diff --git a/README.md b/README.md
index d83f777b5..3b9a2956b 100644
--- a/README.md
+++ b/README.md
@@ -27,8 +27,6 @@ You *only* need an account on our site if you want to use the control panel foun
 
 Public networks, as the name implies, can be joined without getting authorization from anyone. All you need is their 16-digit network ID. A public network called [Earth](https://www.zerotier.com/earth.html) (8056c2e21c000001) exists for everyone, but be sure your device is adequately secured and up to date before joining.
 
-Alternatively, you can run your own network configuration controller. This lets you run any network for free. To do this, start with the netconf-service/ subfolder of this project. You'll need to do a bit of system administration work and manually populate a Redis database, but it's not terribly hard if you're into that kind of thing.
-
 More products and services will be forthcoming.
 
 ### Basic Troubleshooting
diff --git a/netconf/README.md b/controller/README.md
similarity index 95%
rename from netconf/README.md
rename to controller/README.md
index 41ff27de8..6037424e7 100644
--- a/netconf/README.md
+++ b/controller/README.md
@@ -1,7 +1,7 @@
-Network Configuration Master
+Network Controller Implementation
 ======
 
-This folder contains code implementing the node/NetworkConfigMaster.hpp interface to allow ZeroTier nodes to create and manage virtual networks.
+This folder contains code implementing the node/NetworkController.hpp interface to allow ZeroTier nodes to create and manage virtual networks.
 
 The standard implementation uses SQLite3 with the attached schema. A separate service (not included here yet) is used to administrate that database and configure networks.
 
diff --git a/netconf/SqliteNetworkConfigMaster.cpp b/controller/SqliteNetworkController.cpp
similarity index 93%
rename from netconf/SqliteNetworkConfigMaster.cpp
rename to controller/SqliteNetworkController.cpp
index d74b0e0f7..c2e1a168f 100644
--- a/netconf/SqliteNetworkConfigMaster.cpp
+++ b/controller/SqliteNetworkController.cpp
@@ -37,7 +37,7 @@
 #include <utility>
 #include <stdexcept>
 
-#include "SqliteNetworkConfigMaster.hpp"
+#include "SqliteNetworkController.hpp"
 #include "../node/Utils.hpp"
 #include "../node/CertificateOfMembership.hpp"
 #include "../node/NetworkConfig.hpp"
@@ -53,16 +53,16 @@
 
 namespace ZeroTier {
 
-SqliteNetworkConfigMaster::SqliteNetworkConfigMaster(const Identity &signingId,const char *dbPath) :
+SqliteNetworkController::SqliteNetworkController(const Identity &signingId,const char *dbPath) :
 	_signingId(signingId),
 	_dbPath(dbPath),
 	_db((sqlite3 *)0)
 {
 	if (!_signingId.hasPrivate())
-		throw std::runtime_error("SqliteNetworkConfigMaster signing identity must have a private key");
+		throw std::runtime_error("SqliteNetworkController signing identity must have a private key");
 
 	if (sqlite3_open_v2(dbPath,&_db,SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE,(const char *)0) != SQLITE_OK)
-		throw std::runtime_error("SqliteNetworkConfigMaster cannot open database file");
+		throw std::runtime_error("SqliteNetworkController cannot open database file");
 	sqlite3_busy_timeout(_db,10000);
 
 	sqlite3_stmt *s = (sqlite3_stmt *)0;
@@ -75,18 +75,18 @@ SqliteNetworkConfigMaster::SqliteNetworkConfigMaster(const Identity &signingId,c
 
 		if (schemaVersion == -1234) {
 			sqlite3_close(_db);
-			throw std::runtime_error("SqliteNetworkConfigMaster schemaVersion not found in Config table (init failure?)");
+			throw std::runtime_error("SqliteNetworkController schemaVersion not found in Config table (init failure?)");
 		} else if (schemaVersion != ZT_NETCONF_SQLITE_SCHEMA_VERSION) {
 			// Note -- this will eventually run auto-upgrades so this isn't how it'll work going forward
 			sqlite3_close(_db);
-			throw std::runtime_error("SqliteNetworkConfigMaster database schema version mismatch");
+			throw std::runtime_error("SqliteNetworkController database schema version mismatch");
 		}
 	} else {
 		// Prepare statement will fail if Config table doesn't exist, which means our DB
 		// needs to be initialized.
 		if (sqlite3_exec(_db,ZT_NETCONF_SCHEMA_SQL"INSERT INTO Config (k,v) VALUES ('schemaVersion',"ZT_NETCONF_SQLITE_SCHEMA_VERSION_STR");",0,0,0) != SQLITE_OK) {
 			sqlite3_close(_db);
-			throw std::runtime_error("SqliteNetworkConfigMaster cannot initialize database and/or insert schemaVersion into Config table");
+			throw std::runtime_error("SqliteNetworkController cannot initialize database and/or insert schemaVersion into Config table");
 		}
 	}
 
