diff --git a/tests/msc_vlr/msc_vlr_test_call.c b/tests/msc_vlr/msc_vlr_test_call.c
index 6c7a8ad..ab92433 100644
--- a/tests/msc_vlr/msc_vlr_test_call.c
+++ b/tests/msc_vlr/msc_vlr_test_call.c
@@ -285,6 +285,30 @@
 	struct gsm_mncc mncc = {
 		.imsi = IMSI,
 		.callref = 0x423,
+		.fields = MNCC_F_BEARER_CAP,
+		.bearer_cap = {
+			.speech_ver = {
+				GSM48_BCAP_SV_AMR_F,
+				GSM48_BCAP_SV_EFR,
+				GSM48_BCAP_SV_FR,
+				GSM48_BCAP_SV_AMR_H,
+				GSM48_BCAP_SV_HR,
+				-1 },
+		},
+		/* NOTE: below SDP includes only AMR, above bearer_cap includes more codecs. Ideally, these would match,
+		 * but in reality the bearer cap in MNCC was never implemented properly. This test shows that above
+		 * bearer_cap is ignored when SDP is present: In the CC Setup below, the Bearer Capability is only
+		 * "04 04 60 04 05 8b" with speech versions '04' == GSM48_BCAP_SV_AMR_F and '05' == GSM48_BCAP_SV_AMR_H.
+		 */
+		.sdp = "v=0\r\n"
+		       "o=OsmoMSC 0 0 IN IP4 10.23.23.1\r\n"
+		       "s=GSM Call\r\n"
+		       "c=IN IP4 10.23.23.1\r\n"
+		       "t=0 0\r\n"
+		       "m=audio 23 RTP/AVP 112\r\n"
+		       "a=rtpmap:112 AMR/8000\r\n"
+		       "a=fmtp:112 octet-align=1\r\n"
+		       "a=ptime:20\r\n",
 	};
 
 	comment_start();
@@ -298,6 +322,7 @@
 	paging_expect_imsi(IMSI);
 	paging_sent = false;
 	mncc_sends_to_cc(MNCC_SETUP_REQ, &mncc);
+	mncc.sdp[0] = '\0';
 
 	VERBOSE_ASSERT(paging_sent, == true, "%d");
 
@@ -316,7 +341,7 @@
 	VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 
 	btw("MS sends SecurityModeControl acceptance, VLR accepts, sends CC Setup");
-	dtap_expect_tx("0305" /* CC: Setup */ "04 07 60 04 05 0b 06 08 87" /* Bearer Cap */);
+	dtap_expect_tx("0305" /* CC: Setup */ "04 04 60 04 05 8b" /* Bearer Cap, speech ver of AMR-FR and AMR-HR */);
 	ms_sends_security_mode_complete(1);
 
 	btw("MS confirms call, we create a RAN-side RTP and forward MNCC_CALL_CONF_IND");
@@ -388,6 +413,24 @@
 	struct gsm_mncc mncc = {
 		.imsi = IMSI,
 		.callref = 0x423,
+		.fields = MNCC_F_BEARER_CAP,
+		.bearer_cap = {
+			.speech_ver = { GSM48_BCAP_SV_FR, -1, },
+		},
+		/* NOTE: below SDP includes only AMR, above bearer_cap includes only GSM-FR. Ideally, these would match,
+		 * but in reality the bearer cap in MNCC was never implemented properly. This test shows that above
+		 * bearer_cap is ignored when SDP is present: In the CC Setup below, the Bearer Capability is only
+		 * "04 04 60 04 05 8b" with speech versions '04' == GSM48_BCAP_SV_AMR_F and '05' == GSM48_BCAP_SV_AMR_H.
+		 */
+		.sdp = "v=0\r\n"
+		       "o=OsmoMSC 0 0 IN IP4 10.23.23.1\r\n"
+		       "s=GSM Call\r\n"
+		       "c=IN IP4 10.23.23.1\r\n"
+		       "t=0 0\r\n"
+		       "m=audio 23 RTP/AVP 112\r\n"
+		       "a=rtpmap:112 AMR/8000\r\n"
+		       "a=fmtp:112 octet-align=1\r\n"
+		       "a=ptime:20\r\n",
 	};
 
 	comment_start();
@@ -419,7 +462,7 @@
 	VERBOSE_ASSERT(security_mode_ctrl_sent, == true, "%d");
 
 	btw("MS sends SecurityModeControl acceptance, VLR accepts, sends CC Setup");
-	dtap_expect_tx("0305" /* CC: Setup */ "04 07 60 04 05 0b 06 08 87" /* Bearer Cap */);
+	dtap_expect_tx("0305" /* CC: Setup */ "04 04 60 04 05 8b" /* Bearer Cap, speech ver of AMR-FR and AMR-HR */);
 	ms_sends_security_mode_complete(1);
 
