diff --git a/Makefile.mac b/Makefile.mac
index 892032435..bace24b21 100644
--- a/Makefile.mac
+++ b/Makefile.mac
@@ -20,12 +20,16 @@ LIBS=ext/bin/libcrypto/mac-x86_combined/libcrypto.a
 
 include objects.mk
 
-all: one launcher mac-tap
+all: one cli launcher mac-tap
 
 one:	$(OBJS)
 	$(CXX) $(CXXFLAGS) -o zerotier-one main.cpp $(OBJS) $(LIBS)
 	$(STRIP) zerotier-one
 
+cli:	$(OBJS)
+	$(CXX) $(CXXFLAGS) -o zerotier-cli cli.cpp $(OBJS) $(LIBS)
+	$(STRIP) zerotier-cli
+
 selftest: $(OBJS)
 	$(CXX) $(CXXFLAGS) -o zerotier-selftest selftest.cpp $(OBJS) $(LIBS)
 	$(STRIP) zerotier-selftest
diff --git a/cli.cpp b/cli.cpp
new file mode 100644
index 000000000..a72a0890c
--- /dev/null
+++ b/cli.cpp
@@ -0,0 +1,124 @@
+/*
+ * ZeroTier One - Global Peer to Peer Ethernet
+ * Copyright (C) 2012-2013  ZeroTier Networks LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * --
+ *
+ * ZeroTier may be used and distributed under the terms of the GPLv3, which
+ * are available at: http://www.gnu.org/licenses/gpl-3.0.html
+ *
+ * If you would like to embed ZeroTier into a commercial application or
+ * redistribute it in a modified binary form, please contact ZeroTier Networks
+ * LLC. Start here: http://www.zerotier.com/
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#ifndef __WINDOWS__
+#include <unistd.h>
+#endif
+
+#include "node/Node.hpp"
+#include "node/Constants.hpp"
+#include "node/Utils.hpp"
+#include "node/Thread.hpp"
+
+using namespace ZeroTier;
+
+static void printHelp(FILE *out,const char *exename)
+{
+	fprintf(out,"Usage: %s [-switches] <command>"ZT_EOL_S,exename);
+	fprintf(out,ZT_EOL_S);
+	fprintf(out,"Switches:"ZT_EOL_S);
+	fprintf(out,"  -t<token>        - Specify token on command line"ZT_EOL_S);
+	fprintf(out,"  -T<file>         - Read token from file"ZT_EOL_S);
+	fprintf(out,ZT_EOL_S);
+	fprintf(out,"Use the 'help' command to get help from ZeroTier One itself."ZT_EOL_S);
+}
+
+static volatile uint64_t lastResultTime = 0ULL;
+static volatile unsigned int numResults = 0;
+
+static void resultHandler(void *arg,unsigned long id,const char *line)
+{
+	lastResultTime = Utils::now();
+	++numResults;
+	fprintf(stdout,"%s"ZT_EOL_S,line);
+}
+
+int main(int argc,char **argv)
+{
+	if (argc <= 1) {
+		printHelp(stdout,argv[0]);
+		return -1;
+	}
+
+	std::string authToken;
+
+	for(int i=1;i<argc;++i) {
+		if (argv[i][0] == '-') {
+			if (strlen(argv[i]) <= 1) {
+				printHelp(stdout,argv[0]);
+				return -1;
+			}
+			switch(argv[i][1]) {
+				case 't':
+					authToken.assign(argv[i] + 2);
+					break;
+				case 'T':
+					if (!Utils::readFile(argv[i] + 2,authToken)) {
+						fprintf(stdout,"FATAL ERROR: unable to read token from '%s'"ZT_EOL_S,argv[i] + 2);
+						return -2;
+					}
+					break;
+				default:
+					return -1;
+			}
+		}
+	}
+
+	if (!authToken.length()) {
+		const char *home = getenv("HOME");
+		if (home) {
+			std::string dotZeroTierAuthToken(home);
+			dotZeroTierAuthToken.push_back(ZT_PATH_SEPARATOR);
+			dotZeroTierAuthToken.append(".zerotierOneAuthToken");
+			if (!Utils::readFile(dotZeroTierAuthToken.c_str(),authToken)) {
+				fprintf(stdout,"FATAL ERROR: no token specified on command line and could not read '%s'"ZT_EOL_S,dotZeroTierAuthToken.c_str());
+				return -2;
+			}
+		}
+	}
+	if (!authToken.length()) {
+		fprintf(stdout,"FATAL ERROR: could not find auth token"ZT_EOL_S);
+		return -2;
+	}
+
+	Node::LocalClient(authToken.c_str(),&resultHandler,(void *)0);
+
+	lastResultTime = Utils::now();
+	while ((Utils::now() - lastResultTime) < 300)
+		Thread::sleep(50);
+
+	if (!numResults) {
+		fprintf(stdout,"ERROR: no results received. Is ZeroTier One running?"ZT_EOL_S);
+		return -1;
+	}
+
+	return 0;
+}
diff --git a/node/Node.cpp b/node/Node.cpp
index 57bb8abc2..f8de7908d 100644
--- a/node/Node.cpp
+++ b/node/Node.cpp
@@ -79,13 +79,27 @@ struct _LocalClientImpl
 	UdpSocket *sock;
 	void (*resultHandler)(void *,unsigned long,const char *);
 	void *arg;
+	InetAddress localDestAddr;
 	Mutex inUseLock;
 };
 
