diff --git a/openbsc/include/openbsc/gprs_ns.h b/openbsc/include/openbsc/gprs_ns.h
index 90f1adf..9ea4d67 100644
--- a/openbsc/include/openbsc/gprs_ns.h
+++ b/openbsc/include/openbsc/gprs_ns.h
@@ -54,7 +54,7 @@
 };
 
 
-int gprs_ns_rcvmsg(struct msgb *msg);
+int gprs_ns_rcvmsg(struct msgb *msg, struct sockaddr_in *saddr);
 
 int gprs_ns_sendmsg(struct gprs_ns_link *link, u_int16_t bvci,
 		    struct msgb *msg);
diff --git a/openbsc/src/gprs_ns.c b/openbsc/src/gprs_ns.c
index a686a22..6fb7d1d 100644
--- a/openbsc/src/gprs_ns.c
+++ b/openbsc/src/gprs_ns.c
@@ -85,6 +85,12 @@
 	struct timer_list alive_timer;
 	int timer_is_tns_alive;
 	int alive_retries;
+
+	union {
+		struct {
+			struct sockaddr_in bts_addr;
+		} ip;
+	};
 };
 
 /* FIXME: dynamically search for the matching NSVC */
@@ -116,12 +122,12 @@
 	return "undefined";
 }
 
-static int gprs_ns_tx(struct msgb *msg)
+static int gprs_ns_tx(struct msgb *msg, struct gprs_nsvc *nsvc)
 {
-	return ipac_gprs_send(msg);
+	return ipac_gprs_send(msg, &nsvc->ip.bts_addr);
 }
 
-static int gprs_ns_tx_simple(struct gprs_ns_link *link, u_int8_t pdu_type)
+static int gprs_ns_tx_simple(struct gprs_nsvc *nsvc, u_int8_t pdu_type)
 {
 	struct msgb *msg = msgb_alloc(NS_ALLOC_SIZE, "GPRS/NS");
 	struct gprs_ns_hdr *nsh;
@@ -133,7 +139,7 @@
 
 	nsh->pdu_type = pdu_type;
 
-	return gprs_ns_tx(msg);
+	return gprs_ns_tx(msg, nsvc);
 }
 
 #define NS_TIMER_ALIVE	3, 0 	/* after 3 seconds without response, we retry */
@@ -157,7 +163,7 @@
 		}
 	} else {
 		/* Tns-test case: send NS-ALIVE PDU */
-		gprs_ns_tx_simple(NULL, NS_PDUT_ALIVE);
+		gprs_ns_tx_simple(nsvc, NS_PDUT_ALIVE);
 		/* start Tns-alive timer */
 		nsvc->timer_is_tns_alive = 1;
 	}
@@ -165,25 +171,28 @@
 }
 
 /* Section 9.2.6 */
-static int gprs_ns_tx_reset_ack(u_int16_t nsvci, u_int16_t nsei)
+static int gprs_ns_tx_reset_ack(struct gprs_nsvc *nsvc)
 {
 	struct msgb *msg = msgb_alloc(NS_ALLOC_SIZE, "GPRS/NS");
 	struct gprs_ns_hdr *nsh;
+	u_int16_t nsvci, nsei;
 
 	if (!msg)
 		return -ENOMEM;
 
-	nsvci = htons(nsvci);
-	nsei = htons(nsei);
+	nsvci = htons(nsvc->nsvci);
+	nsei = htons(nsvc->nsei);
 
 	nsh = (struct gprs_ns_hdr *) msgb_put(msg, sizeof(*nsh));
 
 	nsh->pdu_type = NS_PDUT_RESET_ACK;
 
+	DEBUGP(DGPRS, "nsvci=%u, nsei=%u\n", nsvc->nsvci, nsvc->nsei);
+
 	msgb_tvlv_put(msg, NS_IE_VCI, 2, (u_int8_t *)&nsvci);
 	msgb_tvlv_put(msg, NS_IE_NSEI, 2, (u_int8_t *)&nsei);
 
-	return gprs_ns_tx(msg);
+	return gprs_ns_tx(msg, nsvc);
 }
 
 /* Section 9.2.10: transmit side */
@@ -191,6 +200,7 @@
 		    struct msgb *msg)
 {
 	struct gprs_ns_hdr *nsh;
+	struct gprs_nsvc *nsvc = &dummy_nsvc;
 
 	nsh = (struct gprs_ns_hdr *) msgb_push(msg, sizeof(*nsh) + 3);
 	if (!nsh) {
@@ -203,7 +213,7 @@
 	nsh->data[1] = bvci >> 8;
 	nsh->data[2] = bvci & 0xff;
 
-	return gprs_ns_tx(msg);
+	return gprs_ns_tx(msg, nsvc);
 }
 
 /* Section 9.2.10: receive side */
@@ -269,37 +279,37 @@
 	nsvci = (u_int16_t *) TLVP_VAL(&tp, NS_IE_VCI);
 	nsei = (u_int16_t *) TLVP_VAL(&tp, NS_IE_NSEI);
 
-	*nsvci = ntohs(*nsvci);
-	*nsei = ntohs(*nsei);
+	nsvc->state = NSE_S_BLOCKED | NSE_S_ALIVE;
+	nsvc->nsei = ntohs(*nsei);
+	nsvc->nsvci = ntohs(*nsvci);
 
 	DEBUGPC(DGPRS, "cause=%s, NSVCI=%u, NSEI=%u\n",
-		gprs_ns_cause_str(*cause), *nsvci, *nsei);
+		gprs_ns_cause_str(*cause), nsvc->nsvci, nsvc->nsei);
 
