diff --git a/openbsc/include/openbsc/abis_nm.h b/openbsc/include/openbsc/abis_nm.h
index bad7d1d..4b7e2ff 100644
--- a/openbsc/include/openbsc/abis_nm.h
+++ b/openbsc/include/openbsc/abis_nm.h
@@ -215,6 +215,15 @@
 	NM_MT_IPACC_RSL_CONNECT		= 0xe0,
 	NM_MT_IPACC_RSL_CONNECT_ACK,
 	NM_MT_IPACC_RSL_CONNECT_NACK,
+	NM_MT_IPACC_RSL_DISCONNECT	= 0xe3,
+	NM_MT_IPACC_RSL_DISCONNECT_ACK,
+	NM_MT_IPACC_RSL_DISCONNECT_NACK,
+	NM_MT_IPACC_CONN_TRAF		= 0xe6,
+	NM_MT_IPACC_CONN_TRAF_ACK,
+	NM_MT_IPACC_CONN_TRAF_NACK,
+	NM_MT_IPACC_DEF_BOOT_SW		= 0xec,
+	NM_MT_IPACC_DEF_BOOT_SW_ACK,
+	MN_MT_IPACC_DEF_BOOT_SW_NACK,
 	NM_MT_IPACC_SET_NVATTR		= 0xef,
 	NM_MT_IPACC_SET_NVATTR_ACK,
 	NM_MT_IPACC_SET_NVATTR_NACK,
@@ -351,11 +360,25 @@
 
 	NM_ATT_IPACC_RSL_BSC_IP		= 0x80,
 	NM_ATT_IPACC_RSL_BSC_PORT	= 0x81,
+	NM_ATT_IPACC_NV_FLAGS		= 0x86,
+	NM_ATT_IPACC_FREQ_CTRL		= 0x87,
+	NM_ATT_IPACC_IP_IF_CFG		= 0x8a,		/* IP interface */
+	NM_ATT_IPACC_IP_GW_CFG		= 0x8b,		/* IP gateway */
+	NM_ATT_IPACC_IN_SERV_TIME	= 0x8c,
 	NM_ATT_IPACC_LOCATION		= 0x8e,		/* string describing location */
 	NM_ATT_IPACC_UNIT_ID		= 0x91,		/* Site/BTS/TRX */
 	NM_ATT_IPACC_UNIT_NAME		= 0x93,		/* default: nbts-<mac-as-string> */
+	NM_ATT_IPACC_SNMP_CFG		= 0x94,
 	NM_ATT_IPACC_PRIM_OML_IP	= 0x95,
 	NM_ATT_IPACC_SEC_OML_IP		= 0x96,
+	NM_ATT_IPACC_CUR_SW_CFG		= 0x97,
+	
+	NM_ATT_IPACC_ALM_THRESH_LIST	= 0xa4,
+	NM_ATT_IPACC_UPTIME		= 0xab,
+	NM_ATT_IPACC_SSL_CFG		= 0xad,
+	NM_ATT_IPACC_SEC_POSSIBLE	= 0xae,
+	NM_ATT_IPACC_REVOC_DATE		= 0xb0,
+
 
 	NM_ATT_BS11_RF_RES_IND_PER	= 0x8f,
 	
@@ -543,6 +566,31 @@
 	BS11_STATE_ABIS_LOAD		= 0x13,
 };
 
+enum abis_nm_ipacc_test_no {
+	NM_IPACC_TESTNO_CHAN_USAGE	= 0x40,
+	NM_IPACC_TESTNO_BCCH_CHAN_USAGE	= 0x41,
+	NM_IPACC_TESTNO_FREQ_SYNC	= 0x42,
+	NM_IPACC_TESTNO_BCCH_INFO	= 0x43,
+	NM_IPACC_TESTNO_TX_BEACON	= 0x44,
+};
+
+/* first byte after length inside NM_ATT_TEST_REPORT */
+enum abis_nm_ipacc_test_res {
+	NM_IPACC_TESTRES_SUCCESS	= 0,
+	NM_IPACC_TESTRES_TIMEOUT	= 1,
+	NM_IPACC_TESTRES_NO_CHANS	= 2,
+	NM_IPACC_TESTRES_PARTIAL	= 3,
+	NM_IPACC_TESTRES_STOPPED	= 4,
+};
+
+/* internal IE inside NM_ATT_TEST_REPORT */
+enum abis_nm_ipacc_testres_ie {
+	NM_IPACC_TR_IE_FREQ_ERR_LIST	= 3,
+	NM_IPACC_TR_IE_CHAN_USAGE	= 4,
+	NM_IPACC_TR_IE_BCCH_INFO	= 6,
+	NM_IPACC_TR_IE_RESULT_DETAILS	= 8,
+	NM_IPACC_TR_IE_FREQ_ERR		= 18,
+};
 
 /* PUBLIC */
 
diff --git a/openbsc/include/openbsc/gsm_data.h b/openbsc/include/openbsc/gsm_data.h
index 9b4cf9d..af2e22c 100644
--- a/openbsc/include/openbsc/gsm_data.h
+++ b/openbsc/include/openbsc/gsm_data.h
@@ -415,7 +415,7 @@
 char *gsm_band_name(enum gsm_band band);
 enum gsm_band gsm_band_parse(int mhz);
 
-void *tall_bsc_ctx;
+extern void *tall_bsc_ctx;
 
 static inline int is_ipaccess_bts(struct gsm_bts *bts)
 {
diff --git a/openbsc/src/bsc_hack.c b/openbsc/src/bsc_hack.c
index 7e000ad..d2d0b06 100644
--- a/openbsc/src/bsc_hack.c
+++ b/openbsc/src/bsc_hack.c
@@ -49,8 +49,6 @@
 #include <openbsc/signal.h>
 #include <openbsc/talloc.h>
 
-void *tall_bsc_ctx;
-
 /* global pointer to the gsm network data structure */
 static struct gsm_network *gsmnet;
 
diff --git a/openbsc/src/gsm_data.c b/openbsc/src/gsm_data.c
index 81facdf..c21c6b4 100644
--- a/openbsc/src/gsm_data.c
+++ b/openbsc/src/gsm_data.c
@@ -27,6 +27,8 @@
 #include <openbsc/gsm_data.h>
 #include <openbsc/talloc.h>
 
+void *tall_bsc_ctx;
+
 void set_ts_e1link(struct gsm_bts_trx_ts *ts, u_int8_t e1_nr,
 		   u_int8_t e1_ts, u_int8_t e1_ts_ss)
 {
diff --git a/openbsc/src/ipaccess-find.c b/openbsc/src/ipaccess-find.c
index b3e9814..db78922 100644
--- a/openbsc/src/ipaccess-find.c
+++ b/openbsc/src/ipaccess-find.c
@@ -33,7 +33,7 @@
 	return idtag_names[tag];
 }
 
-static int udp_sock(void)
+static int udp_sock(char *local_ip)
 {
 	int fd, rc, bc = 1;
 	struct sockaddr_in sa;
@@ -45,7 +45,7 @@
 	sa.sin_family = AF_INET;
 	sa.sin_port = htons(3006);
 	sa.sin_addr.s_addr = INADDR_ANY;
-	inet_aton("192.168.100.11", &sa.sin_addr);
+	inet_aton(local_ip, &sa.sin_addr);
 
 	rc = bind(fd, (struct sockaddr *)&sa, sizeof(sa));
 	if (rc < 0)
@@ -149,16 +149,25 @@
 int main(int argc, char **argv)
 {
 	struct bsc_fd bfd;
+	char *local_ip;
 	int rc;
 
 	printf("ipaccess-find (C) 2009 by Harald Welte\n");
 	printf("This is FREE SOFTWARE with ABSOLUTELY NO WARRANTY\n\n");
 
