diff --git a/openbsc/configure.ac b/openbsc/configure.ac
index 86dab55..b56254c 100644
--- a/openbsc/configure.ac
+++ b/openbsc/configure.ac
@@ -41,6 +41,18 @@
     ])
 AM_CONDITIONAL(BUILD_BSC, test "x$osmo_ac_build_bsc" = "xyes")
 
+AC_ARG_ENABLE([smpp], [AS_HELP_STRING([--enable-smpp], [Build the SMPP interface])],
+    [
+        PKG_CHECK_MODULES(LIBSMPP34, libsmpp34 >= 1.10)
+        osmo_ac_build_smpp="yes"
+	AC_DEFINE(BUILD_SMPP, 1, [Define if we want to build SMPP])
+    ],
+    [
+        osmo_ac_build_smpp="no"
+    ])
+AM_CONDITIONAL(BUILD_SMPP, test "x$osmo_ac_build_smpp" = "xyes")
+
+
 PKG_CHECK_MODULES(LIBOSMOCORE, libosmocore >= 0.3.2)
 PKG_CHECK_MODULES(LIBOSMOVTY, libosmovty >= 0.3.0)
 PKG_CHECK_MODULES(LIBOSMOGSM, libosmogsm >= 0.3.0)
diff --git a/openbsc/include/openbsc/debug.h b/openbsc/include/openbsc/debug.h
index 0023b8c..84931af 100644
--- a/openbsc/include/openbsc/debug.h
+++ b/openbsc/include/openbsc/debug.h
@@ -32,6 +32,7 @@
 	DSNDCP,
 	DNAT,
 	DCTRL,
+	DSMPP,
 	Debug_LastEntry,
 };
 
diff --git a/openbsc/include/openbsc/gsm_data.h b/openbsc/include/openbsc/gsm_data.h
index dea4119..c6a40e3 100644
--- a/openbsc/include/openbsc/gsm_data.h
+++ b/openbsc/include/openbsc/gsm_data.h
@@ -271,12 +271,29 @@
 	struct ctrl_handle *ctrl;
 };
 
+struct osmo_esme;
+
+enum gsm_sms_source_id {
+	SMS_SOURCE_UNKNOWN = 0,
+	SMS_SOURCE_MS,		/* received from MS */
+	SMS_SOURCE_VTY,		/* received from VTY */
+	SMS_SOURCE_SMPP,	/* received via SMPP */
+};
+
 #define SMS_HDR_SIZE	128
 #define SMS_TEXT_SIZE	256
 struct gsm_sms {
 	unsigned long long id;
 	struct gsm_subscriber *sender;
 	struct gsm_subscriber *receiver;
+	enum gsm_sms_source_id source;
+
+	struct {
+		struct osmo_esme *esme;
+		uint32_t sequence_nr;
+		int transaction_mode;
+		char msg_id[16];
+	} smpp;
 
 	unsigned long validity_minutes;
 	uint8_t reply_path_req;
diff --git a/openbsc/src/libcommon/debug.c b/openbsc/src/libcommon/debug.c
index fad5e27..d082492 100644
--- a/openbsc/src/libcommon/debug.c
+++ b/openbsc/src/libcommon/debug.c
@@ -161,6 +161,11 @@
 		.description = "Control interface",
 		.enabled = 1, .loglevel = LOGL_NOTICE,
 	},
+	[DSMPP] = {
+		.name = "DSMPP",
+		.description = "SMPP interface for external SMS apps",
+		.enabled = 1, .loglevel = LOGL_DEBUG,
+	},
 };
 
 enum log_filter {
diff --git a/openbsc/src/libmsc/Makefile.am b/openbsc/src/libmsc/Makefile.am
index 4a1488d..89fee91 100644
--- a/openbsc/src/libmsc/Makefile.am
+++ b/openbsc/src/libmsc/Makefile.am
@@ -18,3 +18,6 @@
 			transaction.c \
 			osmo_msc.c
 
+if BUILD_SMPP
+libmsc_a_SOURCES += smpp_smsc.c smpp_openbsc.c
+endif
diff --git a/openbsc/src/libmsc/gsm_04_11.c b/openbsc/src/libmsc/gsm_04_11.c
index e695648..fe1b645 100644
--- a/openbsc/src/libmsc/gsm_04_11.c
+++ b/openbsc/src/libmsc/gsm_04_11.c
@@ -117,6 +117,10 @@
 		subscr_put(sms->sender);
 	if (sms->receiver)
 		subscr_put(sms->receiver);
+#ifdef BUILD_SMPP
+	if (sms->smpp.esme)
+		smpp_esme_put(sms->smpp.esme);
+#endif
 
 	talloc_free(sms);
 }
diff --git a/openbsc/src/libmsc/smpp_openbsc.c b/openbsc/src/libmsc/smpp_openbsc.c
new file mode 100644
index 0000000..4a54e47
--- /dev/null
+++ b/openbsc/src/libmsc/smpp_openbsc.c
@@ -0,0 +1,307 @@
+/* OpenBSC SMPP 3.4 interface, SMSC-side implementation */
+
+/* (C) 2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdint.h>
+#include <errno.h>
+
+#include <smpp34.h>
+#include <smpp34_structs.h>
+#include <smpp34_params.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/talloc.h>
+#include <osmocom/gsm/protocol/gsm_04_11.h>
+
+#include <openbsc/gsm_subscriber.h>
+#include <openbsc/debug.h>
+#include <openbsc/db.h>
+#include <openbsc/gsm_04_11.h>
+#include <openbsc/gsm_data.h>
+#include <openbsc/signal.h>
+
+#include "smpp_smsc.h"
+
+/*! \brief find gsm_subscriber for a given SMPP NPI/TON/Address */
+static struct gsm_subscriber *subscr_by_dst(struct gsm_network *net,
