diff --git a/include/osmocom/gsm/gsup.h b/include/osmocom/gsm/gsup.h
index 7f304a3..1374e0e 100644
--- a/include/osmocom/gsm/gsup.h
+++ b/include/osmocom/gsm/gsup.h
@@ -42,7 +42,9 @@
 #include <osmocom/core/msgb.h>
 #include <osmocom/gsm/gsup_sms.h>
 #include <osmocom/gsm/protocol/gsm_23_003.h>
+#include <osmocom/gsm/protocol/gsm_03_40.h>
 #include <osmocom/gsm/protocol/gsm_04_08_gprs.h>
+#include <osmocom/gsm/protocol/gsm_08_08.h>
 #include <osmocom/crypt/auth.h>
 
 #define OSMO_GSUP_PORT 4222
@@ -103,6 +105,14 @@
 	OSMO_GSUP_IMEI_IE			= 0x50,
 	OSMO_GSUP_IMEI_RESULT_IE		= 0x51,
 
+	/* Inter-MSC handover related */
+	OSMO_GSUP_SOURCE_NAME_IE		= 0x60,
+	OSMO_GSUP_DESTINATION_NAME_IE		= 0x61,
+	OSMO_GSUP_AN_APDU_IE			= 0x62,
+	OSMO_GSUP_CAUSE_RR_IE			= 0x63,
+	OSMO_GSUP_CAUSE_BSSAP_IE		= 0x64,
+	OSMO_GSUP_CAUSE_SM_IE			= 0x65,
+
 	_OSMO_GSUP_IEI_END_MARKER
 };
 
@@ -164,6 +174,26 @@
 	OSMO_GSUP_MSGT_CHECK_IMEI_REQUEST	= 0b00110000,
 	OSMO_GSUP_MSGT_CHECK_IMEI_ERROR		= 0b00110001,
 	OSMO_GSUP_MSGT_CHECK_IMEI_RESULT	= 0b00110010,
+
+	OSMO_GSUP_MSGT_E_PREPARE_HANDOVER_REQUEST		= 0b00110100,
+	OSMO_GSUP_MSGT_E_PREPARE_HANDOVER_ERROR			= 0b00110101,
+	OSMO_GSUP_MSGT_E_PREPARE_HANDOVER_RESULT		= 0b00110110,
+
+	OSMO_GSUP_MSGT_E_PREPARE_SUBSEQUENT_HANDOVER_REQUEST	= 0b00111000,
+	OSMO_GSUP_MSGT_E_PREPARE_SUBSEQUENT_HANDOVER_ERROR	= 0b00111001,
+	OSMO_GSUP_MSGT_E_PREPARE_SUBSEQUENT_HANDOVER_RESULT	= 0b00111010,
+
+	OSMO_GSUP_MSGT_E_SEND_END_SIGNAL_REQUEST		= 0b00111100,
+	OSMO_GSUP_MSGT_E_SEND_END_SIGNAL_ERROR			= 0b00111101,
+	OSMO_GSUP_MSGT_E_SEND_END_SIGNAL_RESULT			= 0b00111110,
+
+	OSMO_GSUP_MSGT_E_PROCESS_ACCESS_SIGNALLING_REQUEST	= 0b01000000,
+	OSMO_GSUP_MSGT_E_FORWARD_ACCESS_SIGNALLING_REQUEST	= 0b01000100,
+
+	OSMO_GSUP_MSGT_E_CLOSE					= 0b01000111,
+	OSMO_GSUP_MSGT_E_ABORT					= 0b01001011,
+
+	OSMO_GSUP_MSGT_E_ROUTING_ERROR				= 0b01001110,
 };
 
 #define OSMO_GSUP_IS_MSGT_REQUEST(msgt) (((msgt) & 0b00000011) == 0b00)
@@ -190,6 +220,12 @@
 	OSMO_GSUP_IMEI_RESULT_NACK		= 2, /* on wire: 1 */
 };
 
+/* 3GPP 29.002 AccessNetworkProtocolId */
+enum osmo_gsup_access_network_protocol {
+	OSMO_GSUP_ACCESS_NETWORK_PROTOCOL_TS3G_48006 = 1,
+	OSMO_GSUP_ACCESS_NETWORK_PROTOCOL_TS3G_25413 = 2,
+};
+
 /*! TCAP-like session state */
 enum osmo_gsup_session_state {
 	/*! Undefined session state */
@@ -245,6 +281,14 @@
 static inline const char *osmo_gsup_message_class_name(enum osmo_gsup_message_class val)
 { return get_value_string(osmo_gsup_message_class_names, val); }
 