+	if (argc < 2) {
+		fprintf(stderr, "please specify the _local_ IP address as argument\n");
+		exit(2);
+	}
+
+	local_ip = argv[1];
 	bfd.cb = bfd_cb;
 	bfd.when = BSC_FD_READ | BSC_FD_WRITE;
-	bfd.fd = udp_sock();
-	if (bfd.fd < 0)
-		exit(2);
+	bfd.fd = udp_sock(local_ip);
+	if (bfd.fd < 0) {
+		perror("Cannot create local socket for broadcast udp");
+		exit(1);
+	}
 
 	bsc_register_fd(&bfd);
 
diff --git a/wireshark/abis_oml.patch b/wireshark/abis_oml.patch
index 4b89916..e54868c 100644
--- a/wireshark/abis_oml.patch
+++ b/wireshark/abis_oml.patch
@@ -1,7 +1,7 @@
 Index: wireshark/epan/dissectors/Makefile.common
 ===================================================================
---- wireshark.orig/epan/dissectors/Makefile.common	2009-06-24 13:35:12.000000000 +0200
-+++ wireshark/epan/dissectors/Makefile.common	2009-06-24 13:35:54.000000000 +0200
+--- wireshark.orig/epan/dissectors/Makefile.common	2009-06-25 15:04:16.000000000 +0200
++++ wireshark/epan/dissectors/Makefile.common	2009-06-29 13:30:06.000000000 +0200
 @@ -874,6 +874,7 @@
  #
  DIRTY_DISSECTOR_SRC =	\
@@ -13,8 +13,8 @@
 Index: wireshark/epan/dissectors/packet-abis_oml.c
 ===================================================================
 --- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ wireshark/epan/dissectors/packet-abis_oml.c	2009-06-24 15:26:50.000000000 +0200
-@@ -0,0 +1,776 @@
++++ wireshark/epan/dissectors/packet-abis_oml.c	2009-07-01 17:39:35.000000000 +0200
+@@ -0,0 +1,1115 @@
 +/* packet-abis_oml.c
 + * Routines for packet dissection of GSM A-bis over IP (3GPP TS 12.21)
 + * Copyright 2009 by Harald Welte <laforge@gnumonks.org>
@@ -51,6 +51,7 @@
 +#include <epan/emem.h>
 +
 +#include "packet-abis_oml.h"
++#include "packet-gsm_a_common.h"
 +
 +/* initialize the protocol and registered fields */
 +static int proto_abis_oml = -1;
@@ -75,6 +76,31 @@
 +static int hf_attr_avail_state = -1;
 +static int hf_attr_event_type = -1;
 +static int hf_attr_severity = -1;
++static int hf_attr_bcch_arfcn = -1;
++static int hf_attr_bsic = -1;
++static int hf_attr_test_no = -1;
++static int hf_attr_tsc = -1;
++static int hf_attr_tei = -1;
++static int hf_attr_ach_btsp = -1;
++static int hf_attr_ach_tslot = -1;
++static int hf_attr_ach_sslot = -1;
++static int hf_attr_gsm_time = -1;
++static int hf_attr_chan_comb = -1;
++/* Ipaccess */
++static int hf_oml_ipa_tres_attr_tag = -1;
++static int hf_oml_ipa_tres_attr_len = -1;
++static int hf_attr_ipa_test_res = -1;
++static int hf_attr_ipa_tr_rxlev = -1;
++static int hf_attr_ipa_tr_arfcn = -1;
++static int hf_attr_ipa_tr_f_qual = -1;
++static int hf_attr_ipa_tr_f_err = -1;
++static int hf_attr_ipa_tr_rxqual = -1;
++static int hf_attr_ipa_tr_frame_offs = -1;
++static int hf_attr_ipa_tr_framenr_offs = -1;
++static int hf_attr_ipa_tr_bsic = -1;
++static int hf_attr_ipa_tr_cell_id = -1;
++static int hf_attr_ipa_rsl_ip = -1;
++static int hf_attr_ipa_rsl_port = -1;
 +
 +/* initialize the subtree pointers */
 +static int ett_oml = -1;
@@ -204,6 +230,15 @@
 +	{ NM_MT_IPACC_RSL_CONNECT,	"IPA RSL Connect" },
 +	{ NM_MT_IPACC_RSL_CONNECT_ACK,	"IPA RSL Connect ACK" },
 +	{ NM_MT_IPACC_RSL_CONNECT_NACK,	"IPA RSL Connect NACK" },
++	{ NM_MT_IPACC_RSL_DISCONNECT,	"IPA RSL Disconnect" },
++	{ NM_MT_IPACC_RSL_DISCONNECT_ACK, "IPA RSL Disconnect ACK" },
++	{ NM_MT_IPACC_RSL_DISCONNECT_NACK, "IPA RSL Disconnect NACK" },
++	{ NM_MT_IPACC_CONN_TRAF,	"IPA Connect Traffic" },
++	{ NM_MT_IPACC_CONN_TRAF_ACK,	"IPA Connect Traffic ACK" },
++	{ NM_MT_IPACC_CONN_TRAF_NACK,	"IPA Connect Traffic NACK" },
++	{ NM_MT_IPACC_DEF_BOOT_SW,	"IPA Default Boot Software" },
++	{ NM_MT_IPACC_DEF_BOOT_SW_ACK,	"IPA Default Boot Software ACK" },
++	{ NM_MT_IPACC_DEF_BOOT_SW_NACK,	"IPA Default Boot Software NACK" },
 +	{ NM_MT_IPACC_SET_NVATTR,	"IPA Set NVRAM Attributes" },
 +	{ NM_MT_IPACC_SET_NVATTR_ACK,	"IPA Set NVRAM Attributes ACK" },
 +	{ NM_MT_IPACC_SET_NVATTR_NACK,	"IPA Set NVRAM Attributes NACK" },
@@ -286,6 +321,7 @@
 +	{ NM_ATT_HW_CONFIG,		"HW Configuration" },
 +	{ NM_ATT_HW_DESC,		"HW Description" },
 +	{ NM_ATT_INTAVE_PARAM,		"Intave Parameter" },
++	{ NM_ATT_INTERF_BOUND,		"Interference Boundaries" },
 +	{ NM_ATT_LIST_REQ_ATTR,		"List of required Attributes" },
 +	{ NM_ATT_MAIO,			"MAIO" },
 +	{ NM_ATT_MANUF_STATE,		"Manufacturer Dependent State" },
@@ -348,11 +384,23 @@
 +	{ NM_ATT_BS11_FACCH_QUAL,	"SIE FACCH Quality" },
 +	{ NM_ATT_IPACC_RSL_BSC_IP,	"IPA BSC RSL IP Address" },
 +	{ NM_ATT_IPACC_RSL_BSC_PORT,	"IPA BSC RSL TCP Port" },
++	{ NM_ATT_IPACC_NV_FLAGS,	"IPA NVRAM Flags" },
++	{ NM_ATT_IPACC_FREQ_CTRL,	"IPA Frequency Control" },
++	{ NM_ATT_IPACC_IP_IF_CFG,	"IPA IP Interface Config" },
++	{ NM_ATT_IPACC_IP_GW_CFG,	"IPA IP Gateway Config" },
++	{ NM_ATT_IPACC_IN_SERV_TIME,	"IPA In Service Time" },
 +	{ NM_ATT_IPACC_LOCATION,	"IPA Location Name" },
 +	{ NM_ATT_IPACC_UNIT_ID,		"IPA Unit ID" },
 +	{ NM_ATT_IPACC_UNIT_NAME,	"IPA Unit Name" },
++	{ NM_ATT_IPACC_SNMP_CFG,	"IPA SNMP Config" },
 +	{ NM_ATT_IPACC_PRIM_OML_IP,	"IPA Primary OML IP Address" },
 +	{ NM_ATT_IPACC_SEC_OML_IP,	"IPA Secondary OML IP Address" },
++	{ NM_ATT_IPACC_CUR_SW_CFG,	"IPA Current Software Config" },
++	{ NM_ATT_IPACC_ALM_THRESH_LIST,	"IPA Alarm Threshold List" },
++	{ NM_ATT_IPACC_UPTIME,		"IPA Uptime" },
++	{ NM_ATT_IPACC_SSL_CFG,		"IPA SSL Configuration" },
++	{ NM_ATT_IPACC_SEC_POSSIBLE,	"IPA Security Possoble" },
++	{ NM_ATT_IPACC_REVOC_DATE,	"IPA Revocation Date" },
 +	/* FIXME: More SIE */
 +};
 +
@@ -451,6 +499,124 @@
 +	{ 0xff,				"NULL" },
 +};
 +
++static const value_string oml_test_no_vals[] = {
++	{ NM_IPACC_TESTNO_CHAN_USAGE,	"Channel Usage" },
++	{ NM_IPACC_TESTNO_BCCH_CHAN_USAGE, "BCCH Channel Usage" },
