diff --git a/include/opendht/network_engine.h b/include/opendht/network_engine.h
index 2e309927..1fc5f020 100644
--- a/include/opendht/network_engine.h
+++ b/include/opendht/network_engine.h
@@ -34,7 +34,6 @@
 #include <functional>
 #include <algorithm>
 #include <memory>
-#include <random>
 #include <queue>
 
 namespace dht {
@@ -417,7 +416,7 @@ private:
     /***************
      *  Constants  *
      ***************/
-    static constexpr long unsigned MAX_REQUESTS_PER_SEC {1600};
+    static constexpr size_t MAX_REQUESTS_PER_SEC {1600};
     /* the length of a node info buffer in ipv4 format */
     static const constexpr size_t NODE4_INFO_BUF_LEN {HASH_LEN + sizeof(in_addr) + sizeof(in_port_t)};
     /* the length of a node info buffer in ipv6 format */
@@ -437,7 +436,6 @@ private:
     static constexpr size_t MAX_PACKET_VALUE_SIZE {600};
 
     static const std::string my_v;
-    static std::mt19937 rd_device;
 
     void process(std::unique_ptr<ParsedMessage>&&, const SockAddr& from);
 
@@ -518,6 +516,7 @@ private:
     using IpLimiterMap = std::map<SockAddr, IpLimiter, SockAddr::ipCmp>;
     IpLimiterMap address_rate_limiter {};
     RateLimiter<MAX_REQUESTS_PER_SEC> rate_limiter {};
+    size_t limiter_maintenance {0};
 
     // requests handling
     std::map<TransId, Sp<Request>> requests {};
diff --git a/include/opendht/rate_limiter.h b/include/opendht/rate_limiter.h
index 504c8934..061b36a5 100644
--- a/include/opendht/rate_limiter.h
+++ b/include/opendht/rate_limiter.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2016 Savoir-faire Linux Inc.
+ *  Copyright (C) 2017 Savoir-faire Linux Inc.
  *  Author : Adrien Béraud <adrien.beraud@savoirfairelinux.com>
  *
  *  This program is free software; you can redistribute it and/or modify
@@ -26,10 +26,10 @@ namespace dht {
 template<size_t Quota, unsigned long Perdiod=1>
 class RateLimiter {
 public:
-    /** Clear outdated records and return current quota usage */ 
+    /** Clear outdated records and return current quota usage */
     size_t maintain(const time_point& now) {
-        using namespace std::chrono;
-        while (not records.empty() and duration_cast<seconds>(now - records.front()) >= seconds(Perdiod))
+        auto limit = now - std::chrono::seconds(Perdiod);
+        while (not records.empty() and records.front() < limit)
             records.pop();
         return records.size();
     }
diff --git a/src/network_engine.cpp b/src/network_engine.cpp
index 8843ee3f..4986ae82 100644
--- a/src/network_engine.cpp
+++ b/src/network_engine.cpp
@@ -54,7 +54,6 @@ constexpr std::chrono::seconds NetworkEngine::RX_TIMEOUT;
 
 const std::string NetworkEngine::my_v {"RNG1"};
 const constexpr uint16_t TransId::INVALID;
-std::mt19937 NetworkEngine::rd_device {dht::crypto::random_device{}()};
 
 const TransPrefix TransPrefix::PING = {"pn"};
 const TransPrefix TransPrefix::FIND_NODE = {"fn"};
@@ -249,15 +248,15 @@ NetworkEngine::rateLimit(const SockAddr& addr)
 {
     const auto& now = scheduler.time();
 
-    // occasional IP limiter maintenance
-    std::bernoulli_distribution rand_trial(1./128.);
-    if (rand_trial(rd_device)) {
+    // occasional IP limiter maintenance (a few times every second at max rate)
+    if (limiter_maintenance++ == MAX_REQUESTS_PER_SEC/8) {
         for (auto it = address_rate_limiter.begin(); it != address_rate_limiter.end();) {
             if (it->second.maintain(now) == 0)
                 address_rate_limiter.erase(it++);
             else
                 ++it;
         }
+        limiter_maintenance = 0;
     }
 
     auto it = address_rate_limiter.emplace(addr, IpLimiter{});