+					    uint8_t npi, uint8_t ton, const char *addr)
+{
+	struct gsm_subscriber *subscr = NULL;
+
+	switch (npi) {
+	case NPI_Land_Mobile_E212:
+		subscr = subscr_get_by_imsi(net, addr);
+		break;
+	case NPI_ISDN_E163_E164:
+	case NPI_Private:
+		subscr = subscr_get_by_extension(net, addr);
+		break;
+	default:
+		LOGP(DSMPP, LOGL_NOTICE, "Unsupported NPI: %u\n", npi);
+		break;
+	}
+
+	return subscr;
+}
+
+/*! \brief find a TLV with given tag in list of libsmpp34 TLVs */
+struct tlv_t *find_tlv(struct tlv_t *head, uint16_t tag)
+{
+	struct tlv_t *t;
+
+	for (t = head; t != NULL; t = t->next) {
+		if (t->tag == tag)
+			return t;
+	}
+	return NULL;
+}
+
+/*! \brief convert from submit_sm_t to gsm_sms */
+static int submit_to_sms(struct gsm_sms **psms, struct gsm_network *net,
+			 const struct submit_sm_t *submit)
+{
+	struct gsm_subscriber *dest;
+	struct gsm_sms *sms;
+	struct tlv_t *t;
+	const uint8_t *sms_msg;
+	unsigned int sms_msg_len;
+
+	dest = subscr_by_dst(net, submit->dest_addr_npi,
+			     submit->dest_addr_ton,
+			     (const char *)submit->destination_addr);
+	if (!dest) {
+		LOGP(DSMS, LOGL_NOTICE, "SMPP SUBMIT-SM for unknown subscriber: "
+		     "%s (NPI=%u)\n", submit->destination_addr,
+		     submit->dest_addr_npi);
+		return ESME_RINVDSTADR;
+	}
+
+	t = find_tlv(submit->tlv, TLVID_message_payload);
+	if (t) {
+		if (submit->sm_length) {
+			/* ERROR: we cannot have botH! */
+			LOGP(DSMS, LOGL_ERROR, "SMPP Cannot have payload in "
+				"TLV _and_ in the header\n");
+			return ESME_ROPTPARNOTALLWD;
+		}
+		sms_msg = t->value.octet;
+		sms_msg_len = t->length;
+	} else if (submit->short_message && submit->sm_length) {
+		sms_msg = submit->short_message;
+		sms_msg_len = submit->sm_length;
+	} else {
+		sms_msg = NULL;
+		sms_msg_len = 0;
+	}
+
+	sms = sms_alloc();
+	sms->source = SMS_SOURCE_SMPP;
+	sms->smpp.sequence_nr = submit->sequence_number;
+	sms->receiver = dest;
+	strncpy(sms->dest_addr, dest->extension, sizeof(sms->dest_addr)-1);
+	sms->sender = subscr_get_by_id(net, 1);
+
+	if (submit->esm_class & 0x40)
+		sms->ud_hdr_ind = 1;
+
+	if (submit->esm_class & 0x80) {
+		sms->reply_path_req = 1;
+#warning Implement reply path
+	}
+
+	if (submit->data_coding == 0x00 ||	/* SMSC default */
+	    submit->data_coding == 0x01 ||	/* GSM default alphabet */
+	    (submit->data_coding & 0xFC) == 0xF0) { /* 03.38 DCS default */
+		uint8_t ud_len = 0;
+		sms->data_coding_scheme = GSM338_DCS_1111_7BIT;
+		if (sms->ud_hdr_ind) {
+			ud_len = *sms_msg + 1;
+			printf("copying %u bytes user data...\n", ud_len);
+			memcpy(sms->user_data, sms_msg,
+				OSMO_MIN(ud_len, sizeof(sms->user_data)));
+			sms_msg += ud_len;
+			sms_msg_len -= ud_len;
+		}
+		strncpy(sms->text, (char *)sms_msg,
+			OSMO_MIN(sizeof(sms->text)-1, sms_msg_len));
+		printf("encoding 7bit to offset %u text(%s)\n", ud_len, sms->text);
+		sms->user_data_len = gsm_7bit_encode(sms->user_data+ud_len, sms->text);
+	} else if (submit->data_coding == 0x02 ||
+		   submit->data_coding == 0x04 ||
+		   (submit->data_coding & 0xFC) == 0xF4) { /* 03.38 DCS 8bit */
+		/* 8-bit binary */
+		sms->data_coding_scheme = GSM338_DCS_1111_8BIT_DATA;
+		memcpy(sms->user_data, sms_msg, sms_msg_len);
+		sms->user_data_len = sms_msg_len;
+	} else if (submit->data_coding == 0x80) {
+		/* UCS-2 */
+		sms->data_coding_scheme = (2 << 2);
+		memcpy(sms->user_data, sms_msg, submit->sm_length);
+		sms->user_data_len = sms_msg_len;
+	} else {
+		sms_free(sms);
+		LOGP(DSMS, LOGL_ERROR, "SMPP Unknown Data Coding 0x%02x\n",
+			submit->data_coding);
+		return ESME_RUNKNOWNERR;
+	}
+
+	*psms = sms;
+	return ESME_ROK;
+}
+
+/*! \brief handle incoming libsmpp34 ssubmit_sm_t from remote ESME */
+int handle_smpp_submit(struct osmo_esme *esme, struct submit_sm_t *submit,
+		       struct submit_sm_resp_t *submit_r)
+{
+	struct gsm_sms *sms;