++	{ NM_IPACC_TESTNO_FREQ_SYNC,	"Frequency Synchronization" },
++	{ NM_IPACC_TESTNO_BCCH_INFO,	"BCCH Information" },
++	{ NM_IPACC_TESTNO_TX_BEACON,	"Tx Beacon" },
++};
++
++static const value_string ipacc_test_res_vals[] = {
++	{ NM_IPACC_TESTRES_SUCCESS,	"Success" },
++	{ NM_IPACC_TESTRES_TIMEOUT,	"Timeout" },
++	{ NM_IPACC_TESTRES_NO_CHANS,	"No suitable channels available" },
++	{ NM_IPACC_TESTRES_PARTIAL,	"Partial" },
++	{ NM_IPACC_TESTRES_STOPPED,	"Stopped" },
++};
++
++static const value_string ipacc_testres_ie_vals[] = {
++	{ NM_IPACC_TR_IE_FREQ_ERR_LIST,	"Frequency Error List" },
++	{ NM_IPACC_TR_IE_CHAN_USAGE,	"Channel Usage" },
++	{ NM_IPACC_TR_IE_BCCH_INFO,	"BCCH Information" },
++	{ NM_IPACC_TR_IE_RESULT_DETAILS,"Result Details" },
++	{ NM_IPACC_TR_IE_FREQ_ERR,	"Frequency Error" },
++};
++
++/* Parse the ip.access specific BCCH Information IE embedded into the Test
++ * Report IE */
++static gint
++ipacc_tr_ie_bcch(tvbuff_t *tvb, proto_tree *att_tree, int offset)
++{
++	guint16 binfo_type = tvb_get_ntohs(tvb, offset);
++	guint16 tmp = tvb_get_ntohs(tvb, offset+2);
++
++	/* FIXME: there are still some bugs remaining here */
++	proto_tree_add_item(att_tree, hf_attr_ipa_tr_arfcn,
++			    tvb, offset, 2, TRUE);
++	proto_tree_add_item(att_tree, hf_attr_ipa_tr_f_qual,
++			    tvb, offset, 2, TRUE);
++	offset += 2;
++	proto_tree_add_item(att_tree, hf_attr_ipa_tr_rxlev,
++			    tvb, offset++, 1, TRUE);
++	proto_tree_add_item(att_tree, hf_attr_ipa_tr_rxqual,
++			    tvb, offset++, 1, TRUE);
++	proto_tree_add_item(att_tree, hf_attr_ipa_tr_f_err,
++			    tvb, offset, 2, TRUE);
++	offset += 2;
++	proto_tree_add_item(att_tree, hf_attr_ipa_tr_frame_offs,
++			    tvb, offset, 2, TRUE);
++	offset += 2;
++	proto_tree_add_item(att_tree, hf_attr_ipa_tr_framenr_offs,
++			    tvb, offset, 4, TRUE);
++	offset += 4;
++	proto_tree_add_item(att_tree, hf_attr_ipa_tr_bsic,
++			    tvb, offset++, 1, TRUE);
++	de_lai(tvb, att_tree, offset, 5, NULL, 0);
++	offset += 5;
++	proto_tree_add_item(att_tree, hf_attr_ipa_tr_cell_id,
++			    tvb, offset, 2, TRUE);
++	offset += 2;
++	/* FIXME: parse GSM 04.18 IE's */
++
++	return offset;
++}
++
++/* Parse the ip.access specific Channel Usage IE embedded into the Test
++ * Report IE */
++static gint
++ipacc_tr_ie_chan_usage(tvbuff_t *tvb, proto_tree *att_tree, int offset)
++{
++	while (tvb_reported_length_remaining(tvb, offset) != 0) {
++		guint16 result = tvb_get_ntohs(tvb, offset);
++		proto_tree_add_uint(att_tree, hf_attr_ipa_tr_arfcn,
++				    tvb, offset, 2, result);
++		proto_tree_add_uint(att_tree, hf_attr_ipa_tr_rxlev,
++				    tvb, offset, 2, result);
++		offset += 2;
++	}
++	return offset;
++}
++
++/* Parse the ip.access specific format of the standard test report IE */
++static gint
++dissect_ipacc_test_rep(proto_tree *tree, tvbuff_t *tvb)
++{
++	gint offset = 0;
++	guint8 test_res = tvb_get_guint8(tvb, offset);
++
++	proto_tree_add_item(tree, hf_attr_ipa_test_res, tvb, offset++,
++			    1, FALSE);
++
++	while (tvb_reported_length_remaining(tvb, offset) != 0) {
++		guint8 ie = tvb_get_guint8(tvb, offset);
++		guint16 len = tvb_get_ntohs(tvb, offset+1);
++		proto_item *ti;
++		proto_tree *att_tree;
++
++		ti = proto_tree_add_item(tree, hf_oml_ipa_tres_attr_tag, tvb,
++					 offset++, 1, FALSE);
++		att_tree = proto_item_add_subtree(ti, ett_oml_fom_att);
++		proto_tree_add_uint(att_tree, hf_oml_ipa_tres_attr_len, tvb,
++				    offset, 2, len);
++		offset += 2;
++
++		switch (ie) {
++		case NM_IPACC_TR_IE_CHAN_USAGE:
++			offset = ipacc_tr_ie_chan_usage(tvb,
++						 	att_tree, offset);
++			break;
++		case NM_IPACC_TR_IE_BCCH_INFO:
++			offset = ipacc_tr_ie_bcch(tvb,
++						  att_tree, offset);
++			break;
++		default:
++			break;
++		}
++	}
++}
++
++/* Dissect OML FOM Attributes after OML + FOM header */
 +static gint
 +dissect_oml_attrs(tvbuff_t *tvb, int base_offs, packet_info *pinfo,
 +		  proto_tree *tree)
@@ -459,11 +625,11 @@
 +
 +	while (tvb_reported_length_remaining(tvb, offset) != 0) {
 +		guint8 tag, val8;
-+		guint16 val16;
 +		unsigned int len, len_len, hlen;
-+		struct tlv_def *tdef;
++		const struct tlv_def *tdef;
 +		proto_item *ti;
 +		proto_tree *att_tree;
++		tvbuff_t *sub_tvb;
 +
 +		tag = tvb_get_guint8(tvb, offset);
 +		tdef = &nm_att_tlvdef.def[tag];
@@ -504,9 +670,17 @@
 +				    offset+1, len_len, len);
 +		offset += hlen;
 +
++		sub_tvb = tvb_new_subset(tvb, offset, len, len);
++
 +		switch (tag) {
 +		/* parse only the most common IE for now */
 +		case NM_ATT_ABIS_CHANNEL:
++			proto_tree_add_item(att_tree, hf_attr_ach_btsp, tvb,
++					    offset, 1, TRUE);
++			proto_tree_add_item(att_tree, hf_attr_ach_tslot, tvb,
++					    offset+1, 1, TRUE);
++			proto_tree_add_item(att_tree, hf_attr_ach_sslot, tvb,
++					    offset+2, 1, TRUE);
 +			break;
 +		case NM_ATT_ADM_STATE:
 +			proto_tree_add_item(att_tree, hf_attr_adm_state, tvb,
@@ -538,22 +712,24 @@
 +
 +			break;
 +		case NM_ATT_BCCH_ARFCN:
++			proto_tree_add_item(att_tree, hf_attr_bcch_arfcn, tvb,
++					    offset, len, TRUE);
 +			break;
 +		case NM_ATT_BSIC:
++			proto_tree_add_item(att_tree, hf_attr_bsic, tvb,
++					    offset, len, TRUE);
 +			break;
 +		case NM_ATT_CHAN_COMB:
++			proto_tree_add_item(att_tree, hf_attr_chan_comb, tvb,
++					    offset, len, TRUE);
 +			break;
 +		case NM_ATT_EVENT_TYPE:
 +			proto_tree_add_item(att_tree, hf_attr_event_type, tvb,
-+					    offset, len, FALSE);
-+			break;
-+		case NM_ATT_FILE_ID:
-+			break;
-+		case NM_ATT_FILE_VERSION:
++					    offset, len, TRUE);
 +			break;
 +		case NM_ATT_GSM_TIME:
-+			break;
-+		case NM_ATT_MANUF_STATE:
++			proto_tree_add_item(att_tree, hf_attr_gsm_time, tvb,
++					    offset, len, TRUE);
 +			break;
 +		case NM_ATT_OPER_STATE:
