gbproxy: Separate SGSN numeric namespaces

Currently the SGSN side message's TLLI are searched without checking
the originating SGSN. This leads to collisions if both SGSN use the
same P-TMSI for different MS.

With this patch, the SGSN NSEI is stored within the tlli_info and is
used in comparisons to separate the namespaces.

Note that this type of collision cannot happen with BSS numbers,
since the tlli_info are already separated and stored per (BSS) peer.

Sponsored-by: On-Waves ehf

7 files changed, 240 insertions, 138 deletions

diff --git a/openbsc/include/openbsc/gb_proxy.h b/openbsc/include/openbsc/gb_proxy.h
index d9731a729..d818114ba 100644
--- a/openbsc/include/openbsc/gb_proxy.h
+++ b/openbsc/include/openbsc/gb_proxy.h
@@ -140,6 +140,7 @@ struct gbproxy_tlli_info {
 
 	struct gbproxy_tlli_state tlli;
 	struct gbproxy_tlli_state sgsn_tlli;
+	uint32_t sgsn_nsei;
 
 	time_t timestamp;
 	uint8_t *imsi;
@@ -211,9 +212,11 @@ struct gbproxy_tlli_info *gbproxy_find_tlli(
 	struct gbproxy_peer *peer, uint32_t tlli);
 struct gbproxy_tlli_info *gbproxy_find_tlli_by_imsi(
 	struct gbproxy_peer *peer, const uint8_t *imsi, size_t imsi_len);
+struct gbproxy_tlli_info *gbproxy_find_tlli_by_any_sgsn_tlli(
+	struct gbproxy_peer *peer, uint32_t tlli);
 struct gbproxy_tlli_info *gbproxy_find_tlli_by_sgsn_tlli(
 	struct gbproxy_peer *peer,
-	uint32_t tlli);
+	uint32_t tlli, uint32_t sgsn_nsei);
 struct gbproxy_tlli_info *gbproxy_find_tlli_by_ptmsi(
 	struct gbproxy_peer *peer,
 	uint32_t ptmsi);
diff --git a/openbsc/include/openbsc/gprs_gb_parse.h b/openbsc/include/openbsc/gprs_gb_parse.h
index 3aa17fd8b..6ab105922 100644
--- a/openbsc/include/openbsc/gprs_gb_parse.h
+++ b/openbsc/include/openbsc/gprs_gb_parse.h
@@ -39,6 +39,7 @@ struct gprs_gb_parse_context {
 	uint32_t tlli;
 	int pdu_type;
 	int old_raid_is_foreign;
+	int peer_nsei;
 };
 
 int gprs_gb_parse_dtap(uint8_t *data, size_t data_len,
diff --git a/openbsc/src/gprs/gb_proxy.c b/openbsc/src/gprs/gb_proxy.c
index ee8037565..4b46b0e2b 100644
--- a/openbsc/src/gprs/gb_proxy.c
+++ b/openbsc/src/gprs/gb_proxy.c
@@ -257,7 +257,7 @@ uint32_t gbproxy_make_sgsn_tlli(struct gbproxy_peer *peer,
 			sgsn_tlli = rand_r(&peer->cfg->sgsn_tlli_state);
 			sgsn_tlli = (sgsn_tlli & 0x7fffffff) | 0x78000000;
 
-			if (gbproxy_find_tlli_by_sgsn_tlli(peer, sgsn_tlli))
+			if (gbproxy_find_tlli_by_any_sgsn_tlli(peer, sgsn_tlli))
 				sgsn_tlli = 0;
 		} while (!sgsn_tlli);
 	}
@@ -309,6 +309,7 @@ static void gbproxy_flush_stored_messages(struct gbproxy_peer *peer,
 	while ((stored_msg = msgb_dequeue(&tlli_info->stored_msgs))) {
 		struct gprs_gb_parse_context tmp_parse_ctx = {0};
 		tmp_parse_ctx.to_bss = 0;
+		tmp_parse_ctx.peer_nsei = msgb_nsei(stored_msg);
 		int len_change = 0;
 
