is globally unique.
@@ -63,16 +63,22 @@ Each network has a network record indexed by its 64-bit network ID in lower-case
 - R infrastructure :: if true, network can't be deleted through API or web UI
 - M private :: if true, network requires authentication
 - R creationTime :: timestamp of network creation
-- M etherTypes :: comma-delimited list of *hexadecimal* integers indicating Ethernet types permitted on network
+- M etherTypes :: comma-delimited list of integers indicating Ethernet types permitted on network
 - M enableBroadcast :: if true, ff:ff:ff:ff:ff:ff is enabled network-wide
 - M v4AssignMode :: 'none' (or null/empty/etc.), 'zt', 'dhcp'
 - M v4AssignPool :: network/bits from which to assign IPs
 - M v6AssignMode :: 'none' (or null/empty/etc.), 'zt', 'v6native', 'dhcp6'
 - M v6AssignPool :: network/bits from which to assign IPs
 - M allowPassiveBridging :: if true, allow passive bridging
+- M multicastAlgorithm :: currently only 'p5' is valid, or empty/missing for default
+- M p5MulticastPrefixBits :: P5 multicast algorithm: prefix bits, 1-8 or 0 for default
+- M p5MulticastDepth :: P5 multicast algorithm: depth (TTL) in or 0 for default
+- M multicastRates :: packed JSON containing multicast rates (see below)
 - M subscriptions :: comma-delimited list of subscriptions for this network
 - M ui :: arbitrary field that can be used by the UI to store stuff
 
+Multicast rates are encoded as a JSON document. Each key is a multicast group in "MAC/ADI" format (e.g. *ff:ff:ff:ff:ff:ff/0*), and each value is a comma-delimited tuple of hex integer values: preload, max balance, and rate of accrual in bytes per second. An entry for *0* (or *0/0* or *00:00:00:00:00:00/0*) indicates the default setting for all unspecified multicast groups. Setting a rate limit like *ffffffff,ffffffff,ffffffff* as default will effectively turn off rate limits.
+
 ### zt1:network:\<nwid\>:member:\<address\>:~
 
 For private networks, each member of the network must have a record that indicates whether it is allowed to communicate. The address is the 10-digit lower-case hexadecimal ZeroTier address.
diff --git a/node/MAC.hpp b/node/MAC.hpp
index cd749911d..e4f69aa6a 100644
--- a/node/MAC.hpp
+++ b/node/MAC.hpp
@@ -158,6 +158,8 @@ public:
 	inline void fromString(const char *s)
 	{
 		char tmp[8];
+		for(int i=0;i<6;++i)
+			tmp[i] = (char)0;
 		Utils::unhex(s,tmp,6);
 		setTo(tmp,6);
 	}
diff --git a/node/MulticastGroup.hpp b/node/MulticastGroup.hpp
index 659b05d86..cdb8b6db0 100644
--- a/node/MulticastGroup.hpp
+++ b/node/MulticastGroup.hpp
@@ -124,13 +124,11 @@ public:
 	{
 		char hex[17];
 		unsigned int hexlen = 0;
-		while ((*s)&&(*s != '/')&&(hexlen < sizeof(hex) - 1))
+		while ((*s)&&(*s != '/')&&(hexlen < (sizeof(hex) - 1)))
 			hex[hexlen++] = *s;
 		hex[hexlen] = (char)0;
 		_mac.fromString(hex);
-		if (*s == '/')
-			_adi = (uint32_t)Utils::hexStrToULong(++s);
-		else _adi = 0;
+		_adi = (*s == '/') ? (uint32_t)Utils::hexStrToULong(s + 1) : (uint32_t)0;
 	}
 
 	/**