 +			proto_tree_add_item(att_tree, hf_attr_oper_state, tvb,
@@ -567,18 +743,40 @@
 +			}
 +			break;
 +		case NM_ATT_TEI:
++			proto_tree_add_item(att_tree, hf_attr_tei, tvb,
++					    offset, len, TRUE);
 +			break;
 +		case NM_ATT_TSC:
++			proto_tree_add_item(att_tree, hf_attr_tsc, tvb,
++					    offset, len, TRUE);
 +			break;
 +		case NM_ATT_SEVERITY:
 +			proto_tree_add_item(att_tree, hf_attr_severity, tvb,
-+					    offset, len, FALSE);
++					    offset, len, TRUE);
++			break;
++		case NM_ATT_TEST_REPORT:
++			dissect_ipacc_test_rep(att_tree, sub_tvb);
++			break;
++		case NM_ATT_TEST_NO:
++			proto_tree_add_item(att_tree, hf_attr_test_no, tvb,
++					    offset, len, TRUE);
++			if (check_col(pinfo->cinfo, COL_INFO)) {
++				val8 = tvb_get_guint8(tvb, offset);
++				col_append_fstr(pinfo->cinfo, COL_INFO, "%s ",
++						val_to_str(val8,
++							   oml_test_no_vals,
++							   "%02x"));
++			}
 +			break;
 +
 +		/* proprietary ip.access extensions */
 +		case NM_ATT_IPACC_RSL_BSC_IP:
++			proto_tree_add_item(att_tree, hf_attr_ipa_rsl_ip, tvb,
++					    offset, len, TRUE);
 +			break;
 +		case NM_ATT_IPACC_RSL_BSC_PORT:
++			proto_tree_add_item(att_tree, hf_attr_ipa_rsl_port, tvb,
++					    offset, len, TRUE);
 +			break;
 +		case NM_ATT_IPACC_LOCATION:
 +			break;
@@ -632,13 +830,25 @@
 +	return offset;
 +}
 +
++static const guint8 ipaccess_magic[] = "com.ipaccess";
++
++static int
++dissect_oml_manuf(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset)
++{
++	if (tvb_get_guint8(tvb, offset) != 0x0d ||
++	    tvb_memeql(tvb, offset+1, ipaccess_magic, sizeof(ipaccess_magic)))
++		return offset;
++
++	offset += sizeof(ipaccess_magic) + 1;
++
++	return dissect_oml_fom(tvb, pinfo, tree, offset);
++}
 +
 +static void
 +dissect_abis_oml(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 +{
 +	proto_item *ti;
 +	proto_tree *oml_tree;
-+	guint8 msg_type;
 +
 +	int offset = 0;
 +
@@ -656,18 +866,24 @@
 +		ti = proto_tree_add_item(tree, proto_abis_oml, tvb, 0, -1, FALSE);
 +		oml_tree = proto_item_add_subtree(ti, ett_oml);
 +
-+		proto_tree_add_item(oml_tree, hf_oml_msg_disc, tvb, offset++, 1, FALSE);
-+		proto_tree_add_item(oml_tree, hf_oml_placement, tvb, offset++, 1, FALSE);
-+		proto_tree_add_item(oml_tree, hf_oml_sequence, tvb, offset++, 1, FALSE);
-+		proto_tree_add_item(oml_tree, hf_oml_length, tvb, offset++, 1, FALSE);
++		proto_tree_add_item(oml_tree, hf_oml_msg_disc, tvb, offset++,
++				    1, TRUE);
++		proto_tree_add_item(oml_tree, hf_oml_placement, tvb, offset++,
++				    1, TRUE);
++		proto_tree_add_item(oml_tree, hf_oml_sequence, tvb, offset++,
++				    1, TRUE);
++		proto_tree_add_item(oml_tree, hf_oml_length, tvb, offset++,
++				    1, TRUE);
 +
 +		switch (msg_disc) {
 +		case ABIS_OM_MDISC_FOM:
 +			offset = dissect_oml_fom(tvb, pinfo, oml_tree, offset);
 +			break;
++		case ABIS_OM_MDISC_MANUF:
++			offset = dissect_oml_manuf(tvb, pinfo, oml_tree, offset);
++			break;
 +		case ABIS_OM_MDISC_MMI:
 +		case ABIS_OM_MDISC_TRAU:
-+		case ABIS_OM_MDISC_MANUF:
 +		default:
 +			break;
 +		}
@@ -767,6 +983,129 @@
 +			  FT_UINT8, BASE_HEX, VALS(oml_severity_vals), 0,
 +			  "Severity", HFILL }
 +		},
++		{ &hf_attr_bcch_arfcn,
++			{ "BCCH ARFCN", "oml.fom.attr.bcch_arfcn",
++			  FT_UINT16, BASE_DEC, NULL, 0,
++			  "ARFCN of the BCCH", HFILL }
++		},
++		{ &hf_attr_bsic,
++			{ "BSIC", "oml.fom.attr.bsic",
++			  FT_UINT16, BASE_HEX, NULL, 0,
++			  "Base Station Identity Cdoe", HFILL }
++		},
++		{ &hf_attr_test_no,
++			{ "Test Number", "oml.fom.attr.test_no",
++			  FT_UINT8, BASE_HEX, VALS(oml_test_no_vals), 0,
++			  "Test Number", HFILL }
++		},
++		{ &hf_attr_tsc,
++			{ "TSC", "oml.fom.attr.tsc",
++			  FT_UINT8, BASE_HEX, NULL, 0,
++			  "Training Sequence Code", HFILL }
++		},
++		{ &hf_attr_tei,
++			{ "TEI", "oml.fom.attr.tei",
++			  FT_UINT8, BASE_DEC, NULL, 0,
++			  "TEI", HFILL }
++		},
++		{ &hf_attr_ach_btsp,
++			{ "BTS Port", "oml.fom.attr.abis_ch.bts_port",
++			  FT_UINT8, BASE_DEC, NULL, 0,
++			  "BTS Port", HFILL }
++		},
++		{ &hf_attr_ach_tslot,
++			{ "Timeslot", "oml.fom.attr.abis_ch.timeslot",
++			  FT_UINT8, BASE_DEC, NULL, 0,
++			  "Time Slot", HFILL }
++		},
++		{ &hf_attr_ach_sslot,
++			{ "Subslot", "oml.fom.attr.abis_ch.subslot",
++			  FT_UINT8, BASE_DEC, NULL, 0,
++			  "Subslot", HFILL }
++		},
++		{ &hf_attr_gsm_time,
++			{ "GSM Time", "oml.fom.attr.gsm_time",
++			  FT_UINT16, BASE_DEC, NULL, 0,
++			  "GSM Time", HFILL }
++		},
++		{ &hf_attr_chan_comb,
++			{ "Channel Combination", "oml.fom.attr.chan_comb",
++			  FT_UINT8, BASE_HEX, VALS(oml_chan_comb_vals), 0,
++			  "Channel Combination", HFILL }
++		},
++		/* IP Access */
++		{ &hf_oml_ipa_tres_attr_tag,
++			{ "IPA Test Result Embedded IE",
++						"oml.fom.testrep.ipa_tag",
++			  FT_UINT8, BASE_HEX, VALS(ipacc_testres_ie_vals), 0,
++			  "IPA Test Result Embedded IE", HFILL },
++		},
++		{ &hf_oml_ipa_tres_attr_len,
++			{ "IPA Test Result Embedded IE Length",
++						"oml.fom.testrep.ipa_len",
++			  FT_UINT16, BASE_DEC, NULL, 0,
++			  "IPA Test Result Embedded IE Length", HFILL }
++		},
++		{ &hf_attr_ipa_test_res,
++			{ "IPA Test Result", "oml.fom.testrep.result",
++			  FT_UINT8, BASE_DEC, VALS(ipacc_test_res_vals), 0,
++			  "IPA Test Result", HFILL }
++		},
++		{ &hf_attr_ipa_tr_rxlev,
++			{ "Rx Level", "oml.fom.testrep.ipa_rxlev",
++			  FT_UINT16, BASE_DEC, NULL, 0xfc00,
++			  "Rx Level", HFILL }
++		},
++		{ &hf_attr_ipa_tr_arfcn,
++			{ "ARFCN", "oml.fom.testrep.ipa_arfcn",
++			  FT_UINT16, BASE_DEC, NULL, 0x03ff,
++			  "ARFCN", HFILL }
++		},
++		{ &hf_attr_ipa_tr_f_qual,
++			{ "Frequency Quality", "oml.fom.testrep.ipa.freq_qual",
++			  FT_UINT8, BASE_DEC, NULL, 0xfc,