@@ -109,11 +109,11 @@ SqliteNetworkConfigMaster::SqliteNetworkConfigMaster(const Identity &signingId,c
 			||(sqlite3_prepare_v2(_db,"UPDATE Member SET 'cachedNetconf' = ?,'cachedNetconfRevision' = ? WHERE rowid = ?",-1,&_sCacheNetconf,(const char **)0) != SQLITE_OK)
 		 ) {
 		sqlite3_close(_db);
-		throw std::runtime_error("SqliteNetworkConfigMaster unable to initialize one or more prepared statements");
+		throw std::runtime_error("SqliteNetworkController unable to initialize one or more prepared statements");
 	}
 }
 
-SqliteNetworkConfigMaster::~SqliteNetworkConfigMaster()
+SqliteNetworkController::~SqliteNetworkController()
 {
 	Mutex::Lock _l(_lock);
 	if (_db) {
@@ -137,7 +137,7 @@ SqliteNetworkConfigMaster::~SqliteNetworkConfigMaster()
 	}
 }
 
-NetworkConfigMaster::ResultCode SqliteNetworkConfigMaster::doNetworkConfigRequest(const InetAddress &fromAddr,const Identity &identity,uint64_t nwid,const Dictionary &metaData,uint64_t haveRevision,Dictionary &netconf)
+NetworkController::ResultCode SqliteNetworkController::doNetworkConfigRequest(const InetAddress &fromAddr,const Identity &identity,uint64_t nwid,const Dictionary &metaData,uint64_t haveRevision,Dictionary &netconf)
 {
 	Mutex::Lock _l(_lock);
 
@@ -195,10 +195,10 @@ NetworkConfigMaster::ResultCode SqliteNetworkConfigMaster::doNetworkConfigReques
 					sqlite3_step(_sUpdateNode2);
 				}
 			} else {
-				return NetworkConfigMaster::NETCONF_QUERY_ACCESS_DENIED;
+				return NetworkController::NETCONF_QUERY_ACCESS_DENIED;
 			}
 		} catch ( ... ) { // identity stored in database is not valid or is NULL
-			return NetworkConfigMaster::NETCONF_QUERY_ACCESS_DENIED;
+			return NetworkController::NETCONF_QUERY_ACCESS_DENIED;
 		}
 	} else {
 		std::string idstr(identity.toString(false));
@@ -215,7 +215,7 @@ NetworkConfigMaster::ResultCode SqliteNetworkConfigMaster::doNetworkConfigReques
 		sqlite3_bind_text(_sCreateNode,5,lastSeen,-1,SQLITE_STATIC);
 		if (sqlite3_step(_sCreateNode) != SQLITE_DONE) {
 			netconf["error"] = "unable to create new node record";
-			return NetworkConfigMaster::NETCONF_QUERY_INTERNAL_SERVER_ERROR;
+			return NetworkController::NETCONF_QUERY_INTERNAL_SERVER_ERROR;
 		}
 	}
 
@@ -236,7 +236,7 @@ NetworkConfigMaster::ResultCode SqliteNetworkConfigMaster::doNetworkConfigReques
 		network.revision = (uint64_t)sqlite3_column_int64(_sGetNetworkById,7);
 	}
 	if (!foundNetwork)
-		return NetworkConfigMaster::NETCONF_QUERY_OBJECT_NOT_FOUND;
+		return NetworkController::NETCONF_QUERY_OBJECT_NOT_FOUND;
 
 	// Fetch Member record
 
@@ -269,14 +269,14 @@ NetworkConfigMaster::ResultCode SqliteNetworkConfigMaster::doNetworkConfigReques
 		sqlite3_bind_int(_sCreateMember,3,(member.authorized ? 0 : 1));
 		if ( (sqlite3_step(_sCreateMember) != SQLITE_DONE) && ((member.rowid = (int64_t)sqlite3_last_insert_rowid(_db)) > 0) ) {
 			netconf["error"] = "unable to create new member record";
-			return NetworkConfigMaster::NETCONF_QUERY_INTERNAL_SERVER_ERROR;
+			return NetworkController::NETCONF_QUERY_INTERNAL_SERVER_ERROR;
 		}
 	}
 
 	// Check member authorization
 
 	if (!member.authorized)
-		return NetworkConfigMaster::NETCONF_QUERY_ACCESS_DENIED;
+		return NetworkController::NETCONF_QUERY_ACCESS_DENIED;
 
 	// Update client's currently reported haveRevision in Member record
 
@@ -290,7 +290,7 @@ NetworkConfigMaster::ResultCode SqliteNetworkConfigMaster::doNetworkConfigReques
 	// If netconf is unchanged from client reported revision, just tell client they're up to date
 
 	if ((haveRevision > 0)&&(haveRevision == network.revision))
-		return NetworkConfigMaster::NETCONF_QUERY_OK_BUT_NOT_NEWER;
+		return NetworkController::NETCONF_QUERY_OK_BUT_NOT_NEWER;
 
 	// Generate or retrieve cached netconf
 
@@ -473,7 +473,7 @@ NetworkConfigMaster::ResultCode SqliteNetworkConfigMaster::doNetworkConfigReques
 		}
 	}
 
-	return NetworkConfigMaster::NETCONF_QUERY_OK;
+	return NetworkController::NETCONF_QUERY_OK;
 }
 