+/*! AccessNetworkSignalInfo as in 3GPP TS 29.002. */
+struct osmo_gsup_an_apdu {
+	/* AccessNetworkProtocolId as in 3GPP TS 29.002. */
+	enum osmo_gsup_access_network_protocol access_network_proto;
+	const uint8_t *data;
+	size_t data_len;
+};
+
 /*! parsed/decoded GSUP protocol message */
 struct osmo_gsup_message {
 	enum osmo_gsup_message_type	message_type;
@@ -307,6 +351,28 @@
 	 * Inter-MSC messages are *required* to set a class = OSMO_GSUP_MESSAGE_CLASS_INTER_MSC. For older message classes, this may
 	 * be omitted (for backwards compatibility only -- if in doubt, include it). */
 	enum osmo_gsup_message_class		message_class;
+
+	/*! For messages routed via another GSUP entity (via HLR), the IPA name of the entity that sent this message. */
+	const uint8_t			*source_name;
+	/*! Number of bytes in source_name. */
+	size_t				source_name_len;
+	/*! For messages routed via another GSUP entity (via HLR), the IPA name of the entity that should ultimately
+	 * receive this message. */
+	const uint8_t			*destination_name;
+	/*! Number of bytes in destination_name. */
+	size_t				destination_name_len;
+
+	/*! inter-MSC AN-APDU. */
+	struct osmo_gsup_an_apdu	an_apdu;
+
+	uint8_t				cause_rr; /*!< 0 is a valid cause */
+	bool				cause_rr_set; /*!< whether cause_rr is set */
+
+	enum gsm0808_cause		cause_bssap; /*!< 0 is a valid cause */
+	bool				cause_bssap_set; /*!< whether cause_bssap is set */
+
+	/*! Session Management cause as of 3GPP TS 24.008 10.5.6.6 / Table 10.5.157. */
+	enum gsm48_gsm_cause		cause_sm;
 };
 
 int osmo_gsup_decode(const uint8_t *data, size_t data_len,
diff --git a/src/gsm/gsup.c b/src/gsm/gsup.c
index 71dbbe1..a3d9eef 100644
--- a/src/gsm/gsup.c
+++ b/src/gsm/gsup.c
@@ -83,6 +83,26 @@
 	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_CHECK_IMEI_ERROR),
 	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_CHECK_IMEI_RESULT),
 
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_PREPARE_HANDOVER_REQUEST),
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_PREPARE_HANDOVER_ERROR),
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_PREPARE_HANDOVER_RESULT),
+
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_PREPARE_SUBSEQUENT_HANDOVER_REQUEST),
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_PREPARE_SUBSEQUENT_HANDOVER_ERROR),
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_PREPARE_SUBSEQUENT_HANDOVER_RESULT),
+
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_SEND_END_SIGNAL_REQUEST),
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_SEND_END_SIGNAL_ERROR),
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_SEND_END_SIGNAL_RESULT),
+
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_PROCESS_ACCESS_SIGNALLING_REQUEST),
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_FORWARD_ACCESS_SIGNALLING_REQUEST),
+
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_CLOSE),
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_ABORT),
+
+	OSMO_VALUE_STRING(OSMO_GSUP_MSGT_E_ROUTING_ERROR),
+
 	{ 0, NULL }
 };
 
@@ -247,6 +267,26 @@
 	return -1;
 }
 
+/*! Decode AN-apdu (see 3GPP TS 29.002 7.6.9.1).
+ * \param[out] gsup_msg abstract GSUP message structure
+ * \param[in]  data     pointer to the raw IE payload
+ * \param[in]  data_len length of IE pointed by \ref data
+ * \returns 0 in case of success, negative in case of error
+ */
+int osmo_gsup_decode_an_apdu(struct osmo_gsup_message *gsup_msg, const uint8_t *data, size_t data_len)
+{
+	if (data_len < 1) {
+		LOGP(DLGSUP, LOGL_ERROR, "Corrupted an_apdu message (length must be >= 1)\n");
+		return -EINVAL;
+	}
+
+	gsup_msg->an_apdu.access_network_proto = data[0];
+	gsup_msg->an_apdu.data_len = data_len -1;
+	gsup_msg->an_apdu.data = data + 1;
+
+	return 0;
+}
+
 /*! Decode (parse) a GSUP message
  *  \param[in] const_data input data to be parsed
  *  \param[in] data_len length of input (\a const_data)
@@ -481,6 +521,36 @@
 			gsup_msg->message_class = value[0];
 			break;
 