 static void _CBlocalClientHandler(UdpSocket *sock,void *arg,const InetAddress &remoteAddr,const void *data,unsigned int len)
 {
 	_LocalClientImpl *impl = (_LocalClientImpl *)arg;
+	if (!impl)
+		return;
+	if (!impl->resultHandler)
+		return; // sanity check
 	Mutex::Lock _l(impl->inUseLock);
+
+	try {
+		unsigned long convId = 0;
+		std::vector<std::string> results;
+		if (!NodeConfig::decodeControlMessagePacket(impl->key,data,len,convId,results))
+			return;
+		for(std::vector<std::string>::iterator r(results.begin());r!=results.end();++r)
+			impl->resultHandler(impl->arg,convId,r->c_str());
+	} catch ( ... ) {}
 }
 
 Node::LocalClient::LocalClient(const char *authToken,void (*resultHandler)(void *,unsigned long,const char *),void *arg)
@@ -114,6 +128,8 @@ Node::LocalClient::LocalClient(const char *authToken,void (*resultHandler)(void
 		impl->sock = sock;
 		impl->resultHandler = resultHandler;
 		impl->arg = arg;
+		impl->localDestAddr = InetAddress::LO4;
+		impl->localDestAddr.setPort(ZT_CONTROL_UDP_PORT);
 		_impl = impl;
 	} else delete impl;
 }
@@ -131,9 +147,27 @@ Node::LocalClient::~LocalClient()
 unsigned long Node::LocalClient::send(const char *command)
 	throw()
 {
-	uint32_t convId = (uint32_t)rand();
+	if (!_impl)
+		return 0;
+	_LocalClientImpl *impl = (_LocalClientImpl *)_impl;
+	Mutex::Lock _l(impl->inUseLock);
 
-	return convId;
+	try {
+		uint32_t convId = (uint32_t)rand();
+		if (!convId)
+			convId = 1;
+
+		std::vector<std::string> tmp;
+		tmp.push_back(std::string(command));
+		std::vector< Buffer<ZT_NODECONFIG_MAX_PACKET_SIZE> > packets(NodeConfig::encodeControlMessage(impl->key,convId,tmp));
+
+		for(std::vector< Buffer<ZT_NODECONFIG_MAX_PACKET_SIZE> >::iterator p(packets.begin());p!=packets.end();++p)
+			impl->sock->send(impl->localDestAddr,p->data(),p->size(),-1);
+
+		return convId;
+	} catch ( ... ) {
+		return 0;
+	}
 }
 
 struct _NodeImpl
diff --git a/node/Node.hpp b/node/Node.hpp
index bddced585..b716b556f 100644
--- a/node/Node.hpp
+++ b/node/Node.hpp
@@ -49,11 +49,6 @@ public:
 		/**
 		 * Create a new node config client
 		 *
-		 * The result handler will be called from a different thread. Its
-		 * arguments are the request ID generated by send() and each line
-		 * of output. It may be called more than once per request result
-		 * if the command generates more than one line of output.
-		 *
 		 * @param authToken Authentication token
 		 * @param resultHandler Function to call when commands provide results
 		 */
@@ -65,8 +60,12 @@ public:
 		/**
 		 * Send a command to the local node
 		 *
+		 * Note that the returned conversation ID will never be 0. A return value
+		 * of 0 indicates a fatal error such as failure to bind to any local UDP
+		 * port.
+		 *
 		 * @param command
-		 * @return Request ID that will be provided to result handler when/if results are sent back
+		 * @return Conversation ID that will be provided to result handler when/if results are sent back
 		 */
 		unsigned long send(const char *command)
 			throw();
diff --git a/node/NodeConfig.cpp b/node/NodeConfig.cpp
index 381bbd62b..21ed51881 100644
--- a/node/NodeConfig.cpp
+++ b/node/NodeConfig.cpp
@@ -218,6 +218,20 @@ bool NodeConfig::decodeControlMessagePacket(const void *key,const void *data,uns
 
 void NodeConfig::_CBcontrolPacketHandler(UdpSocket *sock,void *arg,const InetAddress &remoteAddr,const void *data,unsigned int len)
 {
+	NodeConfig *nc = (NodeConfig *)arg;
+	try {
+		unsigned long convId = 0;
+		std::vector<std::string> commands;
+
+		if (!decodeControlMessagePacket(nc->_controlSocketKey,data,len,convId,commands))
+			return;
+
+		for(std::vector<std::string>::iterator c(commands.begin());c!=commands.end();++c) {
+			std::vector< Buffer<ZT_NODECONFIG_MAX_PACKET_SIZE> > resultPackets(encodeControlMessage(nc->_controlSocketKey,convId,nc->execute(c->c_str())));
+			for(std::vector< Buffer<ZT_NODECONFIG_MAX_PACKET_SIZE> >::iterator p(resultPackets.begin());p!=resultPackets.end();++p)
+				sock->send(remoteAddr,p->data(),p->size(),-1);
+		}
+	} catch ( ... ) {}
 }
 
 } // namespace ZeroTier