 } // namespace ZeroTier
diff --git a/netconf/SqliteNetworkConfigMaster.hpp b/controller/SqliteNetworkController.hpp
similarity index 83%
rename from netconf/SqliteNetworkConfigMaster.hpp
rename to controller/SqliteNetworkController.hpp
index 72dea3654..566e97d1a 100644
--- a/netconf/SqliteNetworkConfigMaster.hpp
+++ b/controller/SqliteNetworkController.hpp
@@ -25,8 +25,8 @@
  * LLC. Start here: http://www.zerotier.com/
  */
 
-#ifndef ZT_SQLITENETWORKCONFIGMASTER_HPP
-#define ZT_SQLITENETWORKCONFIGMASTER_HPP
+#ifndef ZT_SQLITENETWORKCONTROLLER_HPP
+#define ZT_SQLITENETWORKCONTROLLER_HPP
 
 #include <stdint.h>
 
@@ -37,22 +37,22 @@
 #include <vector>
 
 #include "../node/Constants.hpp"
-#include "../node/NetworkConfigMaster.hpp"
+#include "../node/NetworkController.hpp"
 #include "../node/Mutex.hpp"
 #include "../node/NonCopyable.hpp"
 
 namespace ZeroTier {
 
-class SqliteNetworkConfigMaster : public NetworkConfigMaster
+class SqliteNetworkController : public NetworkController
 {
 public:
 	class DBC;
-	friend class SqliteNetworkConfigMaster::DBC;
+	friend class SqliteNetworkController::DBC;
 
-	SqliteNetworkConfigMaster(const Identity &signingId,const char *dbPath);
-	virtual ~SqliteNetworkConfigMaster();
+	SqliteNetworkController(const Identity &signingId,const char *dbPath);
+	virtual ~SqliteNetworkController();
 
-	virtual NetworkConfigMaster::ResultCode doNetworkConfigRequest(
+	virtual NetworkController::ResultCode doNetworkConfigRequest(
 		const InetAddress &fromAddr,
 		const Identity &identity,
 		uint64_t nwid,
@@ -90,16 +90,16 @@ public:
 	 *
 	 * This acts as both a contextual lock of the master's Mutex and a pointer
 	 * to the Sqlite3 database instance. Dereferencing this with * yields the
-	 * sqlite3* pointer. Create on parent with DBC(SqliteNetworkConfigMaster &).
+	 * sqlite3* pointer. Create on parent with DBC(SqliteNetworkController &).
 	 */
 	class DBC : NonCopyable
 	{
 	public:
-		DBC(SqliteNetworkConfigMaster &nc) : _p(&nc) { nc._lock.lock(); }
+		DBC(SqliteNetworkController &nc) : _p(&nc) { nc._lock.lock(); }
 		~DBC() { _p->_lock.unlock(); }
 		inline sqlite3 *operator*() const throw() { return _p->_db; }
 	private:
-		SqliteNetworkConfigMaster *const _p;
+		SqliteNetworkController *const _p;
 	};
 };
 
diff --git a/netconf/netconf-schema.sql b/controller/schema.sql
similarity index 100%
rename from netconf/netconf-schema.sql
rename to controller/schema.sql
diff --git a/netconf/netconf-schema.sql.c b/controller/schema.sql.c
similarity index 100%
rename from netconf/netconf-schema.sql.c
rename to controller/schema.sql.c
diff --git a/controller/schema2c.sh b/controller/schema2c.sh
new file mode 100755
index 000000000..4f4f1647c
--- /dev/null
+++ b/controller/schema2c.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+# Run this file to package the .sql file into a .c file whenever the SQL changes.
+
+rm -f schema.sql.c
+echo '#define ZT_NETCONF_SCHEMA_SQL \' >schema.sql.c
+cat schema.sql | sed 's/"/\\"/g' | sed 's/^/"/' | sed 's/$/\\n"\\/' >>schema.sql.c
+echo '""' >>schema.sql.c
diff --git a/make-freebsd.mk b/make-freebsd.mk
index 4d73a4eb1..37968bdd4 100644
--- a/make-freebsd.mk
+++ b/make-freebsd.mk
@@ -7,7 +7,6 @@ LIBS=
 
 include objects.mk
 OBJS+=osdep/BSDEthernetTap.o 
-TESTNET_OBJS=testnet/SimNet.o testnet/SimNetSocketManager.o testnet/TestEthernetTap.o 
 
 # Enable SSE-optimized Salsa20 on x86 and x86_64 machines
 MACHINE=$(shell uname -m)
@@ -30,13 +29,6 @@ ifeq ($(MACHINE),x86)
 	DEFS+=-DZT_SALSA20_SSE 
 endif
 
-# Build with ZT_ENABLE_NETCONF_MASTER=1 to build with NetworkConfigMaster enabled
-ifeq ($(ZT_ENABLE_NETCONF_MASTER),1)
-	DEFS+=-DZT_ENABLE_NETCONF_MASTER
-	LIBS+=-lsqlite3
-	OBJS+=netconf/SqliteNetworkConfigMaster.o 
-endif
-
 # "make official" is a shortcut for this
 ifeq ($(ZT_OFFICIAL_RELEASE),1)
 	ZT_AUTO_UPDATE=1
@@ -65,8 +57,8 @@ CXXFLAGS=$(CFLAGS) -fno-rtti
 
 all:	one
 
-one:	$(OBJS) main.o
-	$(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-one main.o $(OBJS) $(LIBS)
+one:	$(OBJS) one.o
+	$(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-one $(OBJS) one.o $(LIBS)
 	$(STRIP) zerotier-one
 	ln -sf zerotier-one zerotier-cli
 	ln -sf zerotier-one zerotier-idtool
@@ -75,16 +67,12 @@ selftest:	$(OBJS) selftest.o
 	$(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-selftest selftest.o $(OBJS) $(LIBS)
 	$(STRIP) zerotier-selftest
 
