diff --git a/contrib/systemd/yggdrasil.service b/contrib/systemd/yggdrasil.service
index bdf365c8..b90d09d1 100644
--- a/contrib/systemd/yggdrasil.service
+++ b/contrib/systemd/yggdrasil.service
@@ -8,7 +8,7 @@ Group=yggdrasil
 ProtectHome=true
 ProtectSystem=true
 SyslogIdentifier=yggdrasil
-CapabilityBoundingSet=CAP_NET_ADMIN
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
 ExecStartPre=+-/sbin/modprobe tun
 ExecStartPre=/bin/sh -ec "if ! test -s /etc/yggdrasil.conf; \
                 then umask 077; \
diff --git a/src/yggdrasil/link.go b/src/yggdrasil/link.go
index 1710e202..cd40a9ea 100644
--- a/src/yggdrasil/link.go
+++ b/src/yggdrasil/link.go
@@ -64,6 +64,7 @@ type linkInterface struct {
 	closeTimer     *time.Timer // Fires when the link has been idle so long we need to close it
 	inSwitch       bool        // True if the switch is tracking this link
 	stalled        bool        // True if we haven't been receiving any response traffic
+	unstalled      bool        // False if an idle notification to the switch hasn't been sent because we stalled (or are first starting up)
 }
 
 func (l *link) init(c *Core) error {
@@ -324,11 +325,15 @@ func (intf *linkInterface) notifySent(size int, isLinkTraffic bool) {
 
 // Notify the switch that we're ready for more traffic, assuming we're not in a stalled state
 func (intf *linkInterface) _notifySwitch() {
-	if !intf.inSwitch && !intf.stalled {
-		intf.inSwitch = true
-		intf.link.core.switchTable.Act(intf, func() {
-			intf.link.core.switchTable._idleIn(intf.peer.port)
-		})
+	if !intf.inSwitch {
+		if intf.stalled {
+			intf.unstalled = false
+		} else {
+			intf.inSwitch = true
+			intf.link.core.switchTable.Act(intf, func() {
+				intf.link.core.switchTable._idleIn(intf.peer.port)
+			})
+		}
 	}
 }
 
@@ -362,7 +367,10 @@ func (intf *linkInterface) notifyRead(size int) {
 			intf.stallTimer = nil
 		}
 		intf.stalled = false
-		intf._notifySwitch()
+		if !intf.unstalled {
+			intf._notifySwitch()
+			intf.unstalled = true
+		}
 		if size > 0 && intf.stallTimer == nil {
 			intf.stallTimer = time.AfterFunc(keepAliveTime, intf.notifyDoKeepAlive)
 		}
diff --git a/src/yggdrasil/switch.go b/src/yggdrasil/switch.go
index 5d355041..d0a9f4e0 100644
--- a/src/yggdrasil/switch.go
+++ b/src/yggdrasil/switch.go
@@ -814,12 +814,12 @@ func (t *switchTable) _handleIdle(port switchPort) bool {
 			packet := buf.packets[0]
 			coords := switch_getPacketCoords(packet.bytes)
 			priority := float64(now.Sub(packet.time)) / float64(buf.size)
-			if priority > bestPriority && t.portIsCloser(coords, port) {
+			if priority >= bestPriority && t.portIsCloser(coords, port) {
 				best = streamID
 				bestPriority = priority
 			}
 		}
-		if bestPriority != 0 {
+		if best != "" {
 			buf := t.queues.bufs[best]
 			var packet switch_packetInfo
 			// TODO decide if this should be LIFO or FIFO