diff --git a/router/java/src/net/i2p/router/peermanager/ProfileOrganizer.java b/router/java/src/net/i2p/router/peermanager/ProfileOrganizer.java
index d75706a02572ed6fe656ea00c79a1b498a699f3b..9d9a8b7461ac27c7a174cf6614ae628b89be6bd8 100644
--- a/router/java/src/net/i2p/router/peermanager/ProfileOrganizer.java
+++ b/router/java/src/net/i2p/router/peermanager/ProfileOrganizer.java
@@ -379,34 +379,30 @@ public class ProfileOrganizer {
      * Return a set of Hashes for peers that are both not failing and we're actively
      * talking with.
      *
+     * We use commSystem().isEstablished(), not profile.getIsActive(), as the
+     * NTCP idle time is now shorter than the 5 minute getIsActive() threshold,
+     * and we're using this to try and limit connections.
+     *
+     * Caution, this does NOT cascade further to non-connected peers, so it should only
+     * be used when there is a good number of connected peers.
+     *
+     * @param exclude non-null
+     * No mask parameter, to be fixed
      */
-    /*
-    private void selectActiveNotFailingPeers(int howMany, Set exclude, Set matches) {
-        if (true) {
-            selectAllNotFailingPeers(howMany, exclude, matches);
-            return;
-        }
-        // pick out the not-failing peers that we're actively talking with
+    public void selectActiveNotFailingPeers(int howMany, Set exclude, Set matches) {
         if (matches.size() < howMany) {
-            synchronized (_reorganizeLock) {
-                for (Iterator iter = _notFailingPeers.keySet().iterator(); iter.hasNext(); ) {
-                    Hash peer = (Hash)iter.next();
-                    if ( (exclude != null) && exclude.contains(peer) ) continue;
-                    if (matches.contains(peer)) continue;
-                    PeerProfile prof = (PeerProfile)_notFailingPeers.get(peer);
-                    if (prof.getIsActive())
-                        matches.add(peer);
-                    if (matches.size() >= howMany)
-                        return;
+            getReadLock();
+            try {
+                for (Iterator<Hash> iter = _notFailingPeers.keySet().iterator(); iter.hasNext(); ) {
+                    Hash peer = iter.next();
+                    if (!_context.commSystem().isEstablished(peer))
+                        exclude.add(peer);
                 }
-            }
+                locked_selectPeers(_notFailingPeers, howMany, exclude, matches, 0);
+            } finally { releaseReadLock(); }
         }
-        // ok, still not enough, pick out the not-failing peers that we aren't talking with
-        if (matches.size() < howMany)
-            selectAllNotFailingPeers(howMany, exclude, matches);
-        return;
     }
-    */
+
     /**
      * Return a set of Hashes for peers that are not failing.
      *
@@ -414,6 +410,10 @@ public class ProfileOrganizer {
     public void selectAllNotFailingPeers(int howMany, Set exclude, Set matches, boolean onlyNotFailing) {
         selectAllNotFailingPeers(howMany, exclude, matches, onlyNotFailing, 0);
     }
+    /**
+     * @param mask ignored, should call locked_selectPeers, to be fixed
+     *
+     */
     private void selectAllNotFailingPeers(int howMany, Set exclude, Set matches, boolean onlyNotFailing, int mask) {
         if (matches.size() < howMany) {
             int orig = matches.size();
diff --git a/router/java/src/net/i2p/router/tunnel/pool/ExploratoryPeerSelector.java b/router/java/src/net/i2p/router/tunnel/pool/ExploratoryPeerSelector.java
index 629a4b5245c1164611c95e1ac7421c7377ca4980..b324990de68d263281cde473bda0074de936d372 100644
--- a/router/java/src/net/i2p/router/tunnel/pool/ExploratoryPeerSelector.java
+++ b/router/java/src/net/i2p/router/tunnel/pool/ExploratoryPeerSelector.java
@@ -42,10 +42,15 @@ class ExploratoryPeerSelector extends TunnelPeerSelector {
         // exclude.addAll(fac.getFloodfillPeers());
         HashSet matches = new HashSet(length);
         boolean exploreHighCap = shouldPickHighCap(ctx);
+        //
+        // We don't honor IP Restriction here, to be fixed
+        //
         if (exploreHighCap) 
             ctx.profileOrganizer().selectHighCapacityPeers(length, exclude, matches);
-        else
+        else if (ctx.commSystem().haveOutboundCapacity())
             ctx.profileOrganizer().selectNotFailingPeers(length, exclude, matches, false);
+        else // use only connected peers so we don't make more connections
+            ctx.profileOrganizer().selectActiveNotFailingPeers(length, exclude, matches);
         
         if (l.shouldLog(Log.DEBUG))
             l.debug("profileOrganizer.selectNotFailing(" + length + ") found " + matches);