+		case OSMO_GSUP_SOURCE_NAME_IE:
+			gsup_msg->source_name = value;
+			gsup_msg->source_name_len = value_len;
+			break;
+
+		case OSMO_GSUP_DESTINATION_NAME_IE:
+			gsup_msg->destination_name = value;
+			gsup_msg->destination_name_len = value_len;
+			break;
+
+		case OSMO_GSUP_AN_APDU_IE:
+			rc = osmo_gsup_decode_an_apdu(gsup_msg, value, value_len);
+			if (rc)
+				return rc;
+			break;
+
+		case OSMO_GSUP_CAUSE_RR_IE:
+			gsup_msg->cause_rr = value[0];
+			gsup_msg->cause_rr_set = true;
+			break;
+
+		case OSMO_GSUP_CAUSE_BSSAP_IE:
+			gsup_msg->cause_bssap = value[0];
+			gsup_msg->cause_bssap_set = true;
+			break;
+
+		case OSMO_GSUP_CAUSE_SM_IE:
+			gsup_msg->cause_sm = value[0];
+			break;
+
 		default:
 			LOGP(DLGSUP, LOGL_NOTICE,
 			     "GSUP IE type %d unknown\n", iei);
@@ -568,6 +638,35 @@
 	*len_field = msgb_length(msg) - old_len;
 }
 
+/*! Encode AN-apdu (see 3GPP TS 29.002 7.6.9.1).
+ * \param[out] msg      target message buffer (caller-allocated)
+ * \param[in]  gsup_msg abstract GSUP message structure
+ * \returns 0 in case of success, negative in case of error
+ */
+int osmo_gsup_encode_an_apdu(struct msgb *msg, const struct osmo_gsup_message *gsup_msg)
+{
+	const struct osmo_gsup_an_apdu an_apdu = gsup_msg->an_apdu;
+
+	if (msgb_tailroom(msg) < 2 + an_apdu.data_len) {
+		LOGP(DLGSUP, LOGL_ERROR, "Not enough tailroom in msg to encode an_apdu:"
+		     " IE header (2) + an_apdu.data_len (%zu) == %zu, msgb tailroom == %d\n",
+		     an_apdu.data_len, an_apdu.data_len + 2, msgb_tailroom(msg));
+		return -ENOMEM;
+	}
+
+	/* Tag and total length */
+	msgb_tv_put(msg, OSMO_GSUP_AN_APDU_IE, 1 + an_apdu.data_len);
+
+	/* Put access_network_proto */
+	msgb_v_put(msg, an_apdu.access_network_proto);
+
+	/* Put data */
+	uint8_t *buf = msgb_put(msg, an_apdu.data_len);
+	memcpy(buf, an_apdu.data, an_apdu.data_len);
+
+	return 0;
+}
+
 /*! Encode a GSUP message
  *  \param[out] msg message buffer to which encoded message is written
  *  \param[in] gsup_msg \ref osmo_gsup_message data to be encoded
@@ -727,6 +826,34 @@
 		msgb_tlv_put(msg, OSMO_GSUP_MESSAGE_CLASS_IE, sizeof(u8), &u8);
 	}
 
+	if (gsup_msg->source_name)
+		msgb_tlv_put(msg, OSMO_GSUP_SOURCE_NAME_IE, gsup_msg->source_name_len, gsup_msg->source_name);
+
+	if (gsup_msg->destination_name)
+		msgb_tlv_put(msg, OSMO_GSUP_DESTINATION_NAME_IE, gsup_msg->destination_name_len,
+			     gsup_msg->destination_name);
+
+	if (gsup_msg->an_apdu.access_network_proto || gsup_msg->an_apdu.data_len) {
+		rc = osmo_gsup_encode_an_apdu(msg, gsup_msg);
+		if (rc) {
+			LOGP(DLGSUP, LOGL_ERROR, "Failed to encode AN-apdu IE \n");
+			return -EINVAL;
+		}
+	}
+
+	if (gsup_msg->cause_rr_set) {
+		u8 = gsup_msg->cause_rr;
+		msgb_tlv_put(msg, OSMO_GSUP_CAUSE_RR_IE, sizeof(u8), &u8);
+	}
+
+	if (gsup_msg->cause_bssap_set) {
+		u8 = gsup_msg->cause_bssap;
+		msgb_tlv_put(msg, OSMO_GSUP_CAUSE_BSSAP_IE, sizeof(u8), &u8);
+	}
+
+	if ((u8 = gsup_msg->cause_sm))
+		msgb_tlv_put(msg, OSMO_GSUP_CAUSE_SM_IE, sizeof(u8), &u8);
+
 	return 0;
 }
 