+	int rc = -1;
+
+	rc = submit_to_sms(&sms, esme->smsc->priv, submit);
+	if (rc != ESME_ROK) {
+		submit_r->command_status = rc;
+		return 0;
+	}
+	smpp_esme_get(esme);
+	sms->smpp.esme = esme;
+	sms->protocol_id = submit->protocol_id;
+
+	switch (submit->esm_class & 3) {
+	case 0: /* default */
+	case 1: /* datagram */
+	case 3: /* store-and-forward */
+		rc = db_sms_store(sms);
+		if (rc < 0) {
+			LOGP(DSMS, LOGL_ERROR, "SMPP SUBMIT-SM: Unable to "
+				"store SMS in database\n");
+			sms_free(sms);
+			submit_r->command_status = ESME_RSYSERR;
+			return 0;
+		}
+		strcpy((char *)submit_r->message_id, "msg_id_not_implemented");
+		LOGP(DSMS, LOGL_INFO, "SMPP SUBMIT-SM: Stored in DB\n");
+		rc = 0;
+		break;
+	case 2: /* forward (i.e. transaction) mode */
+		LOGP(DSMS, LOGL_DEBUG, "SMPP SUBMIT-SM: Forwarding in "
+			"real time (Transaction/Forward mode)\n");
+		sms->smpp.transaction_mode = 1;
+		gsm411_send_sms_subscr(sms->receiver, sms);
+		rc = 1; /* don't send any response yet */
+		break;
+	}
+	return rc;
+}
+
+/*! \brief signal handler for status of attempted SMS deliveries */
+static int smpp_sms_cb(unsigned int subsys, unsigned int signal,
+			void *handler_data, void *signal_data)
+{
+	struct gsm_network *network = handler_data;
+	struct sms_signal_data *sig_sms = signal_data;
+	struct gsm_sms *sms = sig_sms->sms;
+	int rc = 0;
+
+	if (!sms)
+		return 0;
+
+	if (sms->source != SMS_SOURCE_SMPP)
+		return 0;
+
+	switch (signal) {
+	case S_SMS_UNKNOWN_ERROR:
+		if (sms->smpp.transaction_mode) {
+			/* Send back the SUBMIT-SM response with apropriate error */
+			LOGP(DSMS, LOGL_INFO, "SMPP SUBMIT-SM: Error\n");
+			rc = smpp_tx_submit_r(sms->smpp.esme,
+					      sms->smpp.sequence_nr,
+					      ESME_RDELIVERYFAILURE,
+					      sms->smpp.msg_id);
+		}
+		break;
+	case S_SMS_DELIVERED:
+		/* SMS layer tells us the delivery has been completed */
+		if (sms->smpp.transaction_mode) {
+			/* Send back the SUBMIT-SM response */
+			LOGP(DSMS, LOGL_INFO, "SMPP SUBMIT-SM: Success\n");
+			rc = smpp_tx_submit_r(sms->smpp.esme,
+					      sms->smpp.sequence_nr,
+					      ESME_ROK, sms->smpp.msg_id);
+		}
+		break;
+	}
+
+	return rc;
+}
+
+/*! \brief signal handler for subscriber related signals */
+static int smpp_subscr_cb(unsigned int subsys, unsigned int signal,
+			  void *handler_data, void *signal_data)
+{
+	struct gsm_subscriber *subscr = signal_data;
+	struct smsc *smsc = handler_data;
+	struct osmo_esme *esme;
+	uint8_t smpp_avail_status;
+
+	/* determine the smpp_avail_status depending on attach/detach */
+	switch (signal) {
+	case S_SUBSCR_ATTACHED:
+		smpp_avail_status = 0;
+		break;
+	case S_SUBSCR_DETACHED:
+		smpp_avail_status = 2;
+		break;
+	default:
+		return 0;
+	}
+
+	llist_for_each_entry(esme, &smsc->esme_list, list) {
+		/* we currently send an alert notification to each ESME that is
+		 * connected, and do not require a (non-existant) delivery
+		 * pending flag to be set before,  FIXME: make this VTY
+		 * configurable */
+		smpp_tx_alert(esme, TON_Subscriber_Number,
+				NPI_Land_Mobile_E212, subscr->imsi,
+				smpp_avail_status);
+	}
+
+	return 0;
+}
+
+/*! \brief Initialize the OpenBSC SMPP interface */
+int smpp_openbsc_init(struct gsm_network *net, uint16_t port)
+{
+	struct smsc *smsc = talloc_zero(net, struct smsc);
+	int rc;
+
+	smsc->priv = net;
+
+	rc = smpp_smsc_init(smsc, port);
+	if (rc < 0)
+		talloc_free(smsc);
+
+	osmo_signal_register_handler(SS_SMS, smpp_sms_cb, net);
+	osmo_signal_register_handler(SS_SUBSCR, smpp_subscr_cb, smsc);
+
+	return rc;
+}
diff --git a/openbsc/src/libmsc/smpp_smsc.c b/openbsc/src/libmsc/smpp_smsc.c
new file mode 100644
index 0000000..8957c8e
--- /dev/null
+++ b/openbsc/src/libmsc/smpp_smsc.c
@@ -0,0 +1,638 @@
+/* SMPP 3.4 interface, SMSC-side implementation */
+/* (C) 2012 by Harald Welte <laforge@gnumonks.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdint.h>