 		gprs_gb_parse_bssgp(msgb_bssgph(stored_msg),
@@ -511,13 +512,13 @@ static int gbprox_process_bssgp_ul(struct gbproxy_config *cfg,
 	time_t now;
 	struct gbproxy_tlli_info *tlli_info = NULL;
 	uint32_t sgsn_nsei = cfg->nsip_sgsn_nsei;
-	int send_msg_directly = 0;
 
 	if (!cfg->core_mcc && !cfg->core_mnc && !cfg->core_apn &&
 	    !cfg->acquire_imsi && !cfg->patch_ptmsi && !cfg->route_to_sgsn2)
 		return 1;
 
 	parse_ctx.to_bss = 0;
+	parse_ctx.peer_nsei = msgb_nsei(msg);
 
 	/* Parse BSSGP/LLC */
 	rc = gprs_gb_parse_bssgp(msgb_bssgph(msg), msgb_bssgp_len(msg),
@@ -560,11 +561,16 @@ static int gbprox_process_bssgp_ul(struct gbproxy_config *cfg,
 		}
 	}
 
-	if (tlli_info && cfg->route_to_sgsn2 && gbproxy_check_tlli(peer, tlli_info)) {
-		sgsn_nsei = cfg->nsip_sgsn2_nsei;
-		send_msg_directly = 1;
+	if (tlli_info && cfg->route_to_sgsn2) {
+		if (cfg->acquire_imsi && tlli_info->imsi_len == 0)
+			sgsn_nsei = 0xffff;
+		else if (gbproxy_check_tlli(peer, tlli_info))
+			sgsn_nsei = cfg->nsip_sgsn2_nsei;
 	}
 
+	if (tlli_info)
+		tlli_info->sgsn_nsei = sgsn_nsei;
+
 	/* Handle IMSI acquisition */
 	if (cfg->acquire_imsi) {
 		rc = gbproxy_imsi_acquisition(peer, msg, sgsn_nsei, now,
@@ -578,7 +584,7 @@ static int gbprox_process_bssgp_ul(struct gbproxy_config *cfg,
 
 	gbproxy_update_tlli_state_after(peer, tlli_info, now, &parse_ctx);
 
-	if (send_msg_directly) {
+	if (sgsn_nsei != cfg->nsip_sgsn_nsei) {
 		/* Send message directly to the selected SGSN */
 		rc = gbprox_relay2sgsn(cfg, msg, msgb_bvci(msg), sgsn_nsei);
 		/* Don't let the calling code handle the transmission */
@@ -604,6 +610,7 @@ static void gbprox_process_bssgp_dl(struct gbproxy_config *cfg,
 		return;
 
 	parse_ctx.to_bss = 1;
+	parse_ctx.peer_nsei = msgb_nsei(msg);
 
 	rc = gprs_gb_parse_bssgp(msgb_bssgph(msg), msgb_bssgp_len(msg),
 				 &parse_ctx);
diff --git a/openbsc/src/gprs/gb_proxy_tlli.c b/openbsc/src/gprs/gb_proxy_tlli.c
index c4140f7e8..8aadd2f44 100644
--- a/openbsc/src/gprs/gb_proxy_tlli.c
+++ b/openbsc/src/gprs/gb_proxy_tlli.c
@@ -60,16 +60,33 @@ struct gbproxy_tlli_info *gbproxy_find_tlli_by_ptmsi(
 	return NULL;
 }
 
-struct gbproxy_tlli_info *gbproxy_find_tlli_by_sgsn_tlli(
+struct gbproxy_tlli_info *gbproxy_find_tlli_by_any_sgsn_tlli(
 	struct gbproxy_peer *peer,
 	uint32_t tlli)
 {
 	struct gbproxy_tlli_info *tlli_info;
 	struct gbproxy_patch_state *state = &peer->patch_state;
 