++			  "Frequency Quality", HFILL }
++		},
++		{ &hf_attr_ipa_tr_f_err,
++			{ "Frequency Error", "oml.fom.testrep.ipa.freq_err",
++			  FT_UINT16, BASE_DEC, NULL, 0,
++			  "Frequency Error", HFILL }
++		},
++		{ &hf_attr_ipa_tr_rxqual,
++			{ "Rx Quality", "oml.fom.testrep.ipa.rx_qual",
++			  FT_UINT8, BASE_DEC, NULL, 0x7,
++			  "Rx Quality", HFILL }
++		},
++		{ &hf_attr_ipa_tr_frame_offs,
++			{ "Frame Offset", "oml.fom.testrep.ipa.frame_offset",
++			  FT_UINT16, BASE_DEC, NULL, 0,
++			  "Frame Offset", HFILL }
++		},
++		{ &hf_attr_ipa_tr_framenr_offs,
++			{ "Frame Number Offset", "oml.fom.testrep.ipa.framenr_offset",
++			  FT_UINT32, BASE_DEC, NULL, 0,
++			  "Frame Number Offset", HFILL }
++		},
++		{ &hf_attr_ipa_tr_bsic,
++			{ "BSIC", "oml.fom.testrep.ipa.bsic",
++			  FT_UINT8, BASE_DEC, NULL, 0x3f,
++			  "Base Station Identity Code", HFILL }
++		},
++		{ &hf_attr_ipa_tr_cell_id,
++			{ "Cell ID", "oml.fom.testrep.ipa.cell_id",
++			  FT_UINT16, BASE_HEX, NULL, 0,
++			  "Cell ID", HFILL }
++		},
++		{ &hf_attr_ipa_rsl_ip,
++			{ "BSC RSL IP Address", "oml.fom.attr.ipa.rsl_ip",
++			  FT_IPv4, BASE_NONE, NULL, 0,
++			  "BSC RSL IP Address", HFILL }
++		},
++		{ &hf_attr_ipa_rsl_port,
++			{ "BSC RSL TCP Port", "oml.fom.attr.ipa.rsl_port",
++			  FT_UINT16, BASE_DEC, NULL, 0,
++			  "BSC RSL TCP Port", HFILL }
++		},
 +	};
 +	static gint *ett[] = {
 +		&ett_oml,
@@ -794,8 +1133,8 @@
 Index: wireshark/epan/dissectors/packet-abis_oml.h
 ===================================================================
 --- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ wireshark/epan/dissectors/packet-abis_oml.h	2009-06-24 13:35:54.000000000 +0200
-@@ -0,0 +1,665 @@
++++ wireshark/epan/dissectors/packet-abis_oml.h	2009-07-01 11:27:15.000000000 +0200
+@@ -0,0 +1,714 @@
 +/* GSM Network Management messages on the A-bis interface
 + * 3GPP TS 12.21 version 8.0.0 Release 1999 / ETSI TS 100 623 V8.0.0 */
 +
@@ -1011,6 +1350,15 @@
 +	NM_MT_IPACC_RSL_CONNECT		= 0xe0,
 +	NM_MT_IPACC_RSL_CONNECT_ACK,
 +	NM_MT_IPACC_RSL_CONNECT_NACK,
++	NM_MT_IPACC_RSL_DISCONNECT	= 0xe3,
++	NM_MT_IPACC_RSL_DISCONNECT_ACK,
++	NM_MT_IPACC_RSL_DISCONNECT_NACK,
++	NM_MT_IPACC_CONN_TRAF		= 0xe6,
++	NM_MT_IPACC_CONN_TRAF_ACK,
++	NM_MT_IPACC_CONN_TRAF_NACK,
++	NM_MT_IPACC_DEF_BOOT_SW		= 0xec,
++	NM_MT_IPACC_DEF_BOOT_SW_ACK,
++	NM_MT_IPACC_DEF_BOOT_SW_NACK,
 +	NM_MT_IPACC_SET_NVATTR		= 0xef,
 +	NM_MT_IPACC_SET_NVATTR_ACK,
 +	NM_MT_IPACC_SET_NVATTR_NACK,
@@ -1147,11 +1495,25 @@
 +
 +	NM_ATT_IPACC_RSL_BSC_IP		= 0x80,
 +	NM_ATT_IPACC_RSL_BSC_PORT	= 0x81,
++	NM_ATT_IPACC_NV_FLAGS		= 0x86,
++	NM_ATT_IPACC_FREQ_CTRL		= 0x87,
++	NM_ATT_IPACC_IP_IF_CFG		= 0x8a,		/* IP interface */
++	NM_ATT_IPACC_IP_GW_CFG		= 0x8b,		/* IP gateway */
++	NM_ATT_IPACC_IN_SERV_TIME	= 0x8c,
 +	NM_ATT_IPACC_LOCATION		= 0x8e,		/* string describing location */
 +	NM_ATT_IPACC_UNIT_ID		= 0x91,		/* Site/BTS/TRX */
 +	NM_ATT_IPACC_UNIT_NAME		= 0x93,		/* default: nbts-<mac-as-string> */
++	NM_ATT_IPACC_SNMP_CFG		= 0x94,
 +	NM_ATT_IPACC_PRIM_OML_IP	= 0x95,
 +	NM_ATT_IPACC_SEC_OML_IP		= 0x96,
++	NM_ATT_IPACC_CUR_SW_CFG		= 0x97,
++
++	NM_ATT_IPACC_ALM_THRESH_LIST	= 0xa4,
++	NM_ATT_IPACC_UPTIME		= 0xab,
++	NM_ATT_IPACC_SSL_CFG		= 0xad,
++	NM_ATT_IPACC_SEC_POSSIBLE	= 0xae,
++	NM_ATT_IPACC_REVOC_DATE		= 0xb0,
++
 +
 +	NM_ATT_BS11_RF_RES_IND_PER	= 0x8f,
 +
@@ -1357,6 +1719,31 @@
 +	struct tlv_def def[0xff];
 +};
 +
++enum abis_nm_ipacc_test_no {
++	NM_IPACC_TESTNO_CHAN_USAGE	= 0x40,
++	NM_IPACC_TESTNO_BCCH_CHAN_USAGE	= 0x41,
++	NM_IPACC_TESTNO_FREQ_SYNC	= 0x42,
++	NM_IPACC_TESTNO_BCCH_INFO	= 0x43,
++	NM_IPACC_TESTNO_TX_BEACON	= 0x44,
++};
++
++/* first byte after length inside NM_ATT_TEST_REPORT */
++enum abis_nm_ipacc_test_res {
++	NM_IPACC_TESTRES_SUCCESS	= 0,
++	NM_IPACC_TESTRES_TIMEOUT	= 1,
++	NM_IPACC_TESTRES_NO_CHANS	= 2,
++	NM_IPACC_TESTRES_PARTIAL	= 3,
++	NM_IPACC_TESTRES_STOPPED	= 4,
++};
++
++/* internal IE inside NM_ATT_TEST_REPORT */
++enum abis_nm_ipacc_testres_ie {
++	NM_IPACC_TR_IE_FREQ_ERR_LIST	= 3,
++	NM_IPACC_TR_IE_CHAN_USAGE	= 4,
++	NM_IPACC_TR_IE_BCCH_INFO	= 6,
++	NM_IPACC_TR_IE_RESULT_DETAILS	= 8,
++	NM_IPACC_TR_IE_FREQ_ERR		= 18,
++};
 +
 +/* From openbsc/src/abis_nm.c */
 +static const struct tlv_definition nm_att_tlvdef = {
@@ -1455,6 +1842,7 @@
 +		[NM_ATT_IPACC_RSL_BSC_PORT] =	{ TLV_TYPE_FIXED, 2 },
 +		[NM_ATT_IPACC_PRIM_OML_IP] =	{ TLV_TYPE_FIXED, 6 },
 +		[0x95] =			{ TLV_TYPE_FIXED, 2 },
++		[0x9b] =			{ TLV_TYPE_TL16V },
 +		[0x85] =			{ TLV_TYPE_TV },
 +
 +	},
diff --git a/wireshark/rsl-ipaccess.patch b/wireshark/rsl-ipaccess.patch
index 030f07e..b893faa 100644
--- a/wireshark/rsl-ipaccess.patch
+++ b/wireshark/rsl-ipaccess.patch
@@ -1,7 +1,7 @@
 Index: wireshark/epan/dissectors/packet-rsl.c
 ===================================================================
---- wireshark.orig/epan/dissectors/packet-rsl.c	2009-02-22 15:39:34.000000000 +0100
-+++ wireshark/epan/dissectors/packet-rsl.c	2009-02-22 17:27:51.000000000 +0100
+--- wireshark.orig/epan/dissectors/packet-rsl.c	2009-02-28 15:39:56.000000000 +0100
++++ wireshark/epan/dissectors/packet-rsl.c	2009-06-26 15:51:00.000000000 +0200
 @@ -2,6 +2,7 @@
   * Routines for Radio Signalling Link (RSL) dissection.
   *
@@ -10,7 +10,16 @@
   *
   * $Id: packet-rsl.c 27065 2008-12-20 00:09:02Z wmeier $
   *
-@@ -116,6 +117,14 @@
+@@ -44,6 +45,8 @@
+ #include <epan/lapd_sapi.h>
+ 
+ #include "packet-gsm_a_common.h"
++#include "packet-rtp.h"
++#include "packet-rtcp.h"
+ 
+ /* Initialize the protocol and registered fields */
+ static int proto_rsl		= -1;
+@@ -116,6 +119,14 @@
  static int hf_rsl_rtd				= -1;
  static int hf_rsl_delay_ind			= -1;
  static int hf_rsl_tfo				= -1;
@@ -25,7 +34,7 @@
  