+#include <errno.h>
+
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+#include <smpp34.h>
+#include <smpp34_structs.h>
+#include <smpp34_params.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/write_queue.h>
+#include <osmocom/core/talloc.h>
+
+#include "smpp_smsc.h"
+
+#include <openbsc/debug.h>
+
+/*! \brief Ugly wrapper. libsmpp34 should do this itself! */
+#define SMPP34_UNPACK(rc, type, str, data, len)		\
+	memset(str, 0, sizeof(*str));			\
+	rc = smpp34_unpack(type, str, data, len)
+
+enum emse_bind {
+	ESME_BIND_RX = 0x01,
+	ESME_BIND_TX = 0x02,
+};
+
+/*! \brief increaes the use/reference count */
+void smpp_esme_get(struct osmo_esme *esme)
+{
+	esme->use++;
+}
+
+static void esme_destroy(struct osmo_esme *esme)
+{
+	osmo_wqueue_clear(&esme->wqueue);
+	if (esme->wqueue.bfd.fd >= 0) {
+		osmo_fd_unregister(&esme->wqueue.bfd);
+		close(esme->wqueue.bfd.fd);
+	}
+	llist_del(&esme->list);
+	talloc_free(esme);
+}
+
+/*! \brief decrease the use/reference count, free if it is 0 */
+void smpp_esme_put(struct osmo_esme *esme)
+{
+	esme->use--;
+	if (esme->use <= 0)
+		esme_destroy(esme);
+}
+
+static struct osmo_esme *
+esme_by_system_id(const struct smsc *smsc, char *system_id)
+{
+	struct osmo_esme *e;
+
+	llist_for_each_entry(e, &smsc->esme_list, list) {
+		if (!strcmp(e->system_id, system_id))
+			return e;
+	}
+	return NULL;
+}
+
+
+/*! \brief initialize the libsmpp34 data structure for a response */
+#define INIT_RESP(type, resp, req) 		{ \
+	memset((resp), 0, sizeof(*(resp)));	  \
+	(resp)->command_length	= 0;		  \
+	(resp)->command_id	= type;		  \
+	(resp)->command_status	= ESME_ROK;	  \
+	(resp)->sequence_number	= (req)->sequence_number;	\
+}
+
+/*! \brief pack a libsmpp34 data strcutrure and send it to the ESME */
+#define PACK_AND_SEND(esme, ptr)	pack_and_send(esme, (ptr)->command_id, ptr)
+static int pack_and_send(struct osmo_esme *esme, uint32_t type, void *ptr)
+{
+	struct msgb *msg = msgb_alloc(4096, "SMPP_Tx");
+	int rc, rlen;
+	if (!msg)
+		return -ENOMEM;
+
+	rc = smpp34_pack(type, msg->tail, msgb_tailroom(msg), &rlen, ptr);
+	if (rc != 0) {
+		LOGP(DSMPP, LOGL_ERROR, "[%s] Error during smpp34_pack(): %s\n",
+		     esme->system_id, smpp34_strerror);
+		msgb_free(msg);
+		return -EINVAL;
+	}
+	msgb_put(msg, rlen);
+
+	return osmo_wqueue_enqueue(&esme->wqueue, msg);
+}
+
+/*! \brief transmit a generic NACK to a remote ESME */
+static int smpp_tx_gen_nack(struct osmo_esme *esme, uint32_t seq, uint32_t status)
+{
+	struct generic_nack_t nack;
+	char buf[SMALL_BUFF];
+
+	nack.command_length = 0;
+	nack.command_id = GENERIC_NACK;
+	nack.sequence_number = seq;
+	nack.command_status = status;
+
+	LOGP(DSMPP, LOGL_ERROR, "[%s] Tx GENERIC NACK: %s\n",
+	     esme->system_id, str_command_status(status, buf));
+
+	return PACK_AND_SEND(esme, &nack);
+}
+
+/*! \brief retrieve SMPP command ID from a msgb */
+static inline uint32_t smpp_msgb_cmdid(struct msgb *msg)
+{
+	uint8_t *tmp = msgb_data(msg) + 4;
+	return ntohl(*(uint32_t *)tmp);
+}
+
+/*! \brief retrieve SMPP sequence number from a msgb */
+static inline uint32_t smpp_msgb_seq(struct msgb *msg)
+{
+	uint8_t *tmp = msgb_data(msg);
+	return ntohl(*(uint32_t *)tmp);
+}
+
+/*! \brief handle an incoming SMPP generic NACK */
+static int smpp_handle_gen_nack(struct osmo_esme *esme, struct msgb *msg)
+{
+	struct generic_nack_t nack;
+	char buf[SMALL_BUFF];
+	int rc;
+
+	SMPP34_UNPACK(rc, GENERIC_NACK, &nack, msgb_data(msg),
+			 msgb_length(msg));
+	if (rc < 0) {
+		LOGP(DSMPP, LOGL_ERROR, "[%s] Error in smpp34_unpack():%s\n",
+			esme->system_id, smpp34_strerror);
+		return rc;
+	}
+
+	LOGP(DSMPP, LOGL_ERROR, "[%s] Rx GENERIC NACK: %s\n",
+	     esme->system_id, str_command_status(nack.command_status, buf));
+
+	return 0;
+}
+
+/*! \brief handle an incoming SMPP BIND RECEIVER */