diff --git a/tests/gsup/gsup_test.c b/tests/gsup/gsup_test.c
index 0631a51..b84c88f 100644
--- a/tests/gsup/gsup_test.c
+++ b/tests/gsup/gsup_test.c
@@ -9,9 +9,16 @@
 
 /* Tests for osmo_gsup_messages.c */
 
+/* Complete IEs used multiple times (sorted alphabetically)
+ * 1st byte: IEI from osmo_gsup_iei, 2nd byte: length */
 #define TEST_IMSI_IE 0x01, 0x08, 0x21, 0x43, 0x65, 0x87, 0x09, 0x21, 0x43, 0xf5
 #define TEST_IMSI_STR "123456789012345"
 #define TEST_CLASS_SUBSCR_IE 0xa, 0x1, 0x1
+#define TEST_CLASS_INTER_MSC_IE 0xa, 0x1, 0x4
+#define TEST_MSISDN_IE 0x08, 0x07, 0x91, 0x94, 0x61, 0x46, 0x32, 0x24, 0x43
+#define TEST_AN_APDU_IE 0x62, 0x05, 0x01, 0x42, 0x42, 0x42, 0x42
+#define TEST_SOURCE_NAME_IE 0x60, 0x05, 'M', 'S', 'C', '-', 'A'
+#define TEST_DESTINATION_NAME_IE 0x61, 0x05, 'M', 'S', 'C', '-', 'B'
 
 static void test_gsup_messages_dec_enc(void)
 {
@@ -66,8 +73,7 @@
 	static const uint8_t update_location_res[] = {
 		0x06,
 		TEST_IMSI_IE,
-		0x08, 0x07, /* MSISDN of the subscriber */
-			0x91, 0x94, 0x61, 0x46, 0x32, 0x24, 0x43,
+		TEST_MSISDN_IE,
 		0x09, 0x07, /* HLR-Number of the subscriber */
 			0x91, 0x83, 0x52, 0x38, 0x48, 0x83, 0x93,
 		0x04, 0x00, /* PDP info complete */
@@ -312,6 +318,217 @@
 			0x00, /* OSMO_GSUP_IMEI_RESULT_ACK */
 	};
 