  /* Initialize the subtree pointers */
  static int ett_rsl = -1;
-@@ -173,6 +182,15 @@
+@@ -173,6 +184,15 @@
  static int ett_ie_meas_res_no = -1;
  static int ett_ie_message_id = -1;
  static int ett_ie_sys_info_type = -1;
@@ -41,7 +50,7 @@
  
  proto_tree *top_tree;
  dissector_handle_t gsm_a_ccch_handle;
-@@ -208,8 +226,11 @@
+@@ -208,8 +228,11 @@
  	{  0x06,		"Common Channel Management messages" },
  	{  0x08,		"TRX Management messages" },
  	{  0x16,		"Location Services messages" },
@@ -53,7 +62,29 @@
  /*
   * 9.2 MESSAGE TYPE
   */
-@@ -338,6 +359,14 @@
+@@ -276,6 +299,21 @@
+ 	/* 	0 1 - - - - - - Location Services messages: */
+ #define RSL_MSG_LOC_INF					65	/* 8.7.1 */
+ 
++/* Vendor-Specific messages of ip.access nanoBTS. There is no public documentation
++ * about those extensions, all information in this dissector is based on lawful
++ * protocol reverse enginering by Harald Welte <laforge@gnumonks.org> */
++#define RSL_MSG_TYPE_IPAC_BIND		0x70
++#define RSL_MSG_TYPE_IPAC_BIND_ACK	0x71
++#define RSL_MSG_TYPE_IPAC_BIND_NACK	0x72
++#define RSL_MSG_TYPE_IPAC_CONNECT	0x73
++#define RSL_MSG_TYPE_IPAC_CONNECT_ACK	0x74
++#define RSL_MSG_TYPE_IPAC_CONNECT_NACK	0x75
++#define RSL_MSG_TYPE_IPAC_DISC_IND	0x76
++
++#define RSL_IE_IPAC_REMOTE_IP		0xf0
++#define RSL_IE_IPAC_REMOTE_PORT		0xf1
++#define RSL_IE_IPAC_LOCAL_PORT		0xf3
++#define RSL_IE_IPAC_LOCAL_IP		0xf5
+ 
+ static const value_string rsl_msg_type_vals[] = {
+ 	  /* 	0 0 0 0 - - - - Radio Link Layer Management messages: */
+@@ -338,6 +376,14 @@
  	{  0x3f,	"TFO MODification REQuest" },					/* 8.4.31 */
  	/* 	0 1 - - - - - - Location Services messages: */
  	{  0x41,	"Location Information" },						/* 8.7.1 */
@@ -68,7 +99,7 @@
  	{ 0,		NULL }
  };
  