+static int smpp_handle_bind_rx(struct osmo_esme *esme, struct msgb *msg)
+{
+	struct bind_receiver_t bind;
+	struct bind_receiver_resp_t bind_r;
+	int rc;
+
+	SMPP34_UNPACK(rc, BIND_RECEIVER, &bind, msgb_data(msg),
+			   msgb_length(msg));
+	if (rc < 0) {
+		LOGP(DSMPP, LOGL_ERROR, "[%s] Error in smpp34_unpack():%s\n",
+			esme->system_id, smpp34_strerror);
+		return rc;
+	}
+
+	INIT_RESP(BIND_TRANSMITTER_RESP, &bind_r, &bind);
+
+	LOGP(DSMPP, LOGL_INFO, "[%s] Rx BIND Rx from (Version %02x)\n",
+		bind.system_id, bind.interface_version);
+
+	if (bind.interface_version != SMPP_VERSION) {
+		bind_r.command_status = ESME_RSYSERR;
+		goto err;
+	}
+
+	if (esme->bind_flags) {
+		bind_r.command_status = ESME_RALYBND;
+		goto err;
+	}
+
+	esme->smpp_version = bind.interface_version;
+	snprintf(esme->system_id, sizeof(esme->system_id), "%s",
+		 bind.system_id);
+	esme->bind_flags = ESME_BIND_RX;
+
+	/* FIXME */
+err:
+	return 0;
+}
+
+/*! \brief handle an incoming SMPP BIND TRANSMITTER */
+static int smpp_handle_bind_tx(struct osmo_esme *esme, struct msgb *msg)
+{
+	struct bind_transmitter_t bind;
+	struct bind_transmitter_resp_t bind_r;
+	struct tlv_t tlv;
+	int rc;
+
+	SMPP34_UNPACK(rc, BIND_TRANSMITTER, &bind, msgb_data(msg),
+			   msgb_length(msg));
+	if (rc < 0) {
+		LOGP(DSMPP, LOGL_ERROR, "[%s] Error in smpp34_unpack():%s\n",
+			esme->system_id, smpp34_strerror);
+		return rc;
+	}
+
+	INIT_RESP(BIND_TRANSMITTER_RESP, &bind_r, &bind);
+
+	LOGP(DSMPP, LOGL_INFO, "[%s] Rx BIND Tx (Version %02x)\n",
+		bind.system_id, bind.interface_version);
+
+	if (bind.interface_version != SMPP_VERSION) {
+		bind_r.command_status = ESME_RSYSERR;
+		goto err;
+	}
+
+	if (esme->bind_flags) {
+		bind_r.command_status = ESME_RALYBND;
+		goto err;
+	}
+
+	esme->smpp_version = bind.interface_version;
+	snprintf(esme->system_id, sizeof(esme->system_id), "%s", bind.system_id);
+	esme->bind_flags = ESME_BIND_TX;
+
+	/* build response */
+	snprintf((char *)bind_r.system_id, sizeof(bind_r.system_id), "%s",
+		 esme->smsc->system_id);
+
+	/* add interface version TLV */
+	tlv.tag = TLVID_sc_interface_version;
+	tlv.length = sizeof(uint8_t);
+	tlv.value.val16 = esme->smpp_version;
+	build_tlv(&bind_r.tlv, &tlv);
+
+err:
+	return PACK_AND_SEND(esme, &bind_r);
+}
+
+/*! \brief handle an incoming SMPP BIND TRANSCEIVER */
+static int smpp_handle_bind_trx(struct osmo_esme *esme, struct msgb *msg)
+{
+	struct bind_transceiver_t bind;
+	struct bind_transceiver_resp_t bind_r;
+	int rc;
+
+	SMPP34_UNPACK(rc, BIND_TRANSCEIVER, &bind, msgb_data(msg),
+			   msgb_length(msg));
+	if (rc < 0) {
+		LOGP(DSMPP, LOGL_ERROR, "[%s] Error in smpp34_unpack():%s\n",
+			esme->system_id, smpp34_strerror);
+		return rc;
+	}
+
+	INIT_RESP(BIND_TRANSMITTER_RESP, &bind_r, &bind);
+
+	LOGP(DSMPP, LOGL_INFO, "[%s] Rx BIND Trx (Version %02x)\n",
+		bind.system_id, bind.interface_version);
+
+	if (bind.interface_version != SMPP_VERSION) {
+		bind_r.command_status = ESME_RSYSERR;
+		goto err;
+	}
+
+	if (esme->bind_flags) {
+		bind_r.command_status = ESME_RALYBND;
+		goto err;
+	}
+
+	esme->smpp_version = bind.interface_version;
+	snprintf(esme->system_id, sizeof(esme->system_id), "%s", bind.system_id);
+	esme->bind_flags |= ESME_BIND_TX | ESME_BIND_RX;
+
+	/* FIXME */
+err:
+	return 0;
+}
+
+/*! \brief handle an incoming SMPP UNBIND */
+static int smpp_handle_unbind(struct osmo_esme *esme, struct msgb *msg)
+{
+	struct unbind_t unbind;
+	struct unbind_resp_t unbind_r;
+	int rc;
+
+	SMPP34_UNPACK(rc, UNBIND, &unbind, msgb_data(msg),
+			   msgb_length(msg));
+	if (rc < 0) {
+		LOGP(DSMPP, LOGL_ERROR, "[%s] Error in smpp34_unpack():%s\n",
+			esme->system_id, smpp34_strerror);
+		return rc;
+	}
+
+	INIT_RESP(UNBIND_RESP, &unbind_r, &unbind);
+
+	LOGP(DSMPP, LOGL_INFO, "[%s] Rx UNBIND\n", esme->system_id);
+
+	if (esme->bind_flags == 0) {
+		unbind_r.command_status = ESME_RINVBNDSTS;