-testnet: $(TESTNET_OBJS) $(OBJS) testnet.o
-	$(CXX) $(CXXFLAGS) -o zerotier-testnet testnet.o $(OBJS) $(TESTNET_OBJS) $(LIBS)
-	$(STRIP) zerotier-testnet
-
 # No installer on FreeBSD yet
 #installer: one FORCE
 #	./buildinstaller.sh
 
 clean:
-	rm -rf *.o netconf/*.o node/*.o osdep/*.o service/*.o ext/http-parser/*.o ext/lz4/*.o build-* zerotier-* ZeroTierOneInstaller-*
+	rm -rf *.o node/*.o controller/*.o osdep/*.o service/*.o ext/http-parser/*.o ext/lz4/*.o build-* zerotier-* ZeroTierOneInstaller-*
 
 debug:	FORCE
 	make -j 4 ZT_DEBUG=1
diff --git a/make-linux.mk b/make-linux.mk
index d06f6cf70..c0fe973e2 100644
--- a/make-linux.mk
+++ b/make-linux.mk
@@ -8,7 +8,6 @@ LIBS=
 
 include objects.mk
 OBJS+=osdep/LinuxEthernetTap.o 
-TESTNET_OBJS=testnet/SimNet.o testnet/SimNetSocketManager.o testnet/TestEthernetTap.o 
 
 # Enable SSE-optimized Salsa20 on x86 and x86_64 machines
 MACHINE=$(shell uname -m)
@@ -31,13 +30,6 @@ ifeq ($(MACHINE),x86)
 	DEFS+=-DZT_SALSA20_SSE 
 endif
 
-# Build with ZT_ENABLE_NETCONF_MASTER=1 to build with NetworkConfigMaster enabled
-ifeq ($(ZT_ENABLE_NETCONF_MASTER),1)
-	DEFS+=-DZT_ENABLE_NETCONF_MASTER
-	LIBS+=-lsqlite3
-	OBJS+=netconf/SqliteNetworkConfigMaster.o 
-endif
-
 # "make official" is a shortcut for this
 ifeq ($(ZT_OFFICIAL_RELEASE),1)
 	ZT_AUTO_UPDATE=1
@@ -71,8 +63,8 @@ CXXFLAGS=$(CFLAGS) -fno-rtti
 
 all:	one
 
-one:	$(OBJS) main.o
-	$(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-one main.o $(OBJS) $(LIBS)
+one:	$(OBJS) one.o
+	$(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-one $(OBJS) one.o $(LIBS)
 	$(STRIP) zerotier-one
 	ln -sf zerotier-one zerotier-cli
 	ln -sf zerotier-one zerotier-idtool
@@ -81,15 +73,11 @@ selftest:	$(OBJS) selftest.o
 	$(CXX) $(CXXFLAGS) $(LDFLAGS) -o zerotier-selftest selftest.o $(OBJS) $(LIBS)
 	$(STRIP) zerotier-selftest
 
-testnet: $(TESTNET_OBJS) $(OBJS) testnet.o
-	$(CXX) $(CXXFLAGS) -o zerotier-testnet testnet.o $(OBJS) $(TESTNET_OBJS) $(LIBS)
-	$(STRIP) zerotier-testnet
-
 installer: one FORCE
 	./buildinstaller.sh
 
 clean:
-	rm -rf *.o netconf/*.o node/*.o osdep/*.o service/*.o ext/http-parser/*.o ext/lz4/*.o zerotier-* build-* ZeroTierOneInstaller-* *.deb *.rpm
+	rm -rf *.o node/*.o controller/*.o osdep/*.o service/*.o ext/http-parser/*.o ext/lz4/*.o zerotier-* build-* ZeroTierOneInstaller-* *.deb *.rpm
 
 debug:	FORCE
 	make -j 4 ZT_DEBUG=1
diff --git a/make-mac.mk b/make-mac.mk
index 66e5b6d85..649ea214c 100644
--- a/make-mac.mk
+++ b/make-mac.mk
@@ -26,12 +26,11 @@ ifeq ($(ZT_AUTO_UPDATE),1)
 	DEFS+=-DZT_AUTO_UPDATE 
 endif
 
-# Build with ZT_ENABLE_NETCONF_MASTER=1 to build with NetworkConfigMaster enabled
-ifeq ($(ZT_ENABLE_NETCONF_MASTER),1)
-	DEFS+=-DZT_ENABLE_NETCONF_MASTER
+# Build with ZT_ENABLE_NETWORK_CONTROLLER=1 to build with the Sqlite network controller
+ifeq ($(ZT_ENABLE_NETWORK_CONTROLLER),1)
+	DEFS+=-DZT_ENABLE_NETWORK_CONTROLLER 
 	LIBS+=-L/usr/local/lib -lsqlite3
-	ARCH_FLAGS=-arch x86_64
-	OBJS+=netconf/SqliteNetworkConfigMaster.o 
+	OBJS+=controller/SqliteNetworkController.o 
 endif
 