+	/* Handover related test messages. Oftentimes they only differ in the
+	 * AN_APDU_IE, which is mostly a blob in GSUP. To give a better example
+	 * of how the messages can be used, I've added the information an_apdu
+	 * holds in brackets (see osmo-msc.git's doc/interMSC_HO_GSUP_msgs.txt).
+	 * The session states are from the ASCII art in this e-mail:
+	 * https://lists.osmocom.org/pipermail/openbsc/2019-January/012653.html */
+	static const uint8_t send_e_prepare_handover_req[] = {
+		0x34, /* OSMO_GSUP_MSGT_E_PREPARE_HANDOVER_REQUEST */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (begin) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x01,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+		TEST_AN_APDU_IE, /* (Handover Request) */
+	};
+
+	static const uint8_t send_e_prepare_handover_err[] = {
+		0x35, /* OSMO_GSUP_MSGT_E_PREPARE_HANDOVER_ERROR */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (continue) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x02,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+
+		/* cause_bssap */
+		0x64, 0x01,
+			0x51, /* GSM0808_CAUSE_INVALID_MESSAGE_CONTENTS */
+	};
+
+	static const uint8_t send_e_prepare_handover_res[] = {
+		0x36, /* OSMO_GSUP_MSGT_E_PREPARE_HANDOVER_RESULT */
+		TEST_IMSI_IE,
+		TEST_MSISDN_IE, /* (Handover Number) */
+
+		/* Session ID and state (continue) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x02,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+		TEST_AN_APDU_IE, /* (Handover Request Ack) */
+	};
+
+	static const uint8_t send_e_prepare_subsequent_handover_req[] = {
+		0x38, /* OSMO_GSUP_MSGT_E_PREPARE_SUBSEQUENT_HANDOVER_REQUEST */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (begin) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x01,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+		TEST_AN_APDU_IE, /* (Handover Required) */
+	};
+
+	static const uint8_t send_e_prepare_subsequent_handover_err[] = {
+		0x39, /* OSMO_GSUP_MSGT_E_PREPARE_SUBSEQUENT_HANDOVER_ERROR */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (continue) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x02,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+
+		/* cause_bssap */
+		0x64, 0x01,
+			0x51, /* GSM0808_CAUSE_INVALID_MESSAGE_CONTENTS */
+	};
+
+	static const uint8_t send_e_prepare_subsequent_handover_res[] = {
+		0x3A, /* OSMO_GSUP_MSGT_E_PREPARE_SUBSEQUENT_HANDOVER_RESULT */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (continue) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x02,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+		TEST_AN_APDU_IE, /* (Handover Request Ack) */
+	};
+
+	static const uint8_t send_e_send_end_signal_req[] = {
+		0x3C, /* OSMO_GSUP_MSGT_E_SEND_END_SIGNAL_REQUEST */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (end) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x03,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+		TEST_AN_APDU_IE, /* (Handover Complete) */
+	};
+
+	static const uint8_t send_e_send_end_signal_err[] = {
+		0x3D, /* OSMO_GSUP_MSGT_E_SEND_END_SIGNAL_ERROR */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (continue) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x02,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+
+		/* cause_bssap */
+		0x64, 0x01,
+			0x51, /* GSM0808_CAUSE_INVALID_MESSAGE_CONTENTS */
+	};
+
+	static const uint8_t send_e_process_access_signalling_req[] = {