-@@ -477,6 +506,10 @@
+@@ -477,6 +523,10 @@
  			Not used
  
  	*/
@@ -79,7 +110,103 @@
  	{ 0,			NULL }
  };
  
-@@ -2043,7 +2076,6 @@
+@@ -513,6 +563,95 @@
+ 	{ 0,			NULL }
+ };
+ 
++/* From openbsc/include/openbsc/tlv.h */
++enum tlv_type {
++	TLV_TYPE_FIXED,
++	TLV_TYPE_T,
++	TLV_TYPE_TV,
++	TLV_TYPE_TLV,
++	TLV_TYPE_TL16V,
++};
++
++struct tlv_def {
++	enum tlv_type type;
++	u_int8_t fixed_len;
++};
++
++struct tlv_definition {
++	struct tlv_def def[0xff];
++};
++
++static const struct tlv_definition rsl_att_tlvdef = {
++	.def = {
++		[RSL_IE_CH_NO]			= { TLV_TYPE_TV, 0 },
++		[RSL_IE_LINK_ID]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_ACT_TYPE]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_BS_POW]			= { TLV_TYPE_TV, 0 },
++		[RSL_IE_CH_ID]			= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_CH_MODE]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_ENC_INF]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_FRAME_NO]		= { TLV_TYPE_FIXED, 2 },
++		[RSL_IE_HO_REF]			= { TLV_TYPE_TV, 0 },
++		[RSL_IE_L1_INF]			= { TLV_TYPE_FIXED, 2 },
++		[RSL_IE_L3_INF]			= { TLV_TYPE_TL16V, 0 },
++		[RSL_IE_MS_ID]			= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_MS_POW]			= { TLV_TYPE_TV, 0 },
++		[RSL_IE_PAGING_GRP]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_PAGING_LOAD]		= { TLV_TYPE_FIXED, 2 },
++		[RSL_IE_PHY_CTX]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_ACCESS_DELAY]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_RACH_LOAD]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_REQ_REF]		= { TLV_TYPE_FIXED, 3 },
++		[RSL_IE_REL_MODE]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_RESOURCE_INF]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_RLM_CAUSE]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_STARTING_TIME]		= { TLV_TYPE_FIXED, 2 },
++		[RSL_IE_TIMING_ADV]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_UPLINK_MEAS]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_CAUSE]			= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_MEAS_RES_NO]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_MESSAGE_ID]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_SYS_INFO_TYPE]		= { TLV_TYPE_TV, 0 },
++		//[RSL_IE_MS_POWER_PARAM]		= { TLV_TYPE_TLV, 0 },
++		//[RSL_IE_BS_POWER_PARAM]		= { TLV_TYPE_TLV, 0 },
++		//[RSL_IE_PREPROC_CONFIG]		= { TLV_TYPE_TLV, 0 },
++		//[RSL_IE_PREPROC_MEAS_RES]		= { TLV_TYPE_TLV, 0 },
++		//[RSL_IE_IMM_ASS_INFO]		= { TLV_TYPE_TLV, 0 },
++		//[RSL_IE_SMSCB_INFO]		= { TLV_TYPE_FIXED, 23 },
++		//[RSL_IE_MS_TIMING_OFFSET]	= { TLV_TYPE_TV, 0 },
++		[RSL_IE_ERR_MSG]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_FULL_BCCH_INF]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_CH_NEEDED]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_CB_CMD_TYPE]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_SMSCB_MESS]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_FULL_IMM_ASS_INF]	= { TLV_TYPE_TLV, 0 },
++		//[RSL_IE_SACCH_INFO]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_CBCH_LOAD_INF]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_SMSCB_CH_IND]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_GRP_CALL_REF]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_CH_DESC]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_NCH_DRX_INF]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_CMD_IND]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_EMLPP_PRIO]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_UIC]			= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_MAIN_CH_REF]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_MULTIRATE_CONF]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_MULTIRATE_CNTRL]	= { TLV_TYPE_TV, 0 },
++		[RSL_IE_SUP_CODEC_TYPES]	= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_CODEC_CONF]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_RTD]			= { TLV_TYPE_TV, 0 },
++		[RSL_IE_TFO_STATUS]		= { TLV_TYPE_TV, 0 },
++		[RSL_IE_LLP_APDU]		= { TLV_TYPE_TLV, 0 },
++		[RSL_IE_IPAC_REMOTE_IP]		= { TLV_TYPE_FIXED, 4 },
++		[RSL_IE_IPAC_REMOTE_PORT]	= { TLV_TYPE_FIXED, 2 },
++		[RSL_IE_IPAC_LOCAL_IP]		= { TLV_TYPE_FIXED, 4 },
++		[RSL_IE_IPAC_LOCAL_PORT]	= { TLV_TYPE_FIXED, 2 },
++		[0xf4]				= { TLV_TYPE_TV, 0 },
++		[0xf8]				= { TLV_TYPE_FIXED, 2 },
++		[0xfc]				= { TLV_TYPE_TV, 0 },
++	},
++};
++
+ /* 9.3.1 Channel number			9.3.1	M TV 2 */
+ static int
+ dissect_rsl_ie_ch_no(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, gboolean is_mandatory)
+@@ -2043,7 +2182,6 @@
  	proto_item_set_len(ti, length+2);
  
  	proto_tree_add_item(ie_tree, hf_rsl_ie_length, tvb, offset, 1, FALSE);
@@ -87,25 +214,11 @@
  
  	/* Received Message */
  	offset = dissct_rsl_msg(tvb, pinfo, ie_tree, offset);
-@@ -2907,13 +2939,320 @@
+@@ -2907,13 +3045,392 @@
  	return ie_offset + length;
  }
  
