diff --git a/include/osmocom/mgcp/debug.h b/include/osmocom/mgcp/debug.h
index ddeb0dc..1eed769 100644
--- a/include/osmocom/mgcp/debug.h
+++ b/include/osmocom/mgcp/debug.h
@@ -29,6 +29,7 @@
 /* Debug Areas of the code */
 enum {
 	DRTP,
+	DIUUP,
 	Debug_LastEntry,
 };
 
diff --git a/include/osmocom/mgcp/iuup_cn_node.h b/include/osmocom/mgcp/iuup_cn_node.h
index 158b6a1..f792469 100644
--- a/include/osmocom/mgcp/iuup_cn_node.h
+++ b/include/osmocom/mgcp/iuup_cn_node.h
@@ -10,22 +10,23 @@
  *                                            -----------------
  */
 
-
 #pragma once
 
 struct osmo_iuup_cn;
 struct msgb;
 
-typedef int (*osmo_iuup_data_cb_t)(struct msgb *msg, void *node_priv, void *pdu_priv);
+typedef int (*osmo_iuup_data_cb_t)(struct msgb *msg, void *node_priv);
 
 struct osmo_iuup_cn_cfg {
 	void *node_priv;
 
-	/* When an IuUP PDU containing voice payload has been received, this callback is invoked to pass
-	 * the voice payload towards the Core Network, msgb_l3() pointing at the payload. */
+	/* When the IuUP peer sent a voice packet, the clean RTP without the IuUP header is fed to this
+	 * callback. */
 	osmo_iuup_data_cb_t rx_payload;
 
-	/* IuUP handler sends a PDU to the IuUP peer (e.g. the RNC) */
+	/* IuUP handler requests that a PDU shall be sent to the IuUP peer (e.g. the RNC).
+	 * It is guaranteed that the msgb->dst pointer is preserved or copied from the msgb that
+	 * originated the request. */
 	osmo_iuup_data_cb_t tx_msg;
 };
 
@@ -35,12 +36,6 @@
 				       const char *name_fmt, ...);
 void osmo_iuup_cn_free(struct osmo_iuup_cn *cn);
 
-/* Encapsulate voice stream payload in IuUP and, if appropriate, call the tx_msg() to transmit the
- * resulting message to the IuUP peer. msgb_l3() should point at the payload data.
- * pdu_priv is transparently passed on to tx_msg().
- * Returns 0 on success, negative on error. */
-int osmo_iuup_cn_tx_payload(struct osmo_iuup_cn *cn, struct msgb *payload, void *pdu_priv);
+int osmo_iuup_cn_tx_payload(struct osmo_iuup_cn *cn, struct msgb *payload);
 
-/* Feed a received PDU to the IuUP CN node. This function takes ownership of the msgb, it must not be
- * freed by the caller. */
-int osmo_iuup_cn_rx_pdu(struct osmo_iuup_cn *cn, struct msgb *pdu, void *pdu_priv);
+int osmo_iuup_cn_rx_pdu(struct osmo_iuup_cn *cn, struct msgb *pdu);
diff --git a/include/osmocom/mgcp/iuup_protocol.h b/include/osmocom/mgcp/iuup_protocol.h
index 108bcaa..f4aec1f 100644
--- a/include/osmocom/mgcp/iuup_protocol.h
+++ b/include/osmocom/mgcp/iuup_protocol.h
@@ -21,6 +21,9 @@
 
 enum osmo_iuup_procedure {
 	OSMO_IUUP_PROC_INITIALIZATION = 0,
+	OSMO_IUUP_PROC_RATE_CONTROL = 1,
+	OSMO_IUUP_PROC_TIME_ALIGNMENT = 2,
+	OSMO_IUUP_PROC_ERROR_EVENT = 3,
 };
 