+		0x40, /* OSMO_GSUP_MSGT_E_PROCESS_ACCESS_SIGNALLING_REQUEST */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (continue) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x02,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+		TEST_AN_APDU_IE, /* (Handover Detect) */
+	};
+
+	static const uint8_t send_e_send_end_signal_res[] = {
+		0x3E, /* OSMO_GSUP_MSGT_E_SEND_END_SIGNAL_RESULT */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (end) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x03,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+		TEST_AN_APDU_IE, /* (Handover Complete) */
+	};
+
+	static const uint8_t send_e_forward_access_signalling_req [] = {
+		0x44, /* OSMO_GSUP_MSGT_E_FORWARD_ACCESS_SIGNALLING_REQUEST */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (continue) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x02,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+		TEST_AN_APDU_IE, /* (DTAP, e.g. CC, SMS, ...) */
+	};
+
+	static const uint8_t send_e_close[] = {
+		0x47, /* OSMO_GSUP_MSGT_E_CLOSE */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (end) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x03,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+	};
+
+	static const uint8_t send_e_abort[] = {
+		0x4B, /* OSMO_GSUP_MSGT_E_ABORT */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (end) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x03,
+
+		TEST_CLASS_INTER_MSC_IE,
+
+		/* cause_bssap */
+		0x64, 0x01,
+			0x51, /* GSM0808_CAUSE_INVALID_MESSAGE_CONTENTS */
+	};
+
+	static const uint8_t send_e_routing_error[] = {
+		0x4E, /* OSMO_GSUP_MSGT_E_ROUTING_ERROR */
+		TEST_IMSI_IE,
+
+		/* Session ID and state (end) */
+		0x30, 0x04, 0xde, 0xad, 0xbe, 0xef,
+		0x31, 0x01, 0x03,
+
+		TEST_CLASS_INTER_MSC_IE,
+		TEST_SOURCE_NAME_IE,
+		TEST_DESTINATION_NAME_IE,
+	};
+
 	static const struct test {
 		char *name;
 		const uint8_t *data;
@@ -367,6 +584,34 @@
 			send_check_imei_err, sizeof(send_check_imei_err)},
 		{"Check IMEI Result",
 			send_check_imei_res, sizeof(send_check_imei_res)},
+		{"E Prepare Handover Request",
+			send_e_prepare_handover_req, sizeof(send_e_prepare_handover_req)},
+		{"E Prepare Handover Error",
+			send_e_prepare_handover_err, sizeof(send_e_prepare_handover_err)},
+		{"E Prepare Handover Result",
+			send_e_prepare_handover_res, sizeof(send_e_prepare_handover_res)},
+		{"E Prepare Subsequent Handover Request",
+			send_e_prepare_subsequent_handover_req, sizeof(send_e_prepare_subsequent_handover_req)},
+		{"E Prepare Subsequent Handover Error",
+			send_e_prepare_subsequent_handover_err, sizeof(send_e_prepare_subsequent_handover_err)},
+		{"E Prepare Subsequent Handover Result",
+			send_e_prepare_subsequent_handover_res, sizeof(send_e_prepare_subsequent_handover_res)},
+		{"E Send End Signal Request",
+			send_e_send_end_signal_req, sizeof(send_e_send_end_signal_req)},
+		{"E Send End Signal Error",
+			send_e_send_end_signal_err, sizeof(send_e_send_end_signal_err)},
+		{"E Send End Signal Result",
+			send_e_send_end_signal_res, sizeof(send_e_send_end_signal_res)},
+		{"E Process Access Signalling Request",
+			send_e_process_access_signalling_req, sizeof(send_e_process_access_signalling_req)},
+		{"E Forward Access Signalling Request",
+			send_e_forward_access_signalling_req, sizeof(send_e_forward_access_signalling_req)},
+		{"E Close",
+			send_e_close, sizeof(send_e_close)},
+		{"E Abort",
+			send_e_abort, sizeof(send_e_abort)},
+		{"E Routing Error",
+			send_e_routing_error, sizeof(send_e_routing_error)},
 	};
 