 	btw("MS confirms call, we create a RAN-side RTP and forward MNCC_CALL_CONF_IND");
diff --git a/tests/msc_vlr/msc_vlr_test_call.err b/tests/msc_vlr/msc_vlr_test_call.err
index e87c25e..a86a2b0 100644
--- a/tests/msc_vlr/msc_vlr_test_call.err
+++ b/tests/msc_vlr/msc_vlr_test_call.err
@@ -291,7 +291,7 @@
 DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) new state NULL -> INITIATED
 DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) SETUP to 123
 DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) codecs: :0{AMR:octet-align=1#112} (from: MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
-DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) tx MNCC_SETUP_IND
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) tx MNCC_SETUP_IND (RTP=0.0.0.0:0{AMR:octet-align=1#112})
   MSC --> MNCC: callref 0x80000001: MNCC_SETUP_IND
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
 - MNCC replies with MNCC_RTP_CREATE, causing MGW endpoint CRCX to RAN
@@ -325,8 +325,8 @@
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_CN: 10.23.23.1:23 (osmux=no:-2)
-DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) codecs: :0{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
-DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) tx MNCC_RTP_CREATE (RTP=10.23.23.1:23)
+DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) codecs: 10.23.23.1:23{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000001 tid-8) tx MNCC_RTP_CREATE (RTP=10.23.23.1:23{VND.3GPP.IUFP/16000#96})
   MSC --> MNCC: callref 0x80000001: MNCC_RTP_CREATE
 - MNCC says that's fine
   MSC <-- MNCC: callref 0x80000001: MNCC_CALL_PROC_REQ
@@ -665,11 +665,20 @@
 
 - after a while, MNCC asks us to setup a call, causing Paging
   MSC <-- MNCC: callref 0x423: MNCC_SETUP_REQ
+v=0
+o=OsmoMSC 0 0 IN IP4 10.23.23.1
+s=GSM Call
+c=IN IP4 10.23.23.1
+t=0 0
+m=audio 23 RTP/AVP 112
+a=rtpmap:112 AMR/8000
+a=fmtp:112 octet-align=1
+a=ptime:20
 
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 + mncc_tx_to_gsm_cc: now used by 2 (attached,mncc_tx_to_gsm_cc)
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 + CC: now used by 3 (attached,mncc_tx_to_gsm_cc,CC)
 DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 callref-0x423 tid-255) New transaction
-DMNCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 callref-0x423 tid-255) rx MNCC_SETUP_REQ
+DMNCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 callref-0x423 tid-255) rx MNCC_SETUP_REQ (RTP=10.23.23.1:23{AMR:octet-align=1#112})
 DPAG Paging: IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 for MNCC: establish call: Starting paging
   paging request (CALL_CONVERSATIONAL) to IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 on UTRAN-Iu
   strcmp(paging_expecting_imsi, vsub->imsi) == 0
@@ -757,12 +766,11 @@
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTHENTICATED}: Received Event MSC_A_EV_TRANSACTION_ACCEPTED
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTHENTICATED}: state_chg to MSC_A_ST_COMMUNICATING
 DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) starting timer T303 with 30 seconds
-DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) Got no information of remote audio codecs: neither SDP nor Bearer Capability. Trying anyway.
-DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) codecs: :0{AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113} (from: RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
+DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) codecs: :0{AMR:octet-align=1#112} (from: remote=10.23.23.1:23{AMR:octet-align=1#112} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
 DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) new state NULL -> CALL_PRESENT
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Sending DTAP: CC GSM48_MT_CC_SETUP
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: RAN encode: DTAP on UTRAN-Iu
-- DTAP --UTRAN-Iu--> MS: GSM48_MT_CC_SETUP: 030504076004050b060887
+- DTAP --UTRAN-Iu--> MS: GSM48_MT_CC_SETUP: 030504046004058b
 - DTAP matches expected message
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 - Paging: now used by 3 (attached,CC,active-conn)
@@ -811,8 +819,8 @@
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_CN: 10.23.23.1:23 (osmux=no:-2)
-DCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) codecs: :0{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
-DMNCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_RTP_CREATE (RTP=10.23.23.1:23)
+DCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) codecs: 10.23.23.1:23{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 remote=10.23.23.1:23{AMR:octet-align=1#112} MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
+DMNCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_RTP_CREATE (RTP=10.23.23.1:23{VND.3GPP.IUFP/16000#96})
   MSC --> MNCC: callref 0x423: MNCC_RTP_CREATE
 - Total time passed: 1.000023 s
   MSC <--UTRAN-Iu-- MS: GSM48_MT_CC_ALERTING
@@ -823,7 +831,8 @@
 DCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) stopping pending timer T310
 DCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) starting timer T301 with 180 seconds
 DCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) new state MO_TERM_CALL_CONF -> CALL_RECEIVED
-DMNCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_ALERT_IND
+DCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) codecs: 10.23.23.1:23{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 remote=10.23.23.1:23{AMR:octet-align=1#112} MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
+DMNCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_ALERT_IND (RTP=10.23.23.1:23{VND.3GPP.IUFP/16000#96})
   MSC --> MNCC: callref 0x423: MNCC_ALERT_IND
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
 - Total time passed: 2.000046 s
@@ -834,7 +843,7 @@
 DCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) rx CONNECT in state CALL_RECEIVED
 DCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) stopping pending timer T301
 DCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) new state CALL_RECEIVED -> CONNECT_REQUEST
-DMNCC trans(CC:CONNECT_REQUEST IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_SETUP_CNF
+DMNCC trans(CC:CONNECT_REQUEST IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_SETUP_CNF (RTP=10.23.23.1:23{VND.3GPP.IUFP/16000#96})
   MSC --> MNCC: callref 0x423: MNCC_SETUP_CNF
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
   MSC <-- MNCC: callref 0x423: MNCC_SETUP_COMPL_REQ
@@ -1135,11 +1144,20 @@
 