 # Enable SSE-optimized Salsa20 -- all Intel macs support SSE2
@@ -77,7 +76,7 @@ selftest: $(OBJS) selftest.o
 #	$(CODESIGN) -vvv "build-ZeroTierUI-release/ZeroTier One.app"
 
 clean:
-	rm -rf *.dSYM build-* *.pkg *.dmg *.o netconf/*.o service/*.o node/*.o osdep/*.o ext/http-parser/*.o ext/lz4/*.o zerotier-* ZeroTierOneInstaller-*
+	rm -rf *.dSYM build-* *.pkg *.dmg *.o node/*.o controller/*.o service/*.o osdep/*.o ext/http-parser/*.o ext/lz4/*.o zerotier-* ZeroTierOneInstaller-*
 
 # For our use -- builds official signed binary, packages in installer and download DMG
 official: FORCE
diff --git a/netconf/schema2c.sh b/netconf/schema2c.sh
deleted file mode 100755
index 2ef1393aa..000000000
--- a/netconf/schema2c.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/bash
-
-# Run this file to package the .sql file into a .c file whenever the SQL changes.
-
-rm -f netconf-schema.sql.c
-echo '#define ZT_NETCONF_SCHEMA_SQL \' >netconf-schema.sql.c
-cat netconf-schema.sql | sed 's/"/\\"/g' | sed 's/^/"/' | sed 's/$/\\n"\\/' >>netconf-schema.sql.c
-echo '""' >>netconf-schema.sql.c
diff --git a/node/IncomingPacket.cpp b/node/IncomingPacket.cpp
index 67e2ae2a0..967f50f2c 100644
--- a/node/IncomingPacket.cpp
+++ b/node/IncomingPacket.cpp
@@ -38,7 +38,7 @@
 #include "Topology.hpp"
 #include "Switch.hpp"
 #include "Peer.hpp"
-#include "NetworkConfigMaster.hpp"
+#include "NetworkController.hpp"
 #include "SelfAwareness.hpp"
 
 namespace ZeroTier {
@@ -361,14 +361,14 @@ bool IncomingPacket::_doOK(const RuntimeEnvironment *RR,const SharedPtr<Peer> &p
 					if (dict.length()) {
 						if (nw->setConfiguration(Dictionary(dict)) == 2) { // 2 == accepted and actually new
 							/* If this configuration was indeed new, we do another
-							 * netconf request with its revision. We do this in
-							 * order to (a) tell the netconf server we got it (it
+							 * controller request with its revision. We do this in
+							 * order to (a) tell the network controller we got it (it
 							 * won't send a duplicate if ts == current), and (b)
-							 * get another one if the netconf is changing rapidly
+							 * get another one if the controller is changing rapidly
 							 * until we finally have the final version.
 							 *
-							 * Note that we don't do this for netconf masters with
-							 * versions <= 1.0.3, since those regenerate a new netconf
+							 * Note that we don't do this for network controllers with
+							 * versions <= 1.0.3, since those regenerate a new controller
 							 * with a new revision every time. In that case this double
 							 * confirmation would create a race condition. */
 							const SharedPtr<NetworkConfig> nc(nw->config2());
@@ -672,10 +672,10 @@ bool IncomingPacket::_doNETWORK_CONFIG_REQUEST(const RuntimeEnvironment *RR,cons
 		const uint64_t pid = packetId();
 		peer->received(RR,_remoteAddress,_linkDesperation,h,pid,Packet::VERB_NETWORK_CONFIG_REQUEST,0,Packet::VERB_NOP);
 