+	/* Don't care about the NSEI */
 	llist_for_each_entry(tlli_info, &state->enabled_tllis, list)
 		if (tlli_info->sgsn_tlli.current == tlli ||
-		    tlli_info->sgsn_tlli.assigned == tlli)
+		     tlli_info->sgsn_tlli.assigned == tlli)
+			return tlli_info;
+
+	return NULL;
+}
+
+struct gbproxy_tlli_info *gbproxy_find_tlli_by_sgsn_tlli(
+	struct gbproxy_peer *peer,
+	uint32_t tlli, uint32_t sgsn_nsei)
+{
+	struct gbproxy_tlli_info *tlli_info;
+	struct gbproxy_patch_state *state = &peer->patch_state;
+
+	llist_for_each_entry(tlli_info, &state->enabled_tllis, list)
+		if ((tlli_info->sgsn_tlli.current == tlli ||
+		     tlli_info->sgsn_tlli.assigned == tlli) &&
+		    tlli_info->sgsn_nsei == sgsn_nsei)
 			return tlli_info;
 
 	return NULL;
@@ -409,7 +426,8 @@ static void gbproxy_remove_matching_tllis(struct gbproxy_peer *peer,
 			continue;
 
 		if (!gbproxy_tlli_match(&tlli_info->tlli, &info->tlli) &&
-		    !gbproxy_tlli_match(&tlli_info->sgsn_tlli, &info->sgsn_tlli))
+		    (tlli_info->sgsn_nsei != info->sgsn_nsei ||
+		     !gbproxy_tlli_match(&tlli_info->sgsn_tlli, &info->sgsn_tlli)))
 			continue;
 
 		LOGP(DGPRS, LOGL_INFO,
@@ -508,7 +526,8 @@ struct gbproxy_tlli_info *gbproxy_update_tlli_state_dl(
 	struct gbproxy_tlli_info *tlli_info = NULL;
 
 	if (parse_ctx->tlli_enc)
-		tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, parse_ctx->tlli);
+		tlli_info = gbproxy_find_tlli_by_sgsn_tlli(
+			peer, parse_ctx->tlli, parse_ctx->peer_nsei);
 
 	if (parse_ctx->tlli_enc && parse_ctx->new_ptmsi_enc && tlli_info) {
 		/* A new P-TMSI has been signalled in the message,
diff --git a/openbsc/src/gprs/gb_proxy_vty.c b/openbsc/src/gprs/gb_proxy_vty.c
index 22592a162..da615630e 100644
--- a/openbsc/src/gprs/gb_proxy_vty.c
+++ b/openbsc/src/gprs/gb_proxy_vty.c
@@ -479,6 +479,10 @@ DEFUN(show_gbproxy_tllis, show_gbproxy_tllis_cmd, "show gbproxy tllis",
 			if (stored_msgs)
 				vty_out(vty, ", STORED %d", stored_msgs);
 
+			if (g_cfg->route_to_sgsn2)
+				vty_out(vty, ", SGSN NSEI %d",
+					tlli_info->sgsn_nsei);
+
 			if (tlli_info->is_deregistered)
 				vty_out(vty, ", DE-REGISTERED");
 
@@ -583,15 +587,15 @@ DEFUN(delete_gb_nsei, delete_gb_nsei_cmd,
 	"Delete a GBProxy TLLI entry by NSEI and identification\nNSEI number\n"
 
