diff --git a/profiles/internal/rpc/client.go b/profiles/internal/rpc/client.go
index d8f4c9b..ab268dc 100644
--- a/profiles/internal/rpc/client.go
+++ b/profiles/internal/rpc/client.go
@@ -642,17 +642,28 @@
 	suberrs := []verror.SubErr{}
 	topLevelError := verror.ErrNoServers
 	topLevelAction := verror.RetryRefetch
+	onlyErrNetwork := true
 	for _, r := range responses {
 		if r != nil && r.serverErr != nil && r.serverErr.Err != nil {
 			switch verror.ErrorID(r.serverErr.Err) {
 			case stream.ErrNotTrusted.ID, verror.ErrNotTrusted.ID, errServerAuthorizeFailed.ID:
 				topLevelError = verror.ErrNotTrusted
 				topLevelAction = verror.NoRetry
+				onlyErrNetwork = false
+			case stream.ErrNetwork.ID:
+				// do nothing
+			default:
+				onlyErrNetwork = false
 			}
 			suberrs = append(suberrs, *r.serverErr)
 		}
 	}
 
+	if onlyErrNetwork {
+		// If we only encountered network errors, then report ErrBadProtocol.
+		topLevelError = verror.ErrBadProtocol
+	}
+
 	// TODO(cnicolaou): we get system errors for things like dialing using
 	// the 'ws' protocol which can never succeed even if we retry the connection,
 	// hence we return RetryRefetch below except for the case where the servers
diff --git a/profiles/internal/rpc/stream/errors.go b/profiles/internal/rpc/stream/errors.go
index 82079e6..9d7e25b 100644
--- a/profiles/internal/rpc/stream/errors.go
+++ b/profiles/internal/rpc/stream/errors.go
@@ -22,6 +22,7 @@
 	ErrSecurity   = verror.Register(pkgPath+".errSecurity", verror.NoRetry, "{:3}")
 	ErrNotTrusted = verror.Register(pkgPath+".errNotTrusted", verror.NoRetry, "{:3}")
 	ErrNetwork    = verror.Register(pkgPath+".errNetwork", verror.NoRetry, "{:3}")
+	ErrDialFailed = verror.Register(pkgPath+".errDialFailed", verror.NoRetry, "{:3}")
 	ErrProxy      = verror.Register(pkgPath+".errProxy", verror.NoRetry, "{:3}")
 	ErrBadArg     = verror.Register(pkgPath+".errBadArg", verror.NoRetry, "{:3}")
 	ErrBadState   = verror.Register(pkgPath+".errBadState", verror.NoRetry, "{:3}")
diff --git a/profiles/internal/rpc/stream/manager/error_test.go b/profiles/internal/rpc/stream/manager/error_test.go
index 7d6e27e..ff51fe6 100644
--- a/profiles/internal/rpc/stream/manager/error_test.go
+++ b/profiles/internal/rpc/stream/manager/error_test.go
@@ -100,7 +100,7 @@
 	// bad protocol
 	ep, _ := inaming.NewEndpoint(naming.FormatEndpoint("x", "127.0.0.1:2"))
 	_, err := client.Dial(ep, pclient)
-	if verror.ErrorID(err) != stream.ErrBadArg.ID {
+	if verror.ErrorID(err) != stream.ErrDialFailed.ID {
 		t.Fatalf("wrong error: %s", err)
 	}
 	t.Log(err)
@@ -108,7 +108,7 @@
 	// no server
 	ep, _ = inaming.NewEndpoint(naming.FormatEndpoint("tcp", "127.0.0.1:2"))
 	_, err = client.Dial(ep, pclient)
-	if verror.ErrorID(err) != stream.ErrNetwork.ID {
+	if verror.ErrorID(err) != stream.ErrDialFailed.ID {
 		t.Fatalf("wrong error: %s", err)
 	}
 	t.Log(err)
diff --git a/profiles/internal/rpc/stream/manager/manager.go b/profiles/internal/rpc/stream/manager/manager.go
index 5ee4fd0..ee05736 100644
--- a/profiles/internal/rpc/stream/manager/manager.go
+++ b/profiles/internal/rpc/stream/manager/manager.go
@@ -89,11 +89,11 @@
 	if d, _, _ := rpc.RegisteredProtocol(network); d != nil {
 		conn, err := d(network, address, timeout)
 		if err != nil {
-			return nil, verror.New(stream.ErrNetwork, nil, err)
+			return nil, verror.New(stream.ErrDialFailed, nil, err)
 		}
 		return conn, nil
 	}
-	return nil, verror.New(stream.ErrBadArg, nil, verror.New(errUnknownNetwork, nil, network))
+	return nil, verror.New(stream.ErrDialFailed, nil, verror.New(errUnknownNetwork, nil, network))
 }
 
 // FindOrDialVIF returns the network connection (VIF) to the provided address
diff --git a/profiles/internal/rpc/stream/vc/vc.go b/profiles/internal/rpc/stream/vc/vc.go
index d15482d..8f4a5eb 100644
--- a/profiles/internal/rpc/stream/vc/vc.go
+++ b/profiles/internal/rpc/stream/vc/vc.go
@@ -498,7 +498,7 @@
 			select {
 			case <-remotePubKeyChan:
 			case <-vc.closeCh:
-				return verror.New(errClosedDuringHandshake, nil, vc.VCI)
+				return verror.New(stream.ErrNetwork, nil, verror.New(errClosedDuringHandshake, nil, vc.VCI))
 			}
 		}
 		return nil
@@ -530,13 +530,13 @@
 			case theirKey := <-remotePubKeyChan:
 				return theirKey, nil
 			case <-vc.closeCh:
-				return nil, verror.New(errClosedDuringHandshake, nil, vc.VCI)
+				return nil, verror.New(stream.ErrNetwork, nil, verror.New(errClosedDuringHandshake, nil, vc.VCI))
 			}
 		}
 		var err error
 		crypter, err = crypto.NewBoxCrypter(exchange, vc.pool)
 		if err != nil {
-			return vc.appendCloseReason(verror.New(stream.ErrNetwork, nil,
+			return vc.appendCloseReason(verror.New(stream.ErrSecurity, nil,
 				verror.New(errFailedToSetupEncryption, nil, err)))
 		}
 		// The version is set by FinishHandshakeDialedVC and exchange (called by
diff --git a/profiles/internal/rpc/test/client_test.go b/profiles/internal/rpc/test/client_test.go
index caf87ab..4561cc4 100644
--- a/profiles/internal/rpc/test/client_test.go
+++ b/profiles/internal/rpc/test/client_test.go
@@ -442,7 +442,7 @@
 	}
 	ns.SetRoots(brkRoot.Name())
 
-	nctx, _ := context.WithTimeout(ctx, 100*time.Millisecond)
+	nctx, _ := context.WithTimeout(ctx, time.Minute)
 	call, err := client.StartCall(nctx, "name", "noname", nil, options.NoRetry{}, options.SecurityNone)
 	if verror.ErrorID(err) != verror.ErrBadProtocol.ID {
 		t.Fatalf("wrong error: %s", err)
@@ -458,7 +458,7 @@
 	defer fn()
 
 	call, err = client.StartCall(nctx, name, "noname", nil, options.NoRetry{})
-	if verror.ErrorID(err) != verror.ErrNoServers.ID {
+	if verror.ErrorID(err) != verror.ErrBadProtocol.ID {
 		t.Fatalf("wrong error: %s", err)
 	}
 	if call != nil {