diff --git a/mud b/mud
index 842dada..d0dc607 160000
--- a/mud
+++ b/mud
@@ -1 +1 @@
-Subproject commit 842dadad9460ad4d1027d930742cdfbc9ff78abf
+Subproject commit d0dc6076c894ba5038a70b2e2960760899bd2393
diff --git a/src/bind.c b/src/bind.c
index f7ca315..0c08fbe 100644
--- a/src/bind.c
+++ b/src/bind.c
@@ -370,6 +370,10 @@ gt_bind(int argc, char **argv)
                     res.status.bind = bind_addr;
                     res.status.peer = peer_addr;
                     break;
+                case CTL_BAD:
+                    if (mud_get_bad(mud, &res.bad))
+                        res.ret = errno;
+                    break;
                 }
                 if (sendto(ctl_fd, &res, sizeof(res), 0,
                            (const struct sockaddr *)&ss, sl) == -1)
diff --git a/src/ctl.h b/src/ctl.h
index 35f80f2..c54bb76 100644
--- a/src/ctl.h
+++ b/src/ctl.h
@@ -16,6 +16,7 @@ enum ctl_type {
     CTL_KXTIMEOUT,
     CTL_TIMETOLERANCE,
     CTL_PATH_STATUS,
+    CTL_BAD,
 };
 
 struct ctl_msg {
@@ -37,6 +38,7 @@ struct ctl_msg {
             struct sockaddr_storage bind;
             struct sockaddr_storage peer;
         } status;
+        struct mud_bad bad;
         size_t mtu;
         int tc;
         unsigned long ms;
diff --git a/src/show.c b/src/show.c
index 234c48e..72a9386 100644
--- a/src/show.c
+++ b/src/show.c
@@ -11,6 +11,47 @@
 #include <arpa/inet.h>
 #include <unistd.h>
 
+static void
+gt_show_bad_line(int term, char *name, uint64_t count,
+                 struct sockaddr_storage *ss)
+{
+    if (!count)
+        return;
+
+    char addr[INET6_ADDRSTRLEN];
+    gt_toaddr(addr, sizeof(addr), (struct sockaddr *)ss);
+
+    printf(term ? "%s:\n"
+                  "  count: %"PRIu64"\n"
+                  "  last:  %s port %"PRIu16"\n"
+                : "%s"
+                  " %"PRIu64
+                  " %s %"PRIu16
+                  "\n",
+           name, count, addr[0] ? addr : "-",
+           gt_get_port((struct sockaddr *)ss));
+}
+
+static int
+gt_show_bad(int fd)
+{
+    struct ctl_msg res, req = {.type = CTL_BAD};
+
+    if (ctl_reply(fd, &res, &req))
+        return -1;
+
+    int term = isatty(1);
+
+    gt_show_bad_line(term, "decrypt",
+            res.bad.decrypt.count, &res.bad.decrypt.addr);
+    gt_show_bad_line(term, "difftime",
+            res.bad.difftime.count, &res.bad.difftime.addr);
+    gt_show_bad_line(term, "keyx",
+            res.bad.keyx.count, &res.bad.keyx.addr);
+
+    return 0;
+}
+
 static int
 gt_show_status(int fd)
 {
@@ -82,6 +123,7 @@ gt_show(int argc, char **argv)
 
     struct argz showz[] = {
         {"dev", "NAME", &dev, argz_str},
+        {"bad", NULL, NULL, argz_option},
         {NULL}};
 
     if (argz(showz, argc, argv))
@@ -106,7 +148,9 @@ gt_show(int argc, char **argv)
         return 1;
     }
 
-    int ret = gt_show_status(fd);
+    int ret = argz_is_set(showz, "bad")
+            ? gt_show_bad(fd)
+            : gt_show_status(fd);
 
     if (ret == -1)
         perror("show");