 DEFUN(delete_gb_tlli_by_id, delete_gb_tlli_by_id_cmd,
-	"delete-gbproxy-tlli <0-65534> (tlli|imsi) IDENT",
+	"delete-gbproxy-tlli <0-65534> (tlli|imsi|sgsn-nsei) IDENT",
 	GBPROXY_DELETE_TLLI_STR
 	"Delete entries with a matching TLLI (hex)\n"
 	"Delete entries with a matching IMSI\n"
 	"Identification to match\n")
 {
 	const uint16_t nsei = atoi(argv[0]);
-	enum {MATCH_TLLI = 't', MATCH_IMSI = 'i'} match;
-	uint32_t tlli = 0;
+	enum {MATCH_TLLI = 't', MATCH_IMSI = 'i', MATCH_SGSN = 's'} match;
+	uint32_t ident = 0;
 	const char *imsi = NULL;
 	struct gbproxy_peer *peer = 0;
 	struct gbproxy_tlli_info *tlli_info, *nxt;
@@ -601,10 +605,11 @@ DEFUN(delete_gb_tlli_by_id, delete_gb_tlli_by_id_cmd,
 
 	match = argv[1][0];
 
-	if (match == MATCH_TLLI)
-		tlli = strtoll(argv[2], NULL, 16);
-	else
-		imsi = argv[2];
+	switch (match) {
+	case MATCH_TLLI: ident = strtoll(argv[2], NULL, 16); break;
+	case MATCH_IMSI: imsi = argv[2]; break;
+	case MATCH_SGSN: ident = strtoll(argv[2], NULL, 0); break;
+	};
 
 	peer = gbproxy_peer_by_nsei(g_cfg, nsei);
 	if (!peer) {
@@ -616,10 +621,16 @@ DEFUN(delete_gb_tlli_by_id, delete_gb_tlli_by_id_cmd,
 	state = &peer->patch_state;
 
 	llist_for_each_entry_safe(tlli_info, nxt, &state->enabled_tllis, list) {
-		if (match == MATCH_TLLI) {
-			if (tlli_info->tlli.current != tlli)
+		switch (match) {
+		case MATCH_TLLI:
+			if (tlli_info->tlli.current != ident)
+				continue;
+			break;
+		case MATCH_SGSN:
+			if (tlli_info->sgsn_nsei != ident)
 				continue;
-		} else {
+			break;
+		case MATCH_IMSI:
 			mi_buf[0] = '\0';
 			gsm48_mi_to_string(mi_buf, sizeof(mi_buf),
 					   tlli_info->imsi,
@@ -627,6 +638,7 @@ DEFUN(delete_gb_tlli_by_id, delete_gb_tlli_by_id_cmd,
 
 			if (strcmp(mi_buf, imsi) != 0)
 				continue;
+			break;
 		}
 
 		vty_out(vty, "Deleting TLLI %08x%s", tlli_info->tlli.current,
diff --git a/openbsc/tests/gbproxy/gbproxy_test.c b/openbsc/tests/gbproxy/gbproxy_test.c
index b35519f99..764027940 100644
--- a/openbsc/tests/gbproxy/gbproxy_test.c
+++ b/openbsc/tests/gbproxy/gbproxy_test.c
@@ -157,6 +157,10 @@ static int dump_peers(FILE *stream, int indent, time_t now,
 			if (tlli_info->imsi_acq_pending)
 				fprintf(stream, ", IMSI acquisition in progress");
 
+			if (cfg->route_to_sgsn2)
+				fprintf(stream, ", SGSN NSEI %d",
+					tlli_info->sgsn_nsei);
+
 			if (tlli_info->is_deregistered)
 				fprintf(stream, ", DE-REGISTERED");
 
@@ -1475,7 +1479,7 @@ static void test_gbproxy_ra_patching()
 	OSMO_ASSERT(gbproxy_peer_by_lac(&gbcfg, convert_ra(&rai_sgsn)) != NULL);
 	OSMO_ASSERT(gbproxy_peer_by_lac(&gbcfg, convert_ra(&rai_unknown)) == NULL);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_tlli);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_tlli);
 	OSMO_ASSERT(tlli_info->tlli.current != local_tlli);
@@ -1493,7 +1497,7 @@ static void test_gbproxy_ra_patching()
 
