diff --git a/node/IncomingPacket.cpp b/node/IncomingPacket.cpp
index a1458a806..eff873507 100644
--- a/node/IncomingPacket.cpp
+++ b/node/IncomingPacket.cpp
@@ -156,11 +156,14 @@ bool IncomingPacket::_doERROR(const RuntimeEnvironment *RR,const SharedPtr<Peer>
 			case Packet::ERROR_NEED_MEMBERSHIP_CERTIFICATE: {
 				SharedPtr<Network> network(RR->node->network(at<uint64_t>(ZT_PROTO_VERB_ERROR_IDX_PAYLOAD)));
 				if ((network)&&(network->recentlyAllowedOnNetwork(peer))) {
-					Packet outp(peer->address(),RR->identity.address(),Packet::VERB_NETWORK_CREDENTIALS);
-					network->config().com.serialize(outp);
-					outp.append((uint8_t)0);
-					outp.armor(peer->key(),true);
-					_path->send(RR,outp.data(),outp.size(),RR->node->now());
+					const uint64_t now = RR->node->now();
+					if (peer->rateGateComRequest(now)) {
+						Packet outp(peer->address(),RR->identity.address(),Packet::VERB_NETWORK_CREDENTIALS);
+						network->config().com.serialize(outp);
+						outp.append((uint8_t)0);
+						outp.armor(peer->key(),true);
+						_path->send(RR,outp.data(),outp.size(),now);
+					}
 				}
 			}	break;
 
diff --git a/node/Peer.cpp b/node/Peer.cpp
index 0e6ef3332..f7a21ab1b 100644
--- a/node/Peer.cpp
+++ b/node/Peer.cpp
@@ -50,6 +50,7 @@ Peer::Peer(const RuntimeEnvironment *renv,const Identity &myIdentity,const Ident
 	_lastCredentialRequestSent(0),
 	_lastWhoisRequestReceived(0),
 	_lastEchoRequestReceived(0),
+	_lastComRequestReceived(0),
 	RR(renv),
 	_remoteClusterOptimal4(0),
 	_vProto(0),
diff --git a/node/Peer.hpp b/node/Peer.hpp
index d714b937a..a804dd91a 100644
--- a/node/Peer.hpp
+++ b/node/Peer.hpp
@@ -393,6 +393,18 @@ public:
 		return false;
 	}
 
+	/**
+	 * Rate gate requests for network COM
+	 */
+	inline bool rateGateComRequest(const uint64_t now)
+	{
+		if ((now - _lastComRequestReceived) >= ZT_PEER_GENERAL_RATE_LIMIT) {
+			_lastComRequestReceived = now;
+			return true;
+		}
+		return false;
+	}
+
 	/**
 	 * Find a common set of addresses by which two peers can link, if any
 	 *
@@ -452,6 +464,7 @@ private:
 	uint64_t _lastCredentialRequestSent;
 	uint64_t _lastWhoisRequestReceived;
 	uint64_t _lastEchoRequestReceived;
+	uint64_t _lastComRequestReceived;
 	const RuntimeEnvironment *RR;
 	uint32_t _remoteClusterOptimal4;
 	uint16_t _vProto;