-+/* Vendor-Specific messages of ip.access nanoBTS. There is no public documentation
-+ * about those extensions, all information in this dissector is based on lawful
-+ * protocol reverse enginering by Harald Welte <laforge@gnumonks.org> */
-+#define RSL_MSG_TYPE_IPAC_BIND		0x70
-+#define RSL_MSG_TYPE_IPAC_BIND_ACK	0x71
-+#define RSL_MSG_TYPE_IPAC_BIND_NACK	0x72
-+#define RSL_MSG_TYPE_IPAC_CONNECT	0x73
-+#define RSL_MSG_TYPE_IPAC_CONNECT_ACK	0x74
-+#define RSL_MSG_TYPE_IPAC_CONNECT_NACK	0x75
-+#define RSL_MSG_TYPE_IPAC_DISC_IND	0x76
-+#define RSL_IE_IPAC_REMOTE_IP		0xf0
-+#define RSL_IE_IPAC_REMOTE_PORT		0xf1
-+#define RSL_IE_IPAC_LOCAL_PORT		0xf3
-+#define RSL_IE_IPAC_LOCAL_IP		0xf5
-+
++#if 0
 +static int
 +dissect_rsl_ipac_ie_f8(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset, gboolean is_mandatory)
 +{
@@ -336,21 +449,31 @@
 +
 +	return offset;
 +}
++#endif
 +
 +static int
 +dissct_rsl_ipaccess_msg(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset)
 +{
 +	guint8 msg_type;
++	guint32 local_addr = 0;
++	guint16 local_port = 0;
++	address src_addr;
 +
 +	msg_type = tvb_get_guint8(tvb, offset)&0x7f;
 +	offset++;
 +
 +	switch (msg_type) {
 +	case RSL_MSG_TYPE_IPAC_BIND:
++	case RSL_MSG_TYPE_IPAC_BIND_ACK:
++	case RSL_MSG_TYPE_IPAC_BIND_NACK:
++	case RSL_MSG_TYPE_IPAC_CONNECT:
++	case RSL_MSG_TYPE_IPAC_CONNECT_ACK:
++	case RSL_MSG_TYPE_IPAC_CONNECT_NACK:
++	case RSL_MSG_TYPE_IPAC_DISC_IND:
 +		/* Channel number			9.3.1	M TV 2		*/
 +		offset = dissect_rsl_ie_ch_no(tvb, pinfo, tree, offset, TRUE);
 +		break;
-+	case RSL_MSG_TYPE_IPAC_BIND_ACK:
++#if 0
 +		/* Channel number			9.3.1	M TV 2		*/
 +		offset = dissect_rsl_ie_ch_no(tvb, pinfo, tree, offset, TRUE);
 +		offset = dissect_rsl_ipac_ie_f8(tvb, pinfo, tree, offset, TRUE);
@@ -358,11 +481,9 @@
 +		offset = dissect_rsl_ipac_ie_local_ip(tvb, pinfo, tree, offset, TRUE);
 +		offset = dissect_rsl_ipac_ie_fc(tvb, pinfo, tree, offset, TRUE);
 +		break;
-+	case RSL_MSG_TYPE_IPAC_BIND_NACK:
 +		/* Channel number			9.3.1	M TV 2		*/
 +		offset = dissect_rsl_ie_ch_no(tvb, pinfo, tree, offset, TRUE);
 +		break;
-+	case RSL_MSG_TYPE_IPAC_CONNECT:
 +		/* Channel number			9.3.1	M TV 2		*/
 +		offset = dissect_rsl_ie_ch_no(tvb, pinfo, tree, offset, TRUE);
 +		offset = dissect_rsl_ipac_ie_remote_ip(tvb, pinfo, tree, offset, TRUE);
@@ -370,16 +491,13 @@
 +		offset = dissect_rsl_ipac_ie_f4(tvb, pinfo, tree, offset, TRUE);
 +		offset = dissect_rsl_ipac_ie_fc(tvb, pinfo, tree, offset, TRUE);
 +		break;
-+	case RSL_MSG_TYPE_IPAC_CONNECT_ACK:
 +		/* Channel number			9.3.1	M TV 2		*/
 +		offset = dissect_rsl_ie_ch_no(tvb, pinfo, tree, offset, TRUE);
 +		offset = dissect_rsl_ipac_ie_f8(tvb, pinfo, tree, offset, TRUE);
 +		break;
-+	case RSL_MSG_TYPE_IPAC_CONNECT_NACK:
 +		/* Channel number			9.3.1	M TV 2		*/
 +		offset = dissect_rsl_ie_ch_no(tvb, pinfo, tree, offset, TRUE);
 +		break;
-+	case RSL_MSG_TYPE_IPAC_DISC_IND:
 +		/* Channel number			9.3.1	M TV 2		*/
 +		offset = dissect_rsl_ie_ch_no(tvb, pinfo, tree, offset, TRUE);
 +		offset = dissect_rsl_ipac_ie_f8(tvb, pinfo, tree, offset, TRUE);
@@ -387,8 +505,89 @@
 +		/* Cause					9.3.26	M TLV >=3 */
 +		offset = dissect_rsl_ie_cause(tvb, pinfo, tree, offset, TRUE);
 +		break;
++#endif
++	}
++	/* parse remaining TLV attributes */
++	while (tvb_reported_length_remaining(tvb, offset) != 0) {
++		guint8 tag;
++		unsigned int len, hlen, len_len;
++		const struct tlv_def *tdef;
++		proto_item *ti;
++		proto_tree *ie_tree;
++
++		tag = tvb_get_guint8(tvb, offset);
++		tdef = &rsl_att_tlvdef.def[tag];
++
++		switch (tdef->type) {
++		case TLV_TYPE_FIXED:
++			hlen = 1;
++			len_len = 0;
++			len = tdef->fixed_len;
++			break;
++		case TLV_TYPE_T:
++			hlen = 1;
++			len_len = 0;
++			len = 0;
++			break;
++		case TLV_TYPE_TV:
++			hlen = 1;
++			len_len = 0;
++			len = 1;
++			break;
++		case TLV_TYPE_TLV:
++			hlen = 2;
++			len_len = 1;
++			len = tvb_get_guint8(tvb, offset+1);
++			break;
++		case TLV_TYPE_TL16V:
++			hlen = 3;
++			len_len = 2;
++			len = tvb_get_guint8(tvb, offset+1) << 8 |
++					tvb_get_guint8(tvb, offset+2);
++			break;
++		}
++
++		ti = proto_tree_add_item(tree, hf_rsl_ie_id, tvb, offset, 1, FALSE);
++		ie_tree = proto_item_add_subtree(ti, ett_ie_local_port);
++		offset += hlen;
++
++		switch (tag) {
++		case RSL_IE_CH_NO:
++			break;
++		case RSL_IE_IPAC_REMOTE_IP:
++			proto_tree_add_item(ie_tree, hf_rsl_remote_ip, tvb,
++					    offset, len, FALSE);
++			break;
++		case RSL_IE_IPAC_REMOTE_PORT:
++			proto_tree_add_item(ie_tree, hf_rsl_remote_port, tvb,
++					    offset, len, FALSE);
++			break;
++		case RSL_IE_IPAC_LOCAL_IP:
++			proto_tree_add_item(ie_tree, hf_rsl_local_ip, tvb,
++					    offset, len, FALSE);
++			local_addr = tvb_get_ipv4(tvb, offset);
++			break;
++		case RSL_IE_IPAC_LOCAL_PORT:
++			proto_tree_add_item(ie_tree, hf_rsl_local_port, tvb,
++					    offset, len, FALSE);
++			local_port = tvb_get_ntohs(tvb, offset);
++			break;
++		}
++		offset += len;
 +	}
 +
++	switch (msg_type) {
++	case RSL_MSG_TYPE_IPAC_BIND_ACK:
++		/* Notify the RTP and RTCP dissectors about a new RTP stream */
++		src_addr.type = AT_IPv4;
++		src_addr.len = 4;
++		src_addr.data = (guint8 *)&local_addr;
++		rtp_add_address(pinfo, &src_addr, local_port, 0,
++				"GSM A-bis/IP", pinfo->fd->num, 0);
++		rtcp_add_address(pinfo, &src_addr, local_port+1, 0,
++				 "GSM A-bis/IP", pinfo->fd->num);
++		break;
++	}
 +	return offset;
 +}
 +
@@ -409,7 +608,7 @@
  	offset++;
  
  	switch (msg_type){
-@@ -3517,7 +3856,6 @@
+@@ -3517,7 +4034,6 @@
  		/* 9.1 Message discriminator */
  		proto_tree_add_item(rsl_tree, hf_rsl_msg_dsc, tvb, offset, 1, FALSE);
  		proto_tree_add_item(rsl_tree, hf_rsl_T_bit, tvb, offset, 1, FALSE);
@@ -417,7 +616,7 @@
  
  		offset = dissct_rsl_msg(tvb, pinfo, rsl_tree, offset);
  
-@@ -3883,6 +4221,46 @@
+@@ -3883,6 +4399,46 @@
  			FT_UINT8, BASE_DEC, VALS(rsl_emlpp_prio_vals), 0x03,
  			"eMLPP Priority", HFILL }
  		},
@@ -464,7 +663,7 @@
  	};
  	static gint *ett[] = {
  		&ett_rsl,
-@@ -3941,6 +4319,14 @@
+@@ -3941,6 +4497,14 @@
  		&ett_ie_meas_res_no,
  		&ett_ie_message_id,
  		&ett_ie_sys_info_type,