 	OSMO_ASSERT(6 == peer->ctrg->ctr[GBPROX_PEER_CTR_RAID_PATCHED_BSS].current);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_tlli);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_tlli);
 	OSMO_ASSERT(tlli_info->tlli.current != local_tlli);
@@ -1512,7 +1516,7 @@ static void test_gbproxy_ra_patching()
 
 	OSMO_ASSERT(7 == peer->ctrg->ctr[GBPROX_PEER_CTR_RAID_PATCHED_BSS].current);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_tlli);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_tlli);
 	OSMO_ASSERT(tlli_info->tlli.current != local_tlli);
@@ -1530,7 +1534,7 @@ static void test_gbproxy_ra_patching()
 
 	OSMO_ASSERT(2 == peer->ctrg->ctr[GBPROX_PEER_CTR_RAID_PATCHED_SGSN].current);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_tlli);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == 0);
 	OSMO_ASSERT(tlli_info->tlli.current == local_tlli);
@@ -1963,7 +1967,7 @@ static void test_gbproxy_ptmsi_patching()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, random_sgsn_tlli);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, random_sgsn_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli);
 	OSMO_ASSERT(tlli_info->tlli.current == foreign_bss_tlli);
@@ -1983,7 +1987,7 @@ static void test_gbproxy_ptmsi_patching()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli);
 	OSMO_ASSERT(tlli_info->tlli.current == foreign_bss_tlli);
@@ -2001,7 +2005,7 @@ static void test_gbproxy_ptmsi_patching()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.current == local_bss_tlli);
 	OSMO_ASSERT(tlli_info->tlli.assigned == 0);
@@ -2049,8 +2053,8 @@ static void test_gbproxy_ptmsi_patching()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	OSMO_ASSERT(gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2) != NULL);
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli);
+	OSMO_ASSERT(gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2, SGSN_NSEI) != NULL);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli2);
 	OSMO_ASSERT(tlli_info->tlli.current == local_bss_tlli);
@@ -2075,9 +2079,9 @@ static void test_gbproxy_ptmsi_patching()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	OSMO_ASSERT(gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2) == NULL);
-	OSMO_ASSERT(gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli3) != NULL);
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli);
+	OSMO_ASSERT(gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2, SGSN_NSEI) == NULL);
+	OSMO_ASSERT(gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli3, SGSN_NSEI) != NULL);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli3);
 	OSMO_ASSERT(tlli_info->tlli.current == local_bss_tlli);
@@ -2110,7 +2114,7 @@ static void test_gbproxy_ptmsi_patching()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli3);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli3, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.current == local_bss_tlli3);
 	OSMO_ASSERT(tlli_info->tlli.assigned == 0);
@@ -2284,7 +2288,7 @@ static void test_gbproxy_imsi_acquisition()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, random_sgsn_tlli);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, random_sgsn_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli);
 	OSMO_ASSERT(tlli_info->tlli.current == foreign_bss_tlli);
@@ -2304,7 +2308,7 @@ static void test_gbproxy_imsi_acquisition()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli);
 	OSMO_ASSERT(tlli_info->tlli.current == foreign_bss_tlli);
@@ -2322,7 +2326,7 @@ static void test_gbproxy_imsi_acquisition()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.current == local_bss_tlli);
 	OSMO_ASSERT(tlli_info->tlli.assigned == 0);
@@ -2464,6 +2468,7 @@ static void test_gbproxy_secondary_sgsn()
 	const uint32_t foreign_bss_tlli2 = 0x8000beef;
 
 	const uint32_t random_sgsn_tlli3 = 0x7e23ef54;
+	const uint32_t bss_ptmsi3 = 0xead4775a;
 	const uint32_t local_bss_tlli3 = 0xead4775a;
 	const uint32_t foreign_bss_tlli3 = 0x8000feed;
 