 - after a while, MNCC asks us to setup a call, causing Paging
   MSC <-- MNCC: callref 0x423: MNCC_SETUP_REQ
+v=0
+o=OsmoMSC 0 0 IN IP4 10.23.23.1
+s=GSM Call
+c=IN IP4 10.23.23.1
+t=0 0
+m=audio 23 RTP/AVP 112
+a=rtpmap:112 AMR/8000
+a=fmtp:112 octet-align=1
+a=ptime:20
 
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 + mncc_tx_to_gsm_cc: now used by 2 (attached,mncc_tx_to_gsm_cc)
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 + CC: now used by 3 (attached,mncc_tx_to_gsm_cc,CC)
 DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 callref-0x423 tid-255) New transaction
-DMNCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 callref-0x423 tid-255) rx MNCC_SETUP_REQ
+DMNCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 callref-0x423 tid-255) rx MNCC_SETUP_REQ (RTP=10.23.23.1:23{AMR:octet-align=1#112})
 DPAG Paging: IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 for MNCC: establish call: Starting paging
   paging request (CALL_CONVERSATIONAL) to IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 on UTRAN-Iu
   strcmp(paging_expecting_imsi, vsub->imsi) == 0
@@ -1227,12 +1245,11 @@
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTHENTICATED}: Received Event MSC_A_EV_TRANSACTION_ACCEPTED
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_AUTHENTICATED}: state_chg to MSC_A_ST_COMMUNICATING
 DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) starting timer T303 with 30 seconds
-DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) Got no information of remote audio codecs: neither SDP nor Bearer Capability. Trying anyway.
-DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) codecs: :0{AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113} (from: RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
+DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) codecs: :0{AMR:octet-align=1#112} (from: remote=10.23.23.1:23{AMR:octet-align=1#112} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
 DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) new state NULL -> CALL_PRESENT
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Sending DTAP: CC GSM48_MT_CC_SETUP
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: RAN encode: DTAP on UTRAN-Iu
-- DTAP --UTRAN-Iu--> MS: GSM48_MT_CC_SETUP: 030504076004050b060887
+- DTAP --UTRAN-Iu--> MS: GSM48_MT_CC_SETUP: 030504046004058b
 - DTAP matches expected message
 DMSC dummy_msc_i(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){0}: Received Event MSC_I_EV_FROM_A_FORWARD_ACCESS_SIGNALLING_REQUEST
 DREF VLR subscr IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100 - Paging: now used by 3 (attached,CC,active-conn)
@@ -1258,6 +1275,15 @@
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
 - MNCC sends MNCC_RTP_CREATE
   MSC <-- MNCC: callref 0x423: MNCC_RTP_CREATE
+v=0
+o=OsmoMSC 0 0 IN IP4 10.23.23.1
+s=GSM Call
+c=IN IP4 10.23.23.1
+t=0 0
+m=audio 23 RTP/AVP 112
+a=rtpmap:112 AMR/8000
+a=fmtp:112 octet-align=1
+a=ptime:20
 
 DMNCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) rx MNCC_RTP_CREATE
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Assignment for this trans already started earlier
@@ -1281,8 +1307,8 @@
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_CN: 10.23.23.1:23 (osmux=no:-2)
-DCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) codecs: :0{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
-DMNCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_RTP_CREATE (RTP=10.23.23.1:23)
+DCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) codecs: 10.23.23.1:23{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 remote=10.23.23.1:23{AMR:octet-align=1#112} MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
+DMNCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_RTP_CREATE (RTP=10.23.23.1:23{VND.3GPP.IUFP/16000#96})
   MSC --> MNCC: callref 0x423: MNCC_RTP_CREATE
 - Total time passed: 1.000023 s
   MSC <--UTRAN-Iu-- MS: GSM48_MT_CC_ALERTING
@@ -1293,7 +1319,8 @@
 DCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) stopping pending timer T310
 DCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) starting timer T301 with 180 seconds
 DCC trans(CC:MO_TERM_CALL_CONF IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) new state MO_TERM_CALL_CONF -> CALL_RECEIVED
-DMNCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_ALERT_IND
+DCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) codecs: 10.23.23.1:23{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 remote=10.23.23.1:23{AMR:octet-align=1#112} MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
+DMNCC trans(CC:CALL_RECEIVED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP callref-0x423 tid-0) tx MNCC_ALERT_IND (RTP=10.23.23.1:23{VND.3GPP.IUFP/16000#96})
   MSC --> MNCC: callref 0x423: MNCC_ALERT_IND
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:PAGING_RESP){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
 - Total time passed: 16.000046 s
@@ -1657,7 +1684,7 @@
 DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) new state NULL -> INITIATED
 DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) SETUP to 123
 DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) codecs: :0{AMR:octet-align=1#112} (from: MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
-DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) tx MNCC_SETUP_IND
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) tx MNCC_SETUP_IND (RTP=0.0.0.0:0{AMR:octet-align=1#112})
   MSC --> MNCC: callref 0x80000002: MNCC_SETUP_IND
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
 - MNCC replies with MNCC_RTP_CREATE, causing MGW endpoint CRCX to RAN
@@ -1691,8 +1718,8 @@
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_CN: 10.23.23.1:23 (osmux=no:-2)
-DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) codecs: :0{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
-DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) tx MNCC_RTP_CREATE (RTP=10.23.23.1:23)
+DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) codecs: 10.23.23.1:23{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000002 tid-8) tx MNCC_RTP_CREATE (RTP=10.23.23.1:23{VND.3GPP.IUFP/16000#96})
   MSC --> MNCC: callref 0x80000002: MNCC_RTP_CREATE
 - MNCC says that's fine
   MSC <-- MNCC: callref 0x80000002: MNCC_CALL_PROC_REQ
@@ -2084,7 +2111,7 @@
 DCC trans(CC:NULL IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) new state NULL -> INITIATED
 DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) SETUP to 123
 DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) codecs: :0{AMR:octet-align=1#112} (from: MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
-DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) tx MNCC_SETUP_IND
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) tx MNCC_SETUP_IND (RTP=0.0.0.0:0{AMR:octet-align=1#112})
   MSC --> MNCC: callref 0x80000003: MNCC_SETUP_IND
 DREF msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: - rx_from_ms: now used by 1 (cc)
 - MNCC replies with MNCC_RTP_CREATE, causing MGW endpoint CRCX to RAN
@@ -2118,8 +2145,8 @@
 DCC call_leg(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){ESTABLISHING}: Received Event CALL_LEG_EV_RTP_STREAM_ADDR_AVAILABLE
 DMSC msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: Received Event MSC_EV_CALL_LEG_RTP_LOCAL_ADDR_AVAILABLE
 DIUCS msc_a(IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ){MSC_A_ST_COMMUNICATING}: MGW endpoint's RTP address available for the CI RTP_TO_CN: 10.23.23.1:23 (osmux=no:-2)
-DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) codecs: :0{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
-DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) tx MNCC_RTP_CREATE (RTP=10.23.23.1:23)
+DCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) codecs: 10.23.23.1:23{VND.3GPP.IUFP/16000#96} (from: assigned=VND.3GPP.IUFP/16000#96 MS={AMR:octet-align=1#112,GSM-EFR#110,GSM#3,GSM-HR-08#111} RAN={AMR:octet-align=1#112,AMR-WB/16000:octet-align=1#113})
+DMNCC trans(CC:INITIATED IMSI-901700000010650:MSISDN-42342:TMSI-0x03020100:UTRAN-Iu:CM_SERVICE_REQ callref-0x80000003 tid-8) tx MNCC_RTP_CREATE (RTP=10.23.23.1:23{VND.3GPP.IUFP/16000#96})
   MSC --> MNCC: callref 0x80000003: MNCC_RTP_CREATE
 - MNCC says that's fine
   MSC <-- MNCC: callref 0x80000003: MNCC_CALL_PROC_REQ