diff --git a/netconf-service/netconf.cpp b/netconf-service/netconf.cpp
index d04534311..436d08998 100644
--- a/netconf-service/netconf.cpp
+++ b/netconf-service/netconf.cpp
@@ -114,7 +114,7 @@ int main(int argc,char **argv)
 		strcpy(mysqlPassword,ee);
 	}
 
-	char buf[131072];
+	char buf[131072],buf2[131072];
 	std::string dictBuf;
 
 	try {
@@ -255,6 +255,30 @@ int main(int argc,char **argv)
 					}
 				}
 
+				Dictionary multicastRates;
+				{
+					Query q = dbCon->query();
+					q << "SELECT DISTINCT multicastGroupMac,multicastGroupAdi,preload,maxBalance,accrual FROM NetworkMulticastRates WHERE Network_id = " << nwid;
+					StoreQueryResult rs = q.store();
+					for(unsigned long i=0;i<rs.num_rows();++i) {
+						long preload = (long)rs[i]["preload"];
+						long maxBalance = (long)rs[i]["maxBalance"];
+						long accrual = (long)rs[i]["accrual"];
+						sprintf(buf2,"%s%lx,%s%lx,%s%lx",
+							((preload < 0) ? "-" : ""),
+							preload,
+							((maxBalance < 0) ? "-" : ""),
+							maxBalance,
+							((accrual < 0) ? "-" : ""),
+							accrual);
+						unsigned long long mac = (unsigned long long)rs[i]["multicastGroupMac"];
+						if (mac) {
+							sprintf(buf,"%.12llx/%lx",(mac & 0xffffffffffffULL),(unsigned long)rs[i]["multicastGroupAdi"]);
+							multicastRates[buf] = buf2;
+						} else multicastRates["*"] = buf2;
+					}
+				}
+
 				Dictionary netconf;
 
 				sprintf(buf,"%.16llx",(unsigned long long)nwid);
@@ -265,6 +289,7 @@ int main(int argc,char **argv)
 				netconf["desc"] = desc;
 				netconf["etherTypes"] = etherTypeWhitelistOld; // TODO: remove, old name
 				netconf["et"] = etherTypeWhitelist;
+				netconf["mr"] = multicastRates.toString();
 				sprintf(buf,"%llx",(unsigned long long)Utils::now());
 				netconf["ts"] = buf;
 
diff --git a/node/MulticastGroup.hpp b/node/MulticastGroup.hpp
index 3c31756f7..9b96d6e8c 100644
--- a/node/MulticastGroup.hpp
+++ b/node/MulticastGroup.hpp
@@ -101,12 +101,12 @@ public:
 	}
 
 	/**
-	 * @return Human readable string representing this group
+	 * @return Human readable string representing this group (MAC/ADI in hex)
 	 */
 	inline std::string toString() const
 	{
 		char buf[64];
-		Utils::snprintf(buf,sizeof(buf),"%.2x%.2x%.2x%.2x%.2x%.2x/%.8lx",(unsigned int)_mac.data[0],(unsigned int)_mac.data[1],(unsigned int)_mac.data[2],(unsigned int)_mac.data[3],(unsigned int)_mac.data[4],(unsigned int)_mac.data[5],(unsigned long)_adi);
+		Utils::snprintf(buf,sizeof(buf),"%.2x%.2x%.2x%.2x%.2x%.2x/%lx",(unsigned int)_mac.data[0],(unsigned int)_mac.data[1],(unsigned int)_mac.data[2],(unsigned int)_mac.data[3],(unsigned int)_mac.data[4],(unsigned int)_mac.data[5],(unsigned long)_adi);
 		return std::string(buf);
 	}
 
diff --git a/node/Network.hpp b/node/Network.hpp
index 2d90dac77..76718a77e 100644
--- a/node/Network.hpp
+++ b/node/Network.hpp
@@ -82,6 +82,32 @@ class Network : NonCopyable
 public:
 	/**
 	 * A certificate of network membership for private network participation
+	 *
+	 * Certificates consist of a dictionary containing one or more values with
+	 * optional max delta paramters. A max delta paramter defines the maximum
+	 * absolute value of the difference between each set of two values in order
+	 * for two certificates to match. If there is no max delta parameter, each
+	 * value is compared for straightforward string equality. Values must be
+	 * in hexadecimal (and may be negative) for max delta comparison purposes.
+	 * Decimals are not allowed, so decimal values must be multiplied by some
+	 * factor to convert them to integers with the required relative precision.
+	 * Math is done in 64-bit, allowing plenty of room for this.
+	 *
+	 * This allows membership in a network to be defined not only in terms of
+	 * absolute parameters but also relative comparisons. For example, a network
+	 * could be created that defined membership in terms of a geographic radius.
+	 * Its certificates would contain latitude, longitude, and a max delta for
+	 * each defining the radius.
+	 *
+	 * Max deltas are prefixed by "~". For example, a max delta for "longitude"
+	 * would be "~longitude".
+	 *
+	 * One value and its associated max delta is just about always present: a
+	 * timestamp. This represents the time the certificate was issued by the
+	 * netconf controller. Each peer requests netconf updates periodically with
+	 * new certificates, so this causes peers that are no longer members of the
+	 * network to lose the ability to communicate with their certificate's "ts"
+	 * field differs from everyone else's "ts" by more than "~ts".
 	 */
 	class Certificate : private Dictionary
 	{