@@ -2471,6 +2476,7 @@ static void test_gbproxy_secondary_sgsn()
 	const uint8_t imsi2[] = {0x11, 0x12, 0x99, 0x99, 0x99, 0x16, 0x17, 0x18};
 	const uint8_t imsi3[] = {0x11, 0x12, 0x99, 0x99, 0x99, 0x26, 0x27, 0x28};
 	struct gbproxy_tlli_info *tlli_info;
+	struct gbproxy_tlli_info *other_info;
 	struct gbproxy_peer *peer;
 	unsigned bss_nu = 0;
 	unsigned sgsn_nu = 0;
@@ -2573,7 +2579,8 @@ static void test_gbproxy_secondary_sgsn()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, random_sgsn_tlli);
+	OSMO_ASSERT(!gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN2_NSEI));
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, random_sgsn_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli);
 	OSMO_ASSERT(tlli_info->tlli.current == foreign_bss_tlli);
@@ -2593,7 +2600,8 @@ static void test_gbproxy_secondary_sgsn()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli);
+	OSMO_ASSERT(!gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN2_NSEI));
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli);
 	OSMO_ASSERT(tlli_info->tlli.current == foreign_bss_tlli);
@@ -2611,7 +2619,8 @@ static void test_gbproxy_secondary_sgsn()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli);
+	OSMO_ASSERT(!gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN2_NSEI));
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.current == local_bss_tlli);
 	OSMO_ASSERT(tlli_info->tlli.assigned == 0);
@@ -2695,7 +2704,8 @@ static void test_gbproxy_secondary_sgsn()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, random_sgsn_tlli2);
+	OSMO_ASSERT(!gbproxy_find_tlli_by_sgsn_tlli(peer, random_sgsn_tlli2, SGSN_NSEI));
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, random_sgsn_tlli2, SGSN2_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli2);
 	OSMO_ASSERT(tlli_info->tlli.current == foreign_bss_tlli2);
@@ -2715,7 +2725,8 @@ static void test_gbproxy_secondary_sgsn()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2);
+	OSMO_ASSERT(!gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2, SGSN_NSEI));
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2, SGSN2_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli2);
 	OSMO_ASSERT(tlli_info->tlli.current == foreign_bss_tlli2);
@@ -2733,7 +2744,8 @@ static void test_gbproxy_secondary_sgsn()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
-	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2);
+	OSMO_ASSERT(!gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2, SGSN_NSEI));
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli2, SGSN2_NSEI);
 	OSMO_ASSERT(tlli_info);
 	OSMO_ASSERT(tlli_info->tlli.current == local_bss_tlli2);
 	OSMO_ASSERT(tlli_info->tlli.assigned == 0);
@@ -2817,6 +2829,20 @@ static void test_gbproxy_secondary_sgsn()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
+	OSMO_ASSERT(!gbproxy_find_tlli_by_sgsn_tlli(peer, random_sgsn_tlli3, SGSN_NSEI));
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, random_sgsn_tlli3, SGSN2_NSEI);
+	OSMO_ASSERT(tlli_info);
+	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli3);
+	OSMO_ASSERT(tlli_info->tlli.current == foreign_bss_tlli3);
+	OSMO_ASSERT(!tlli_info->tlli.bss_validated);
+	OSMO_ASSERT(!tlli_info->tlli.net_validated);
+	OSMO_ASSERT(tlli_info->tlli.ptmsi == bss_ptmsi3);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.assigned == local_sgsn_tlli);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.current == random_sgsn_tlli3);
+	OSMO_ASSERT(!tlli_info->sgsn_tlli.bss_validated);
+	OSMO_ASSERT(!tlli_info->sgsn_tlli.net_validated);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.ptmsi == sgsn_ptmsi);
+
 	send_llc_ul_ui(nsi, "ATTACH COMPLETE", &bss_peer[0], 0x1002,
 		       local_bss_tlli3, &rai_bss, cell_id,
 		       GPRS_SAPI_GMM, bss_nu++,
@@ -2824,6 +2850,20 @@ static void test_gbproxy_secondary_sgsn()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
+	other_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN_NSEI);
+	OSMO_ASSERT(other_info);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN2_NSEI);
+	OSMO_ASSERT(tlli_info);
+	OSMO_ASSERT(tlli_info != other_info);
+	OSMO_ASSERT(tlli_info->tlli.assigned == local_bss_tlli3);
+	OSMO_ASSERT(tlli_info->tlli.current == foreign_bss_tlli3);
+	OSMO_ASSERT(tlli_info->tlli.bss_validated);
+	OSMO_ASSERT(!tlli_info->tlli.net_validated);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.assigned == local_sgsn_tlli);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.current == random_sgsn_tlli3);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.bss_validated);
+	OSMO_ASSERT(!tlli_info->sgsn_tlli.net_validated);
+
 	send_llc_dl_ui(nsi, "GMM INFO", &sgsn_peer[1], 0x1002,
 		       local_sgsn_tlli, 1, imsi3, sizeof(imsi3),
 		       GPRS_SAPI_GMM, sgsn_nu++,
@@ -2831,6 +2871,17 @@ static void test_gbproxy_secondary_sgsn()
 