-		if (RR->netconfMaster) {
+		if (RR->localNetworkController) {
 			Dictionary netconf;
-			switch(RR->netconfMaster->doNetworkConfigRequest((h > 0) ? InetAddress() : _remoteAddress,peer->identity(),nwid,metaData,haveRevision,netconf)) {
-				case NetworkConfigMaster::NETCONF_QUERY_OK: {
+			switch(RR->localNetworkController->doNetworkConfigRequest((h > 0) ? InetAddress() : _remoteAddress,peer->identity(),nwid,metaData,haveRevision,netconf)) {
+				case NetworkController::NETCONF_QUERY_OK: {
 					const std::string netconfStr(netconf.toString());
 					if (netconfStr.length() > 0xffff) { // sanity check since field ix 16-bit
 						TRACE("NETWORK_CONFIG_REQUEST failed: internal error: netconf size %u is too large",(unsigned int)netconfStr.length());
@@ -694,9 +694,9 @@ bool IncomingPacket::_doNETWORK_CONFIG_REQUEST(const RuntimeEnvironment *RR,cons
 						}
 					}
 				}	break;
-				case NetworkConfigMaster::NETCONF_QUERY_OK_BUT_NOT_NEWER: // nothing to do -- netconf has not changed
+				case NetworkController::NETCONF_QUERY_OK_BUT_NOT_NEWER: // nothing to do -- netconf has not changed
 					break;
-				case NetworkConfigMaster::NETCONF_QUERY_OBJECT_NOT_FOUND: {
+				case NetworkController::NETCONF_QUERY_OBJECT_NOT_FOUND: {
 					Packet outp(peer->address(),RR->identity.address(),Packet::VERB_ERROR);
 					outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
 					outp.append(pid);
@@ -705,7 +705,7 @@ bool IncomingPacket::_doNETWORK_CONFIG_REQUEST(const RuntimeEnvironment *RR,cons
 					outp.armor(peer->key(),true);
 					RR->node->putPacket(_remoteAddress,outp.data(),outp.size(),_linkDesperation);
 				}	break;
-				case NetworkConfigMaster::NETCONF_QUERY_ACCESS_DENIED: {
+				case NetworkController::NETCONF_QUERY_ACCESS_DENIED: {
 					Packet outp(peer->address(),RR->identity.address(),Packet::VERB_ERROR);
 					outp.append((unsigned char)Packet::VERB_NETWORK_CONFIG_REQUEST);
 					outp.append(pid);
@@ -714,11 +714,11 @@ bool IncomingPacket::_doNETWORK_CONFIG_REQUEST(const RuntimeEnvironment *RR,cons
 					outp.armor(peer->key(),true);
 					RR->node->putPacket(_remoteAddress,outp.data(),outp.size(),_linkDesperation);
 				} break;
-				case NetworkConfigMaster::NETCONF_QUERY_INTERNAL_SERVER_ERROR:
+				case NetworkController::NETCONF_QUERY_INTERNAL_SERVER_ERROR:
 					TRACE("NETWORK_CONFIG_REQUEST failed: internal error: %s",netconf.get("error","(unknown)").c_str());
 					break;
 				default:
-					TRACE("NETWORK_CONFIG_REQUEST failed: invalid return value from NetworkConfigMaster::doNetworkConfigRequest()");
+					TRACE("NETWORK_CONFIG_REQUEST failed: invalid return value from NetworkController::doNetworkConfigRequest()");
 					break;
 			}
 		} else {
diff --git a/node/Network.cpp b/node/Network.cpp
index 7fa17ef15..1c786d245 100644
--- a/node/Network.cpp
+++ b/node/Network.cpp
@@ -36,7 +36,7 @@
 #include "Switch.hpp"
 #include "Packet.hpp"
 #include "Buffer.hpp"
-#include "NetworkConfigMaster.hpp"
+#include "NetworkController.hpp"
 
 namespace ZeroTier {
 
@@ -243,21 +243,21 @@ int Network::setConfiguration(const Dictionary &conf,bool saveToDisk)
 
 void Network::requestConfiguration()
 {
-	if (_id == ZT_TEST_NETWORK_ID) // pseudo-network-ID, no netconf master
+	if (_id == ZT_TEST_NETWORK_ID) // pseudo-network-ID, uses locally generated static config
 		return;
 
 	if (controller() == RR->identity.address()) {
-		if (RR->netconfMaster) {
+		if (RR->localNetworkController) {
 			SharedPtr<NetworkConfig> nconf(config2());
 			Dictionary newconf;
-			switch(RR->netconfMaster->doNetworkConfigRequest(InetAddress(),RR->identity,_id,Dictionary(),(nconf) ? nconf->revision() : (uint64_t)0,newconf)) {
-				case NetworkConfigMaster::NETCONF_QUERY_OK:
+			switch(RR->localNetworkController->doNetworkConfigRequest(InetAddress(),RR->identity,_id,Dictionary(),(nconf) ? nconf->revision() : (uint64_t)0,newconf)) {
+				case NetworkController::NETCONF_QUERY_OK:
 					this->setConfiguration(newconf,true);
 					return;
-				case NetworkConfigMaster::NETCONF_QUERY_OBJECT_NOT_FOUND:
+				case NetworkController::NETCONF_QUERY_OBJECT_NOT_FOUND:
 					this->setNotFound();
 					return;
-				case NetworkConfigMaster::NETCONF_QUERY_ACCESS_DENIED:
+				case NetworkController::NETCONF_QUERY_ACCESS_DENIED:
 					this->setAccessDenied();
 					return;
 				default:
@@ -269,7 +269,7 @@ void Network::requestConfiguration()
 		}
 	}
 
-	TRACE("requesting netconf for network %.16llx from netconf master %s",(unsigned long long)_id,controller().toString().c_str());
+	TRACE("requesting netconf for network %.16llx from controller %s",(unsigned long long)_id,controller().toString().c_str());
 	Packet outp(controller(),RR->identity.address(),Packet::VERB_NETWORK_CONFIG_REQUEST);
 	outp.append((uint64_t)_id);
 	outp.append((uint16_t)0); // no meta-data
@@ -304,7 +304,7 @@ void Network::addMembershipCertificate(const CertificateOfMembership &cert,bool
 		SharedPtr<Peer> signer(RR->topology->getPeer(cert.signedBy()));
 
 		if (!signer) {
-			// This would be rather odd, since this is our netconf master... could happen
+			// This would be rather odd, since this is our controller... could happen
 			// if we get packets before we've gotten config.
 			RR->sw->requestWhois(cert.signedBy());
 			return;
diff --git a/node/Network.hpp b/node/Network.hpp
index 213b44c59..79ae3a90e 100644
--- a/node/Network.hpp
+++ b/node/Network.hpp
@@ -88,7 +88,7 @@ public:
 	inline uint64_t id() const throw() { return _id; }
 