+		goto err;
+	}
+
+	esme->bind_flags = 0;
+err:
+	return PACK_AND_SEND(esme, &unbind_r);
+}
+
+/*! \brief handle an incoming SMPP ENQUIRE LINK */
+static int smpp_handle_enq_link(struct osmo_esme *esme, struct msgb *msg)
+{
+	struct enquire_link_t enq;
+	struct enquire_link_resp_t enq_r;
+	int rc;
+
+	SMPP34_UNPACK(rc, ENQUIRE_LINK, &enq, msgb_data(msg),
+			   msgb_length(msg));
+	if (rc < 0) {
+		LOGP(DSMPP, LOGL_ERROR, "[%s] Error in smpp34_unpack():%s\n",
+			esme->system_id, smpp34_strerror);
+		return rc;
+	}
+
+	LOGP(DSMPP, LOGL_DEBUG, "[%s] Rx Enquire Link\n", esme->system_id);
+
+	INIT_RESP(ENQUIRE_LINK_RESP, &enq_r, &enq);
+
+	LOGP(DSMPP, LOGL_DEBUG, "[%s] Tx Enquire Link Response\n", esme->system_id);
+
+	return PACK_AND_SEND(esme, &enq_r);
+}
+
+/*! \brief send a SUBMIT-SM RESPONSE to a remote ESME */
+int smpp_tx_submit_r(struct osmo_esme *esme, uint32_t sequence_nr,
+		     uint32_t command_status, char *msg_id)
+{
+	struct submit_sm_resp_t submit_r;
+
+	memset(&submit_r, 0, sizeof(submit_r));
+	submit_r.command_length	= 0;
+	submit_r.command_id	= SUBMIT_SM_RESP;
+	submit_r.command_status	= command_status;
+	submit_r.sequence_number= sequence_nr;
+	snprintf((char *) submit_r.message_id, sizeof(submit_r.message_id), "%s", msg_id);
+
+	return PACK_AND_SEND(esme, &submit_r);
+}
+
+static const struct value_string smpp_avail_strs[] = {
+	{ 0,	"Available" },
+	{ 1,	"Denied" },
+	{ 2,	"Unavailable" },
+	{ 0,	NULL }
+};
+
+/*! \brief send an ALERT_NOTIFICATION to a remote ESME */
+int smpp_tx_alert(struct osmo_esme *esme, uint8_t ton, uint8_t npi,
+		  const char *addr, uint8_t avail_status)
+{
+	struct alert_notification_t alert;
+	struct tlv_t tlv;
+
+	memset(&alert, 0, sizeof(alert));
+	alert.command_length	= 0;
+	alert.command_id	= ALERT_NOTIFICATION;
+	alert.command_status	= ESME_ROK;
+	alert.sequence_number	= esme->own_seq_nr++;
+	alert.source_addr_ton 	= ton;
+	alert.source_addr_npi	= npi;
+	snprintf((char *)alert.source_addr, sizeof(alert.source_addr), "%s", addr);
+
+	tlv.tag = TLVID_ms_availability_status;
+	tlv.length = sizeof(uint8_t);
+	tlv.value.val08 = avail_status;
+	build_tlv(&alert.tlv, &tlv);
+
+	LOGP(DSMPP, LOGL_DEBUG, "[%s] Tx ALERT_NOTIFICATION (%s/%u/%u): %s\n",
+		esme->system_id, alert.source_addr, alert.source_addr_ton,
+		alert.source_addr_npi,
+		get_value_string(smpp_avail_strs, avail_status));
+
+	return PACK_AND_SEND(esme, &alert);
+}
+
+/*! \brief handle an incoming SMPP SUBMIT-SM */
+static int smpp_handle_submit(struct osmo_esme *esme, struct msgb *msg)
+{
+	struct submit_sm_t submit;
+	struct submit_sm_resp_t submit_r;
+	int rc;
+
+	memset(&submit, 0, sizeof(submit));
+	SMPP34_UNPACK(rc, SUBMIT_SM, &submit, msgb_data(msg),
+			   msgb_length(msg));
+	if (rc < 0) {
+		LOGP(DSMPP, LOGL_ERROR, "[%s] Error in smpp34_unpack():%s\n",
+			esme->system_id, smpp34_strerror);
+		return rc;
+	}
+
+	INIT_RESP(SUBMIT_SM_RESP, &submit_r, &submit);
+
+	if (!(esme->bind_flags & ESME_BIND_TX)) {
+		submit_r.command_status = ESME_RINVBNDSTS;
+		return PACK_AND_SEND(esme, &submit_r);
+	}
+
+	LOGP(DSMPP, LOGL_INFO, "[%s] Rx SUBMIT-SM (%s/%u/%u)\n",
+		esme->system_id, submit.destination_addr,
+		submit.dest_addr_ton, submit.dest_addr_npi);
+
+	INIT_RESP(SUBMIT_SM_RESP, &submit_r, &submit);
+
+	rc = handle_smpp_submit(esme, &submit, &submit_r);
+	if (rc == 0)
+		return PACK_AND_SEND(esme, &submit_r);
+
+	return rc;
+}
+
+/*! \brief one complete SMPP PDU from the ESME has been received */
+static int smpp_pdu_rx(struct osmo_esme *esme, struct msgb *msg)
+{
+	uint32_t cmd_id = smpp_msgb_cmdid(msg);
+	int rc = 0;
+
+	LOGP(DSMPP, LOGL_DEBUG, "[%s] smpp_pdu_rx(%s)\n", esme->system_id,
+	     osmo_hexdump(msgb_data(msg), msgb_length(msg)));
+
+	switch (cmd_id) {
+	case GENERIC_NACK:
+		rc = smpp_handle_gen_nack(esme, msg);
+		break;
+	case BIND_RECEIVER:
