diff --git a/openbsc/include/openbsc/gsm_04_11.h b/openbsc/include/openbsc/gsm_04_11.h
index 72b6948..00c3a19 100644
--- a/openbsc/include/openbsc/gsm_04_11.h
+++ b/openbsc/include/openbsc/gsm_04_11.h
@@ -37,4 +37,6 @@
 int gsm411_send_sms(struct gsm_subscriber_connection *conn,
 		    struct gsm_sms *sms);
 void gsm411_sapi_n_reject(struct gsm_subscriber_connection *conn);
+
+uint8_t sms_next_rp_msg_ref(struct gsm_subscriber_connection *conn);
 #endif
diff --git a/openbsc/include/openbsc/gsm_data.h b/openbsc/include/openbsc/gsm_data.h
index 41fe328..404dfe4 100644
--- a/openbsc/include/openbsc/gsm_data.h
+++ b/openbsc/include/openbsc/gsm_data.h
@@ -106,6 +106,8 @@
 
 	/* LU expiration handling */
 	uint8_t expire_timer_stopped;
+	/* SMS helpers for libmsc */
+	uint8_t next_rp_ref;
 
 	/*
 	 * Operations that have a state and might be pending
diff --git a/openbsc/src/libmsc/Makefile.am b/openbsc/src/libmsc/Makefile.am
index 2b50599..1e58cd1 100644
--- a/openbsc/src/libmsc/Makefile.am
+++ b/openbsc/src/libmsc/Makefile.am
@@ -6,7 +6,8 @@
 
 libmsc_a_SOURCES =	auth.c \
 			db.c \
-			gsm_04_08.c gsm_04_11.c gsm_04_80.c \
+			gsm_04_08.c gsm_04_11.c gsm_04_11_helper.c \
+			gsm_04_80.c \
 			gsm_subscriber.c \
 			mncc.c mncc_builtin.c mncc_sock.c \
 			rrlp.c \
diff --git a/openbsc/src/libmsc/gsm_04_11.c b/openbsc/src/libmsc/gsm_04_11.c
index 97a67ee..45e5dc5 100644
--- a/openbsc/src/libmsc/gsm_04_11.c
+++ b/openbsc/src/libmsc/gsm_04_11.c
@@ -450,7 +450,7 @@
 	rp = (struct gsm411_rp_hdr *)msgb_push(msg, sizeof(*rp));
 	rp->len = len + 2;
 	rp->msg_type = rp_msg_type;
-	rp->msg_ref = rp_msg_ref; /* FIXME: Choose randomly */
+	rp->msg_ref = rp_msg_ref;
 
 	return gsm411_smr_send(inst, rl_msg_type, msg);
 }
@@ -836,7 +836,7 @@
 	struct msgb *msg = gsm411_msgb_alloc();
 	struct gsm_trans *trans;
 	uint8_t *data, *rp_ud_len;
-	uint8_t msg_ref = 42;
+	uint8_t msg_ref = sms_next_rp_msg_ref(conn);
 	int transaction_id;
 	int rc;
 
diff --git a/openbsc/src/libmsc/gsm_04_11_helper.c b/openbsc/src/libmsc/gsm_04_11_helper.c
new file mode 100644
index 0000000..f48c6de
--- /dev/null
+++ b/openbsc/src/libmsc/gsm_04_11_helper.c
@@ -0,0 +1,37 @@
+/* Helpers for SMS/GSM 04.11 */
+/*
+ * (C) 2014 by Holger Hans Peter Freyther
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <openbsc/gsm_data.h>
+#include <openbsc/gsm_04_11.h>
+
+uint8_t sms_next_rp_msg_ref(struct gsm_subscriber_connection *conn)
+{
+	const uint8_t rp_msg_ref = conn->next_rp_ref;
+	/*
+	 * This should wrap as the valid range is 0 to 255. We only
+	 * transfer one SMS at a time so we don't need to check if
+	 * the id has been already assigned.
+	 */
+	conn->next_rp_ref += 1;
+
+	return rp_msg_ref;
+}
+
diff --git a/openbsc/tests/gsm0408/gsm0408_test.c b/openbsc/tests/gsm0408/gsm0408_test.c
index 38c1a6a..692ec90 100644
--- a/openbsc/tests/gsm0408/gsm0408_test.c
+++ b/openbsc/tests/gsm0408/gsm0408_test.c
@@ -25,6 +25,7 @@
 #include <arpa/inet.h>
 
 #include <openbsc/gsm_04_08.h>
+#include <openbsc/gsm_04_11.h>
 #include <openbsc/gsm_subscriber.h>
 #include <openbsc/debug.h>
 #include <openbsc/arfcn_range_encode.h>
@@ -448,6 +449,29 @@
 	VERIFY(f0, ==, 1);
 }
 
+static void test_gsm411_rp_ref_wrap(void)
+{
+	struct gsm_subscriber_connection conn;
+	int res;
+
+	printf("testing RP-Reference wrap\n");
+
+	memset(&conn, 0, sizeof(conn));
+	conn.next_rp_ref = 255;
+
+	res = sms_next_rp_msg_ref(&conn);
+	printf("Allocated reference: %d\n", res);
+	OSMO_ASSERT(res == 255);
+
+	res = sms_next_rp_msg_ref(&conn);
+	printf("Allocated reference: %d\n", res);
+	OSMO_ASSERT(res == 0);
+
+	res = sms_next_rp_msg_ref(&conn);
+	printf("Allocated reference: %d\n", res);
+	OSMO_ASSERT(res == 1);
+}
+
 int main(int argc, char **argv)
 {
 	osmo_init_logging(&log_info);
@@ -460,6 +484,7 @@
 	test_arfcn_filter();
 	test_print_encoding();
 	test_range_encoding();
+	test_gsm411_rp_ref_wrap();
 
 	printf("Done.\n");
 	return EXIT_SUCCESS;
diff --git a/openbsc/tests/gsm0408/gsm0408_test.ok b/openbsc/tests/gsm0408/gsm0408_test.ok
index 3d3c4e6..058563a 100644
--- a/openbsc/tests/gsm0408/gsm0408_test.ok
+++ b/openbsc/tests/gsm0408/gsm0408_test.ok
@@ -58,4 +58,8 @@
 Random range test: range 255, max num ARFCNs 22
 Random range test: range 511, max num ARFCNs 18
 Random range test: range 1023, max num ARFCNs 16
+testing RP-Reference wrap
+Allocated reference: 255
+Allocated reference: 0
+Allocated reference: 1
 Done.