 	dump_peers(stdout, 0, 0, &gbcfg);
 
+	other_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN_NSEI);
+	OSMO_ASSERT(other_info);
+	tlli_info = gbproxy_find_tlli_by_sgsn_tlli(peer, local_sgsn_tlli, SGSN2_NSEI);
+	OSMO_ASSERT(tlli_info);
+	OSMO_ASSERT(tlli_info != other_info);
+	OSMO_ASSERT(tlli_info->tlli.current == local_bss_tlli3);
+	OSMO_ASSERT(tlli_info->tlli.assigned == 0);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.current == local_sgsn_tlli);
+	OSMO_ASSERT(tlli_info->sgsn_tlli.assigned == 0);
+
+
 	printf("--- Shutdown GPRS connection (SGSN 1) ---\n\n");
 
 	/* Detach */
diff --git a/openbsc/tests/gbproxy/gbproxy_test.ok b/openbsc/tests/gbproxy/gbproxy_test.ok
index 4938aadbf..1ec6bc433 100644
--- a/openbsc/tests/gbproxy/gbproxy_test.ok
+++ b/openbsc/tests/gbproxy/gbproxy_test.ok
@@ -3697,7 +3697,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI 8000dead -> 7c69fb81, IMSI (none), AGE 0, STORED 1, IMSI acquisition in progress
+      TLLI 8000dead -> 7c69fb81, IMSI (none), AGE 0, STORED 1, IMSI acquisition in progress, SGSN NSEI 65535
 PROCESSING IDENT RESPONSE from 0x01020304:1111
 00 00 10 02 01 80 00 de ad 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 11 01 c0 05 08 16 08 11 12 13 14 15 16 17 18 ad 05 28 
 
@@ -3717,7 +3717,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI 8000dead -> 7c69fb81, IMSI 12131415161718, AGE 0
+      TLLI 8000dead -> 7c69fb81, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING IDENT REQUEST from 0x05060708:32000
 00 00 10 02 00 7c 69 fb 81 00 50 20 16 82 02 58 0e 89 41 c0 01 08 15 01 ff 6c ba 
 
@@ -3738,7 +3738,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI 8000dead -> 7c69fb81, IMSI 12131415161718, AGE 0
+      TLLI 8000dead -> 7c69fb81, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING IDENT RESPONSE from 0x01020304:1111
 00 00 10 02 01 80 00 de ad 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 11 01 c0 09 08 16 08 11 12 13 14 15 16 17 18 ba 14 c3 
 
@@ -3759,7 +3759,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI 8000dead -> 7c69fb81, IMSI 12131415161718, AGE 0
+      TLLI 8000dead -> 7c69fb81, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING ATTACH ACCEPT from 0x05060708:32000
 00 00 10 02 00 7c 69 fb 81 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 9e 41 c0 05 08 02 01 49 04 21 63 54 40 50 60 19 cd d7 08 17 16 18 05 f4 ef e2 b7 00 53 62 f1 
 
