diff --git a/src/tests/hnb-test-ranap.c b/src/tests/hnb-test-ranap.c
index eb90745..763a7f2 100644
--- a/src/tests/hnb-test-ranap.c
+++ b/src/tests/hnb-test-ranap.c
@@ -18,8 +18,6 @@
 	printf("rx DirectTransfer: presence = %hx\n", ranap_msg->msg.directTransferIEs.presenceMask);
 	PP(ranap_msg->msg.directTransferIEs.nas_pdu);
 	
-	// nas_pdu == '05 08 12' ==> IMEI Identity request
-	//            '05 04 0d' ==> LU reject
 /*
 typedef struct RANAP_DirectTransferIEs_s {
     uint16_t  presenceMask;
@@ -44,5 +42,6 @@
 	int len = ranap_msg->msg.directTransferIEs.nas_pdu.size;
 	char *data = ranap_msg->msg.directTransferIEs.nas_pdu.buf;
 
+	m->l3h = m->data;
 	memcpy(msgb_put(m, len), data, len);
 }
diff --git a/src/tests/hnb-test.c b/src/tests/hnb-test.c
index 048f3a9..639e177 100644
--- a/src/tests/hnb-test.c
+++ b/src/tests/hnb-test.c
@@ -58,6 +58,12 @@
 
 #include <osmocom/rua/RUA_RUA-PDU.h>
 
+#include <osmocom/gsm/protocol/gsm_04_08.h>
+
+#include <osmocom/ranap/RANAP_ProcedureCode.h>
+#include <osmocom/ranap/RANAP_Criticality.h>
+#include <osmocom/ranap/RANAP_DirectTransfer.h>
+
 static void *tall_hnb_ctx;
 
 struct hnb_test g_hnb_test = {
@@ -175,6 +181,93 @@
 	return 0;
 }
 
+static struct msgb *gen_nas_id_resp()
+{
+	uint8_t id_resp[] = {
+		0x05, /* MM discr */
+		0x19, /* DTAP */
+		/* IMEISV */
+		0x09, /* len */
+		0x03, /* first digit (0000) + even (0) + id IMEISV (011) */
+		0x31, 0x91, 0x06, 0x00, 0x28, 0x47, 0x11, /* digits */
+		0xf2, /* filler (1111) + last digit (0010) */
+	};
+
+	return ranap_generate_initiating_message(RANAP_ProcedureCode_id_DirectTransfer,
+						 RANAP_Criticality_ignore,
+						 &asn_DEF_RANAP_DirectTransfer,
+						 &id_resp);
+}
+
+
+static int hnb_test_nas_tx_id_resp(struct hnb_test *hnb)
+{
+	struct hnbtest_chan *chan;
+	struct msgb *txm, *rua;
+
+	chan = hnb->cs.chan;
+	if (!chan) {
+		printf("hnb_test_nas_tx_id_resp(): No CS channel established yet.\n");
+		return -1;
+	}
+
+	txm = gen_nas_id_resp();
+	rua = rua_new_dt(chan->is_ps, chan->conn_id, txm);
+
+	osmo_wqueue_enqueue(&g_hnb_test.wqueue, rua);
+
+	return 0;
+}
+
+static int hnb_test_nas_rx_mm(struct hnb_test *hnb, struct msgb *rxm)
+{
+	struct hnbtest_chan *chan;
+
+	chan = hnb->cs.chan;
+	if (!chan) {
+		printf("hnb_test_nas_rx_mm(): No CS channel established yet.\n");
+		return -1;
+	}
+
+	OSMO_ASSERT(!chan->is_ps);
+
+	struct gsm48_hdr *gh = msgb_l3(rxm);
+	uint8_t msg_type = gh->msg_type & 0xbf;
+
+	switch (msg_type) {
+	case GSM48_MT_MM_ID_REQ:
+
+		return hnb_test_nas_tx_id_resp(hnb);
+	default:
+		printf("04.08 message type not handled by hnb-test: %d\n",
+		       msg_type);
+		return 0;
+	}
+
+}
+
+static int hnb_test_nas_rx_dtap(struct hnb_test *hnb, struct msgb *msg)
+{
+	printf("got %s\n", osmo_hexdump(msg->data, msg->len));
+
+	// nas_pdu == '05 08 12' ==> IMEI Identity request
+	//            '05 04 0d' ==> LU reject
+
+	struct gsm48_hdr *gh = msgb_l3(msg);
+	uint8_t pdisc = gh->proto_discr & 0x0f;
+
+	switch (pdisc) {
+	case GSM48_PDISC_MM:
+		return hnb_test_nas_rx_mm(hnb, msg);
+	default:
+		printf("04.08 discriminator not handled by hnb-test: %d\n",
+		       pdisc);
+		return 0;
+	}
+
+
+}
+
 int hnb_test_hnbap_rx(struct hnb_test *hnb, struct msgb *msg)
 {
 	HNBAP_PDU_t _pdu, *pdu = &_pdu;
@@ -255,9 +348,8 @@
 			struct msgb *m = msgb_alloc(1500, "direct_transfer_nas_pdu");
 			direct_transfer_nas_pdu_get(&pdu->choice.successfulOutcome.value, m);
 
-			// evaluate
+			hnb_test_nas_rx_dtap(hnb, m);
 
-			printf("got %s\n", osmo_hexdump(m->data, m->len));
 			msgb_free(m);
 		}
 		break;
@@ -544,12 +636,6 @@
 };
 
 
-struct hnbtest_chan {
-	int is_ps;
-	uint32_t conn_id;
-	char *imsi;
-};
-
 static struct msgb *gen_initue_lu(int is_ps, uint32_t conn_id, const char *imsi)
 {
 	uint8_t lu[] = { 0x05, 0x08, 0x70, 0x62, 0xf2, 0x30, 0xff, 0xf3, 0x57,
@@ -562,7 +648,6 @@
 		.pLMNidentity.buf = plmn_id,
 		.pLMNidentity.size = sizeof(plmn_id),
 	};
-	struct msgb *msg;
 
 	/* FIXME: patch imsi */
 	/* Note: the Mobile Identitiy IE's IMSI data has the identity type and
@@ -609,6 +694,10 @@
 	vty->index = chan;
 	vty->node = CHAN_NODE;
 
+	if (!chan->is_ps)
+		g_hnb_test.cs.chan = chan;
+
+
 	return CMD_SUCCESS;
 }
 
diff --git a/src/tests/hnb-test.h b/src/tests/hnb-test.h
index 9fba696..f58c177 100644
--- a/src/tests/hnb-test.h
+++ b/src/tests/hnb-test.h
@@ -42,6 +42,12 @@
 	char imsi[16+1];
 };
 
+struct hnbtest_chan {
+	int is_ps;
+	uint32_t conn_id;
+	char *imsi;
+};
+
 struct hnb_test {
 	uint16_t gw_port;
 	/*! SCTP listen socket for incoming connections */
@@ -64,6 +70,10 @@
 	uint32_t ctx_id;
 
 	int ues;
+
+	struct {
+		struct hnbtest_chan *chan;
+	} cs;
 };
 
 extern struct hnb_test g_hnb_test;