 	/* mark the NS-VC as blocked and alive */
-	nsvc->state = NSE_S_BLOCKED | NSE_S_ALIVE;
-	nsvc->nsei = *nsei;
-	nsvc->nsvci = *nsvci;
-
 	/* start the test procedure */
 	nsvc->alive_timer.cb = gprs_ns_alive_cb;
 	nsvc->alive_timer.data = nsvc;
 	bsc_schedule_timer(&nsvc->alive_timer, NS_TIMER_ALIVE);
 
-	return gprs_ns_tx_reset_ack(*nsvci, *nsei);
+	return gprs_ns_tx_reset_ack(nsvc);
 }
 
 /* main entry point, here incoming NS frames enter */
-int gprs_ns_rcvmsg(struct msgb *msg)
+int gprs_ns_rcvmsg(struct msgb *msg, struct sockaddr_in *saddr)
 {
 	struct gprs_ns_hdr *nsh = (struct gprs_ns_hdr *) msg->l2h;
 	struct gprs_nsvc *nsvc = &dummy_nsvc;
 	int rc = 0;
 
+	/* FIXME: do this properly! */
+	nsvc->ip.bts_addr = *saddr;
+
 	switch (nsh->pdu_type) {
 	case NS_PDUT_ALIVE:
 		/* remote end inquires whether we're still alive,
 		 * we need to respond with ALIVE_ACK */
-		rc = gprs_ns_tx_simple(NULL, NS_PDUT_ALIVE_ACK);
+		rc = gprs_ns_tx_simple(nsvc, NS_PDUT_ALIVE_ACK);
 		break;
 	case NS_PDUT_ALIVE_ACK:
 		/* stop Tns-alive */
@@ -325,7 +335,7 @@
 		/* Section 7.2: unblocking procedure */
 		DEBUGP(DGPRS, "NS UNBLOCK\n");
 		nsvc->state &= ~NSE_S_BLOCKED;
-		rc = gprs_ns_tx_simple(NULL, NS_PDUT_UNBLOCK_ACK);
+		rc = gprs_ns_tx_simple(nsvc, NS_PDUT_UNBLOCK_ACK);
 		break;
 	case NS_PDUT_UNBLOCK_ACK:
 		/* FIXME: mark remote NS-VC as unblocked + active */
@@ -333,7 +343,7 @@
 	case NS_PDUT_BLOCK:
 		DEBUGP(DGPRS, "NS BLOCK\n");
 		nsvc->state |= NSE_S_BLOCKED;
-		rc = gprs_ns_tx_simple(NULL, NS_PDUT_UNBLOCK_ACK);
+		rc = gprs_ns_tx_simple(nsvc, NS_PDUT_UNBLOCK_ACK);
 		break;
 	case NS_PDUT_BLOCK_ACK:
 		/* FIXME: mark remote NS-VC as blocked + active */
diff --git a/openbsc/src/input/ipaccess.c b/openbsc/src/input/ipaccess.c
index fae9428..80055ad 100644
--- a/openbsc/src/input/ipaccess.c
+++ b/openbsc/src/input/ipaccess.c
@@ -603,21 +603,20 @@
 	return rc;
 }
 
-/* declare this as a weak symbol to ensure code will still build
- * even if it does not provide this function */
-extern int gprs_ns_rcvmsg(struct msgb *msg) __attribute__((weak));
-
-static struct msgb *read_gprs_msg(struct bsc_fd *bfd, int *error)
+static struct msgb *read_gprs_msg(struct bsc_fd *bfd, int *error,
+				  struct sockaddr_in *saddr)
 {
 	struct msgb *msg = msgb_alloc(TS1_ALLOC_SIZE, "Abis/IP/GPRS");
 	int ret = 0;
+	socklen_t saddr_len = sizeof(*saddr);
 
 	if (!msg) {
 		*error = -ENOMEM;
 		return NULL;
 	}
 
-	ret = recv(bfd->fd, msg->data, TS1_ALLOC_SIZE, 0);
+	ret = recvfrom(bfd->fd, msg->data, TS1_ALLOC_SIZE, 0,
+			(struct sockaddr *)saddr, &saddr_len);
 	if (ret < 0) {
 		fprintf(stderr, "recv error  %s\n", strerror(errno));
 		msgb_free(msg);
@@ -638,34 +637,25 @@
 static int handle_gprs_read(struct bsc_fd *bfd)
 {
 	int error;
-	struct msgb *msg = read_gprs_msg(bfd, &error);
+	struct sockaddr_in saddr;
+	struct msgb *msg = read_gprs_msg(bfd, &error, &saddr);
 
 	if (!msg)
 		return error;
 
-	if (gprs_ns_rcvmsg)
-		return gprs_ns_rcvmsg(msg);
-	else {
-		msgb_free(msg);
-		return 0;
-	}
+	return gprs_ns_rcvmsg(msg, &saddr);
 }
 
 static int handle_gprs_write(struct bsc_fd *bfd)
 {
 }
 
-int ipac_gprs_send(struct msgb *msg)
+int ipac_gprs_send(struct msgb *msg, struct sockaddr_in *daddr)
 {
-	struct sockaddr_in sin;
 	int rc;
 
-	sin.sin_family = AF_INET;
-	inet_aton("192.168.100.111", &sin.sin_addr);
-	sin.sin_port = htons(23000);
-
 	rc = sendto(e1h->gprs_fd.fd, msg->data, msg->len, 0,
-		  (struct sockaddr *)&sin, sizeof(sin));
+		  (struct sockaddr *)daddr, sizeof(*daddr));
 
 	talloc_free(msg);