 	printf("Test GSUP message decoding/encoding\n");
diff --git a/tests/gsup/gsup_test.err b/tests/gsup/gsup_test.err
index 9283823..e5fe6ee 100644
--- a/tests/gsup/gsup_test.err
+++ b/tests/gsup/gsup_test.err
@@ -73,6 +73,48 @@
   generated message: 32 01 08 21 43 65 87 09 21 43 f5 51 01 00 
   original message:  32 01 08 21 43 65 87 09 21 43 f5 51 01 00 
   IMSI:              123456789012345
+  generated message: 34 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 01 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  original message:  34 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 01 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  IMSI:              123456789012345
+  generated message: 35 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 64 01 51 
+  original message:  35 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 64 01 51 
+  IMSI:              123456789012345
+  generated message: 36 01 08 21 43 65 87 09 21 43 f5 08 07 91 94 61 46 32 24 43 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  original message:  36 01 08 21 43 65 87 09 21 43 f5 08 07 91 94 61 46 32 24 43 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  IMSI:              123456789012345
+  generated message: 38 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 01 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  original message:  38 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 01 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  IMSI:              123456789012345
+  generated message: 39 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 64 01 51 
+  original message:  39 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 64 01 51 
+  IMSI:              123456789012345
+  generated message: 3a 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  original message:  3a 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  IMSI:              123456789012345
+  generated message: 3c 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 03 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  original message:  3c 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 03 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  IMSI:              123456789012345
+  generated message: 3d 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 64 01 51 
+  original message:  3d 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 64 01 51 
+  IMSI:              123456789012345
+  generated message: 3e 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 03 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  original message:  3e 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 03 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  IMSI:              123456789012345
+  generated message: 40 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  original message:  40 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  IMSI:              123456789012345
+  generated message: 44 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  original message:  44 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 02 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 62 05 01 42 42 42 42 
+  IMSI:              123456789012345
+  generated message: 47 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 03 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 
+  original message:  47 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 03 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 
+  IMSI:              123456789012345
+  generated message: 4b 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 03 0a 01 04 64 01 51 
+  original message:  4b 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 03 0a 01 04 64 01 51 
+  IMSI:              123456789012345
+  generated message: 4e 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 03 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 
+  original message:  4e 01 08 21 43 65 87 09 21 43 f5 30 04 de ad be ef 31 01 03 0a 01 04 60 05 4d 53 43 2d 41 61 05 4d 53 43 2d 42 
+  IMSI:              123456789012345
   message 0: tested 14 truncations, 13 parse failures
   message 1: tested 14 truncations, 13 parse failures
   message 2: tested 83 truncations, 81 parse failures
@@ -98,19 +140,33 @@
   message 22: tested 22 truncations, 21 parse failures
   message 23: tested 14 truncations, 13 parse failures
   message 24: tested 14 truncations, 13 parse failures
+  message 25: tested 44 truncations, 38 parse failures
+  message 26: tested 40 truncations, 34 parse failures
+  message 27: tested 53 truncations, 46 parse failures
+  message 28: tested 44 truncations, 38 parse failures
+  message 29: tested 40 truncations, 34 parse failures
+  message 30: tested 44 truncations, 38 parse failures
+  message 31: tested 44 truncations, 38 parse failures
+  message 32: tested 40 truncations, 34 parse failures
+  message 33: tested 44 truncations, 38 parse failures
+  message 34: tested 44 truncations, 38 parse failures
+  message 35: tested 44 truncations, 38 parse failures
+  message 36: tested 37 truncations, 32 parse failures
+  message 37: tested 26 truncations, 22 parse failures
+  message 38: tested 37 truncations, 32 parse failures
 DLGSUP Stopping DLGSUP logging
   message 0: tested 3584 modifications, 771 parse failures
   message 1: tested 3584 modifications, 770 parse failures
   message 2: tested 21248 modifications, 2575 parse failures
   message 3: tested 2816 modifications, 510 parse failures
   message 4: tested 3584 modifications, 770 parse failures
-  message 5: tested 20736 modifications, 4022 parse failures
+  message 5: tested 20736 modifications, 4023 parse failures
   message 6: tested 3584 modifications, 771 parse failures
   message 7: tested 3584 modifications, 770 parse failures
   message 8: tested 2816 modifications, 510 parse failures
   message 9: tested 2816 modifications, 510 parse failures
   message 10: tested 3584 modifications, 770 parse failures
-  message 11: tested 3328 modifications, 769 parse failures
+  message 11: tested 3328 modifications, 770 parse failures
   message 12: tested 54016 modifications, 4626 parse failures
   message 13: tested 11520 modifications, 1026 parse failures
   message 14: tested 5120 modifications, 1030 parse failures
@@ -124,3 +180,17 @@
   message 22: tested 5632 modifications, 771 parse failures
   message 23: tested 3584 modifications, 770 parse failures
   message 24: tested 3584 modifications, 771 parse failures
+  message 25: tested 11264 modifications, 2058 parse failures
+  message 26: tested 10240 modifications, 2060 parse failures
+  message 27: tested 13568 modifications, 2313 parse failures
+  message 28: tested 11264 modifications, 2058 parse failures
+  message 29: tested 10240 modifications, 2060 parse failures
+  message 30: tested 11264 modifications, 2058 parse failures
+  message 31: tested 11264 modifications, 2057 parse failures
+  message 32: tested 10240 modifications, 2060 parse failures
+  message 33: tested 11264 modifications, 2057 parse failures
+  message 34: tested 11264 modifications, 2058 parse failures
+  message 35: tested 11264 modifications, 2058 parse failures
+  message 36: tested 9472 modifications, 1803 parse failures
+  message 37: tested 6656 modifications, 1546 parse failures
+  message 38: tested 9472 modifications, 1803 parse failures
diff --git a/tests/gsup/gsup_test.ok b/tests/gsup/gsup_test.ok
index 70f723c..db8bc2f 100644
--- a/tests/gsup/gsup_test.ok
+++ b/tests/gsup/gsup_test.ok
@@ -49,4 +49,32 @@
           Check IMEI Error OK
   Testing Check IMEI Result
           Check IMEI Result OK
+  Testing E Prepare Handover Request
+          E Prepare Handover Request OK
+  Testing E Prepare Handover Error
+          E Prepare Handover Error OK
+  Testing E Prepare Handover Result
+          E Prepare Handover Result OK
+  Testing E Prepare Subsequent Handover Request
+          E Prepare Subsequent Handover Request OK
+  Testing E Prepare Subsequent Handover Error
+          E Prepare Subsequent Handover Error OK
+  Testing E Prepare Subsequent Handover Result
+          E Prepare Subsequent Handover Result OK
+  Testing E Send End Signal Request
+          E Send End Signal Request OK
+  Testing E Send End Signal Error
+          E Send End Signal Error OK
+  Testing E Send End Signal Result
+          E Send End Signal Result OK
+  Testing E Process Access Signalling Request
+          E Process Access Signalling Request OK
+  Testing E Forward Access Signalling Request
+          E Forward Access Signalling Request OK
+  Testing E Close
+          E Close OK
+  Testing E Abort
+          E Abort OK
+  Testing E Routing Error
+          E Routing Error OK
 Done.