 	/**
-	 * @return Address of network's netconf master (most significant 40 bits of ID)
+	 * @return Address of network's controller (most significant 40 bits of ID)
 	 */
 	inline Address controller() throw() { return Address(_id >> 24); }
 
@@ -148,7 +148,7 @@ public:
 	int setConfiguration(const Dictionary &conf,bool saveToDisk = true);
 
 	/**
-	 * Set netconf failure to 'access denied' -- called in IncomingPacket when netconf master reports this
+	 * Set netconf failure to 'access denied' -- called in IncomingPacket when controller reports this
 	 */
 	inline void setAccessDenied()
 	{
@@ -157,7 +157,7 @@ public:
 	}
 
 	/**
-	 * Set netconf failure to 'not found' -- called by PacketDecider when netconf master reports this
+	 * Set netconf failure to 'not found' -- called by PacketDecider when controller reports this
 	 */
 	inline void setNotFound()
 	{
diff --git a/node/NetworkConfig.cpp b/node/NetworkConfig.cpp
index a034b15f9..6cab4b416 100644
--- a/node/NetworkConfig.cpp
+++ b/node/NetworkConfig.cpp
@@ -109,7 +109,7 @@ void NetworkConfig::_fromDictionary(const Dictionary &d)
 		throw std::invalid_argument("configuration contains zero network ID");
 
 	_timestamp = Utils::hexStrToU64(d.get(ZT_NETWORKCONFIG_DICT_KEY_TIMESTAMP).c_str());
-	_revision = Utils::hexStrToU64(d.get(ZT_NETWORKCONFIG_DICT_KEY_REVISION,"1").c_str()); // older netconf masters don't send this, so default to 1
+	_revision = Utils::hexStrToU64(d.get(ZT_NETWORKCONFIG_DICT_KEY_REVISION,"1").c_str()); // older controllers don't send this, so default to 1
 
 	memset(_etWhitelist,0,sizeof(_etWhitelist));
 	std::vector<std::string> ets(Utils::split(d.get(ZT_NETWORKCONFIG_DICT_KEY_ALLOWED_ETHERNET_TYPES).c_str(),",","",""));
diff --git a/node/NetworkConfig.hpp b/node/NetworkConfig.hpp
index 31e47f41d..02c5ba3f5 100644
--- a/node/NetworkConfig.hpp
+++ b/node/NetworkConfig.hpp
@@ -68,9 +68,9 @@ namespace ZeroTier {
 #define ZT_NETWORKCONFIG_DICT_KEY_RELAYS "rl"
 
 /**
- * Network configuration received from netconf master nodes
+ * Network configuration received from network controller nodes
  *
- * This is an immutable value object created from a dictionary received from netconf master.
+ * This is an immutable value object created from a dictionary received from controller.
  */
 class NetworkConfig
 {
@@ -102,10 +102,10 @@ public:
 	 * Create an instance of a NetworkConfig for the test network ID
 	 *
 	 * The test network ID is defined as ZT_TEST_NETWORK_ID. This is a
-	 * "fake" network with no real netconf master and default options.
+	 * "fake" network with no real controller and default options.
 	 *
 	 * @param self This node's ZT address
-	 * @return Configured instance of netconf for test network ID
+	 * @return Configuration for test network ID
 	 */
 	static SharedPtr<NetworkConfig> createTestNetworkConfig(const Address &self);
 
diff --git a/node/NetworkConfigMaster.hpp b/node/NetworkController.hpp
similarity index 94%
rename from node/NetworkConfigMaster.hpp
rename to node/NetworkController.hpp
index f3b013e46..32b8f0539 100644
--- a/node/NetworkConfigMaster.hpp
+++ b/node/NetworkController.hpp
@@ -43,7 +43,7 @@ class RuntimeEnvironment;
 /**
  * Interface for network configuration (netconf) master implementations
  */
-class NetworkConfigMaster
+class NetworkController
 {
 public:
 	/**
@@ -58,8 +58,8 @@ public:
 		NETCONF_QUERY_INTERNAL_SERVER_ERROR = 4
 	};
 
-	NetworkConfigMaster() {}
-	virtual ~NetworkConfigMaster() {}
+	NetworkController() {}
+	virtual ~NetworkController() {}
 
 	/**
 	 * Handle a network config request, sending replies if necessary
@@ -78,7 +78,7 @@ public:
 	 * @param result Dictionary to receive resulting signed netconf on success
 	 * @return Returns NETCONF_QUERY_OK if result dictionary is valid, or an error code on error
 	 */
-	virtual NetworkConfigMaster::ResultCode doNetworkConfigRequest(
+	virtual NetworkController::ResultCode doNetworkConfigRequest(
 		const InetAddress &fromAddr,
 		const Identity &identity,
 		uint64_t nwid,
diff --git a/node/Node.cpp b/node/Node.cpp
index c6ae54bdd..801d40789 100644
--- a/node/Node.cpp
+++ b/node/Node.cpp
@@ -30,7 +30,7 @@
 #include "Constants.hpp"
 #include "Node.hpp"
 #include "RuntimeEnvironment.hpp"
-#include "NetworkConfigMaster.hpp"
+#include "NetworkController.hpp"
 #include "CMWC4096.hpp"
 #include "Switch.hpp"
 #include "Multicaster.hpp"
@@ -407,9 +407,9 @@ void Node::freeQueryResult(void *qr)
 		::free(qr);
 }
 