+		rc = smpp_handle_bind_rx(esme, msg);
+		break;
+	case BIND_TRANSMITTER:
+		rc = smpp_handle_bind_tx(esme, msg);
+		break;
+	case BIND_TRANSCEIVER:
+		rc = smpp_handle_bind_trx(esme, msg);
+		break;
+	case UNBIND:
+		rc = smpp_handle_unbind(esme, msg);
+		break;
+	case ENQUIRE_LINK:
+		rc = smpp_handle_enq_link(esme, msg);
+		break;
+	case SUBMIT_SM:
+		rc = smpp_handle_submit(esme, msg);
+		break;
+	case DELIVER_SM:
+		break;
+	case DATA_SM:
+		break;
+	case CANCEL_SM:
+	case QUERY_SM:
+	case REPLACE_SM:
+	case SUBMIT_MULTI:
+		LOGP(DSMPP, LOGL_NOTICE, "[%s] Unimplemented PDU Commmand "
+		     "0x%08x\n", esme->system_id, cmd_id);
+		break;
+	default:
+		LOGP(DSMPP, LOGL_ERROR, "[%s] Unknown PDU Command 0x%08x\n",
+		     esme->system_id, cmd_id);
+		rc = smpp_tx_gen_nack(esme, smpp_msgb_seq(msg), ESME_RINVCMDID);
+		break;
+	}
+
+	return rc;
+}
+
+/* !\brief call-back when per-ESME TCP socket has some data to be read */
+static int esme_link_read_cb(struct osmo_fd *ofd)
+{
+	struct osmo_esme *esme = ofd->data;
+	uint32_t len;
+	uint8_t *lenptr = (uint8_t *) &len;
+	uint8_t *cur;
+	struct msgb *msg;
+	int rdlen;
+	int rc;
+
+	switch (esme->read_state) {
+	case READ_ST_IN_LEN:
+		rdlen = sizeof(uint32_t) - esme->read_idx;
+		rc = read(ofd->fd, lenptr + esme->read_idx, rdlen);
+		if (rc < 0) {
+			LOGP(DSMPP, LOGL_ERROR, "[%s] read returned %d\n",
+			     esme->system_id, rc);
+		} else if (rc == 0) {
+			goto dead_socket;
+		} else
+			esme->read_idx += rc;
+		if (esme->read_idx >= sizeof(uint32_t)) {
+			esme->read_len = ntohl(len);
+			msg = msgb_alloc(esme->read_len, "SMPP Rx");
+			if (!msg)
+				return -ENOMEM;
+			esme->read_msg = msg;
+			cur = msgb_put(msg, sizeof(uint32_t));
+			memcpy(cur, lenptr, sizeof(uint32_t));
+			esme->read_state = READ_ST_IN_MSG;
+			esme->read_idx = sizeof(uint32_t);
+		}
+		break;
+	case READ_ST_IN_MSG:
+		msg = esme->read_msg;
+		rdlen = esme->read_len - esme->read_idx;
+		rc = read(ofd->fd, msg->tail, OSMO_MIN(rdlen, msgb_tailroom(msg)));
+		if (rc < 0) {
+			LOGP(DSMPP, LOGL_ERROR, "[%s] read returned %d\n",
+				esme->system_id, rc);
+		} else if (rc == 0) {
+			goto dead_socket;
+		} else {
+			esme->read_idx += rc;
+			msgb_put(msg, rc);
+		}
+
+		if (esme->read_idx >= esme->read_len) {
+			rc = smpp_pdu_rx(esme, esme->read_msg);
+			esme->read_msg = NULL;
+			esme->read_idx = 0;
+			esme->read_len = 0;
+			esme->read_state = READ_ST_IN_LEN;
+		}
+		break;
+	}
+
+	return 0;
+dead_socket:
+	msgb_free(esme->read_msg);
+	osmo_fd_unregister(&esme->wqueue.bfd);
+	close(esme->wqueue.bfd.fd);
+	esme->wqueue.bfd.fd = -1;
+	smpp_esme_put(esme);
+
+	return 0;
+}
+
+/* call-back of write queue once it wishes to write a message to the socket */
+static void esme_link_write_cb(struct osmo_fd *ofd, struct msgb *msg)
+{
+	struct osmo_esme *esme = ofd->data;
+	int rc;
+
+	rc = write(ofd->fd, msgb_data(msg), msgb_length(msg));
+	if (rc == 0) {
+		osmo_fd_unregister(&esme->wqueue.bfd);
+		close(esme->wqueue.bfd.fd);
+		esme->wqueue.bfd.fd = -1;
+		smpp_esme_put(esme);
+	} else if (rc < msgb_length(msg)) {
+		LOGP(DSMPP, LOGL_ERROR, "[%s] Short write\n", esme->system_id);
+		return;
+	}
+}
+
+/* callback for already-accepted new TCP socket */
+static int link_accept_cb(struct smsc *smsc, int fd,
+			  struct sockaddr_storage *s, socklen_t s_len)
+{
+	struct osmo_esme *esme = talloc_zero(smsc, struct osmo_esme);
+	if (!esme)
+		return -ENOMEM;
+
+	smpp_esme_get(esme);
+	esme->own_seq_nr = rand();
+	esme->smsc = smsc;
+	osmo_wqueue_init(&esme->wqueue, 10);
+	esme->wqueue.bfd.fd = fd;
+	esme->wqueue.bfd.data = esme;
+	esme->wqueue.bfd.when = BSC_FD_READ;
+	osmo_fd_register(&esme->wqueue.bfd);
+
+	esme->wqueue.read_cb = esme_link_read_cb;
+	esme->wqueue.write_cb = esme_link_write_cb;
+
+	esme->sa_len = OSMO_MIN(sizeof(esme->sa), s_len);
+	memcpy(&esme->sa, s, esme->sa_len);
+