 enum osmo_iuup_frame_good {
@@ -40,10 +43,6 @@
 		payload_crc_hi:2;
 	uint8_t payload_crc_lo;
 	uint8_t payload[0];
-	uint8_t spare:3,
-		iptis_present:1,
-		subflows:3,
-		chain:1;
 #elif OSMO_IS_LITTLE_ENDIAN
 	uint8_t frame_nr:2,
 		ack_nack:2,
@@ -54,12 +53,38 @@
 		header_crc:6;
 	uint8_t payload_crc_lo;
 	uint8_t payload[0];
+#endif
+} __attribute__((packed));
+
+union osmo_iuup_hdr_ctrl_payload {
+	struct {
+#if OSMO_IS_BIG_ENDIAN
+	uint8_t spare:3,
+		iptis_present:1,
+		subflows:3,
+		chain:1;
+#elif OSMO_IS_LITTLE_ENDIAN
 	uint8_t spare:3,
 		iptis_present:1,
 		subflows:3,
 		chain:1;
 #endif
-} __attribute__((packed));
+	} initialization;
+
+	struct {
+#if OSMO_IS_BIG_ENDIAN
+	uint8_t error_distance:2,
+		error_cause:6;
+#elif OSMO_IS_LITTLE_ENDIAN
+	uint8_t error_cause:6,
+		error_distance:2;
+#endif
+	} error_event;
+};
+
+extern const struct value_string osmo_iuup_error_cause_names[];
+static inline const char *osmo_iuup_error_cause_name(uint8_t val)
+{ return get_value_string(osmo_iuup_error_cause_names, val); }
 
 struct osmo_iuup_hdr_data {
 #if OSMO_IS_BIG_ENDIAN
diff --git a/include/osmocom/mgcp/mgcp_endp.h b/include/osmocom/mgcp/mgcp_endp.h
index 469d431..04c3d18 100644
--- a/include/osmocom/mgcp/mgcp_endp.h
+++ b/include/osmocom/mgcp/mgcp_endp.h
@@ -23,18 +23,28 @@
 
 #pragma once
 
+#include <osmocom/core/msgb.h>
+
 struct sockaddr_in;
 struct mgcp_conn;
+struct mgcp_conn_rtp;
 struct mgcp_endpoint;
 
+struct osmo_rtp_msg_ctx {
+	int proto;
+	struct mgcp_conn_rtp *conn_src;
+	struct sockaddr_in *from_addr;
+};
+
+#define OSMO_RTP_MSG_CTX(MSGB) (*(struct osmo_rtp_msg_ctx**)&((MSGB)->dst))
+
 #define LOG_ENDP(endp, level, fmt, args...) \
 	LOGP(DRTP, level, "%x@ " fmt, ENDPOINT_NUMBER(endp), ## args)
 
-/* Callback type for RTP dispatcher functions
-   (e.g mgcp_dispatch_rtp_bridge_cb, see below) */
-typedef int (*mgcp_dispatch_rtp_cb) (int proto, struct sockaddr_in *addr,
-				     struct msgb *payload,
-				     struct mgcp_conn *conn);
+/* Callback type for RTP dispatcher functions (e.g mgcp_dispatch_rtp_bridge_cb, see below).
+ * The fields OSMO_RTP_MSG_PROTO, OSMO_RTP_MSG_CONN_SRC, OSMO_RTP_MSG_FROM_ADDR should be set
+ * appropriately on the msg. */
+typedef int (*mgcp_dispatch_rtp_cb) (struct msgb *msg);
 
 /* Callback type for endpoint specific cleanup actions. This function
  * is automatically executed when a connection is freed (see mgcp_conn_free()
diff --git a/include/osmocom/mgcp/mgcp_internal.h b/include/osmocom/mgcp/mgcp_internal.h
index 69ba4d4..51d3b9d 100644
--- a/include/osmocom/mgcp/mgcp_internal.h
+++ b/include/osmocom/mgcp/mgcp_internal.h
@@ -271,8 +271,7 @@
 	      struct msgb *msg, struct mgcp_conn_rtp *conn_src,
 	      struct mgcp_conn_rtp *conn_dst);
 int mgcp_send_dummy(struct mgcp_endpoint *endp, struct mgcp_conn_rtp *conn);
-int mgcp_dispatch_rtp_bridge_cb(int proto, struct sockaddr_in *addr,
-				struct msgb *payload, struct mgcp_conn *conn);
+int mgcp_dispatch_rtp_bridge_cb(struct msgb *msg);
 void mgcp_cleanup_rtp_bridge_cb(struct mgcp_endpoint *endp, struct mgcp_conn *conn);
 int mgcp_bind_net_rtp_port(struct mgcp_endpoint *endp, int rtp_port,
 			   struct mgcp_conn_rtp *conn);