-void Node::setNetconfMaster(void *networkConfigMasterInstance)
+void Node::setNetconfMaster(void *networkControllerInstance)
 {
-	RR->netconfMaster = reinterpret_cast<NetworkConfigMaster *>(networkConfigMasterInstance);
+	RR->localNetworkController = reinterpret_cast<NetworkController *>(networkControllerInstance);
 }
 
 /****************************************************************************/
@@ -654,10 +654,10 @@ void ZT1_Node_freeQueryResult(ZT1_Node *node,void *qr)
 	} catch ( ... ) {}
 }
 
-void ZT1_Node_setNetconfMaster(ZT1_Node *node,void *networkConfigMasterInstance)
+void ZT1_Node_setNetconfMaster(ZT1_Node *node,void *networkControllerInstance)
 {
 	try {
-		reinterpret_cast<ZeroTier::Node *>(node)->setNetconfMaster(networkConfigMasterInstance);
+		reinterpret_cast<ZeroTier::Node *>(node)->setNetconfMaster(networkControllerInstance);
 	} catch ( ... ) {}
 }
 
diff --git a/node/Node.hpp b/node/Node.hpp
index 429e51716..f07776dad 100644
--- a/node/Node.hpp
+++ b/node/Node.hpp
@@ -105,7 +105,7 @@ public:
 	ZT1_VirtualNetworkConfig *networkConfig(uint64_t nwid) const;
 	ZT1_VirtualNetworkList *networks() const;
 	void freeQueryResult(void *qr);
-	void setNetconfMaster(void *networkConfigMasterInstance);
+	void setNetconfMaster(void *networkControllerInstance);
 
 	// Internal functions ------------------------------------------------------
 
diff --git a/node/RuntimeEnvironment.hpp b/node/RuntimeEnvironment.hpp
index 6bb8c3cfe..228040e74 100644
--- a/node/RuntimeEnvironment.hpp
+++ b/node/RuntimeEnvironment.hpp
@@ -42,7 +42,7 @@ class CMWC4096;
 class Node;
 class Multicaster;
 class AntiRecursion;
-class NetworkConfigMaster;
+class NetworkController;
 class SelfAwareness;
 
 /**
@@ -54,7 +54,7 @@ public:
 	RuntimeEnvironment(Node *n) :
 		node(n),
 		identity(),
-		netconfMaster((NetworkConfigMaster *)0),
+		localNetworkController((NetworkController *)0),
 		prng((CMWC4096 *)0),
 		sw((Switch *)0),
 		mc((Multicaster *)0),
@@ -72,8 +72,8 @@ public:
 	std::string publicIdentityStr;
 	std::string secretIdentityStr;
 
-	// This is set externally to an instance of this base class if netconf functionality is enabled
-	NetworkConfigMaster *netconfMaster;
+	// This is set externally to an instance of this base class
+	NetworkController *localNetworkController;
 
 	/*
 	 * Order matters a bit here. These are constructed in this order
diff --git a/selftest.cpp b/selftest.cpp
index 465e0088c..8c8c6fa1a 100644
--- a/selftest.cpp
+++ b/selftest.cpp
@@ -59,9 +59,9 @@
 #include "osdep/Phy.hpp"
 #endif
 
-#ifdef ZT_ENABLE_NETCONF_MASTER
-#include "netconf/SqliteNetworkConfigMaster.hpp"
-#endif // ZT_ENABLE_NETCONF_MASTER
+#ifdef ZT_ENABLE_NETWORK_CONTROLLER
+#include "controller/SqliteNetworkController.hpp"
+#endif // ZT_ENABLE_NETWORK_CONTROLLER
 
 #ifdef __WINDOWS__
 #include <tchar.h>
@@ -726,14 +726,14 @@ static int testPhy()
 
 static int testSqliteNetconfMaster()
 {
-#ifdef ZT_ENABLE_NETCONF_MASTER
+#ifdef ZT_ENABLE_NETWORK_CONTROLLER
 	try {
-		std::cout << "[netconf] Generating signing identity..." << std::endl;
+		std::cout << "[network-controller] Generating signing identity..." << std::endl;
 		Identity signingId;
 		signingId.generate();
 
-		std::cout << "[netconf] Creating database..." << std::endl;
-		SqliteNetworkConfigMaster netconf(signingId,"netconf-test.db");
+		std::cout << "[network-controller] Creating database..." << std::endl;
+		SqliteNetworkController controller(signingId,"network-controller-test.db");
 	} catch (std::runtime_error &exc) {
 		std::cout << "FAIL! (unexpected exception: " << exc.what() << ")" << std::endl;
 		return -1;
@@ -741,7 +741,7 @@ static int testSqliteNetconfMaster()
 		std::cout << "FAIL! (unexpected exception: ...)" << std::endl;
 		return -1;
 	}
-#endif // ZT_ENABLE_NETCONF_MASTER
+#endif // ZT_ENABLE_NETWORK_CONTROLLER
 	return 0;
 }