+	llist_add_tail(&esme->list, &smsc->esme_list);
+
+	return 0;
+}
+
+/* callback of listening TCP socket */
+static int smsc_fd_cb(struct osmo_fd *ofd, unsigned int what)
+{
+	int rc;
+	struct sockaddr_storage sa;
+	socklen_t sa_len = sizeof(sa);
+
+	rc = accept(ofd->fd, (struct sockaddr *)&sa, &sa_len);
+	if (rc < 0) {
+		LOGP(DSMPP, LOGL_ERROR, "Accept returns %d (%s)\n",
+		     rc, strerror(errno));
+		return rc;
+	}
+	return link_accept_cb(ofd->data, rc, &sa, sa_len);
+}
+
+/*! \brief Initialize the SMSC-side SMPP implementation */
+int smpp_smsc_init(struct smsc *smsc, uint16_t port)
+{
+	int rc;
+
+	INIT_LLIST_HEAD(&smsc->esme_list);
+	smsc->listen_ofd.data = smsc;
+	smsc->listen_ofd.cb = smsc_fd_cb;
+	rc = osmo_sock_init_ofd(&smsc->listen_ofd, AF_UNSPEC, SOCK_STREAM,
+				IPPROTO_TCP, NULL, port, OSMO_SOCK_F_BIND);
+
+	return rc;
+}
diff --git a/openbsc/src/libmsc/smpp_smsc.h b/openbsc/src/libmsc/smpp_smsc.h
new file mode 100644
index 0000000..b1617e6
--- /dev/null
+++ b/openbsc/src/libmsc/smpp_smsc.h
@@ -0,0 +1,65 @@
+#ifndef _SMPP_SMSC_H
+#define _SMPP_SMSC_H
+
+#include <sys/socket.h>
+#include <netinet/in.h>
+
+#include <osmocom/core/utils.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/write_queue.h>
+
+#include <smpp34.h>
+#include <smpp34_structs.h>
+#include <smpp34_params.h>
+
+enum esme_read_state {
+	READ_ST_IN_LEN = 0,
+	READ_ST_IN_MSG = 1,
+};
+
+struct osmo_esme {
+	struct llist_head list;
+	struct smsc *smsc;
+
+	int use;
+
+	uint32_t own_seq_nr;
+
+	struct osmo_wqueue wqueue;
+	struct sockaddr_storage sa;
+	socklen_t sa_len;
+
+	enum esme_read_state read_state;
+	uint32_t read_len;
+	uint32_t read_idx;
+	struct msgb *read_msg;
+
+	uint8_t smpp_version;
+	char system_id[16+1];
+
+	uint8_t bind_flags;
+};
+
+struct smsc {
+	struct osmo_fd listen_ofd;
+	struct llist_head esme_list;
+	char system_id[16+1];
+	void *priv;
+};
+
+
+int smpp_smsc_init(struct smsc *smsc, uint16_t port);
+
+void smpp_esme_get(struct osmo_esme *esme);
+void smpp_esme_put(struct osmo_esme *esme);
+
+int smpp_tx_submit_r(struct osmo_esme *esme, uint32_t sequence_nr,
+		     uint32_t command_status, char *msg_id);
+
+int smpp_tx_alert(struct osmo_esme *esme, uint8_t ton, uint8_t npi,
+		  const char *addr, uint8_t avail_status);
+
+int handle_smpp_submit(struct osmo_esme *esme, struct submit_sm_t *submit,
+			struct submit_sm_resp_t *submit_r);
+
+#endif
diff --git a/openbsc/src/osmo-nitb/Makefile.am b/openbsc/src/osmo-nitb/Makefile.am
index 48d9ce2..dc69232 100644
--- a/openbsc/src/osmo-nitb/Makefile.am
+++ b/openbsc/src/osmo-nitb/Makefile.am
@@ -1,5 +1,8 @@
 INCLUDES = $(all_includes) -I$(top_srcdir)/include -I$(top_builddir)
-AM_CFLAGS=-Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) $(LIBOSMOVTY_CFLAGS) $(LIBOSMOABIS_CFLAGS) $(COVERAGE_CFLAGS)
+AM_CFLAGS=-Wall	$(COVERAGE_CFLAGS)			\
+  	$(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) $(LIBOSMOVTY_CFLAGS) \
+	$(LIBOSMOABIS_CFLAGS) $(LIBSMPP34_CFLAGS)
+
 AM_LDFLAGS = $(COVERAGE_LDFLAGS)
 
 bin_PROGRAMS = osmo-nitb
@@ -12,5 +15,6 @@
 		$(top_builddir)/src/libtrau/libtrau.a \
 		$(top_builddir)/src/libctrl/libctrl.a \
 		$(top_builddir)/src/libcommon/libcommon.a \
-		-ldbi -ldl $(LIBCRYPT) $(LIBOSMOGSM_LIBS) \
-		$(LIBOSMOVTY_LIBS) $(LIBOSMOABIS_LIBS) $(LIBOSMOCORE_LIBS)
+		-ldbi -ldl $(LIBCRYPT) 					   \
+		$(LIBOSMOGSM_LIBS) $(LIBOSMOVTY_LIBS) $(LIBOSMOCORE_LIBS)  \
+		$(LIBOSMOABIS_LIBS) $(LIBSMPP34_LIBS)
diff --git a/openbsc/src/osmo-nitb/bsc_hack.c b/openbsc/src/osmo-nitb/bsc_hack.c
index 7427ead..b82a026 100644
--- a/openbsc/src/osmo-nitb/bsc_hack.c
+++ b/openbsc/src/osmo-nitb/bsc_hack.c
@@ -312,7 +312,10 @@
 	/* start the SMS queue */
 	if (sms_queue_start(bsc_gsmnet, 20) != 0)
 		return -1;
-
+#ifdef BUILD_SMPP
+	if (smpp_openbsc_init(bsc_gsmnet, 6040) < 0)
+		return -1;
+#endif
 	if (daemonize) {
 		rc = osmo_daemonize();
 		if (rc < 0) {