@@ -3782,7 +3782,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI 8000dead/c00f7304 -> 7c69fb81/efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000dead/c00f7304 -> 7c69fb81/efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING ATTACH COMPLETE from 0x01020304:1111
 00 00 10 02 01 c0 0f 73 04 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 08 01 c0 0d 08 03 55 1c ea 
 
@@ -3805,7 +3805,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI 8000dead/c00f7304 -> 7c69fb81/efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000dead/c00f7304 -> 7c69fb81/efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING GMM INFO from 0x05060708:32000
 00 00 10 02 00 ef e2 b7 00 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 88 41 c0 09 08 21 04 ba 3d 
 
@@ -3828,7 +3828,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING XID (UL) from 0x01020304:1111
 00 00 10 02 01 c0 0f 73 04 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 0f 41 fb 01 00 0e 00 64 11 05 16 01 90 66 b3 28 
 
@@ -3887,7 +3887,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING LLC_DISCARDED from 0x01020304:1111
 00 00 00 00 2c 1f 84 c0 0f 73 04 0f 81 01 04 82 10 02 25 83 00 00 0c 
 
@@ -3910,7 +3910,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING LLC_DISCARDED from 0x05060708:32000
 00 00 00 00 2c 1f 84 ef e2 b7 00 0f 81 01 04 82 10 02 25 83 00 00 0c 
 
@@ -3933,7 +3933,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING BVC_SUSPEND from 0x01020304:1111
 00 00 00 00 0b 1f 84 c0 0f 73 04 1b 86 11 22 33 40 50 60 
 
@@ -3956,7 +3956,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING BVC_SUSPEND_ACK from 0x05060708:32000
 00 00 00 00 0c 1f 84 ef e2 b7 00 1b 86 21 63 54 40 50 60 1d 81 01 
 
@@ -3979,7 +3979,7 @@ Peers:
     Attach Request count            : 1
     TLLI cache size                 : 1
     TLLI-Cache: 1
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 --- Establish GPRS connection (SGSN 2) ---
 
 PROCESSING ATTACH REQUEST from 0x01020304:1111
@@ -4004,8 +4004,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI 8000beef -> 7eb52dfb, IMSI (none), AGE 0, STORED 1, IMSI acquisition in progress
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000beef -> 7eb52dfb, IMSI (none), AGE 0, STORED 1, IMSI acquisition in progress, SGSN NSEI 65535
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING IDENT RESPONSE from 0x01020304:1111
 00 00 10 02 01 80 00 be ef 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 11 01 c0 15 08 16 08 11 12 99 99 99 16 17 18 b2 dd 58 
 
@@ -4028,8 +4028,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI 8000beef -> 7eb52dfb, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000beef -> 7eb52dfb, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING IDENT REQUEST from 0x15161718:32001
 00 00 10 02 00 7e b5 2d fb 00 50 20 16 82 02 58 0e 89 41 c0 0d 08 15 01 0c a6 18 
 
@@ -4052,8 +4052,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI 8000beef -> 7eb52dfb, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000beef -> 7eb52dfb, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING IDENT RESPONSE from 0x01020304:1111
 00 00 10 02 01 80 00 be ef 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 11 01 c0 19 08 16 08 11 12 99 99 99 16 17 18 a5 cc b3 
 
@@ -4076,8 +4076,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI 8000beef -> 7eb52dfb, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000beef -> 7eb52dfb, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING ATTACH ACCEPT from 0x15161718:32001
 00 00 10 02 00 7e b5 2d fb 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 99 99 99 16 17 18 00 81 00 0e 9e 41 c0 11 08 02 01 49 04 21 63 54 40 50 60 19 cd d7 08 17 16 18 05 f4 e0 98 76 54 cb 1c 5b 
 
@@ -4100,8 +4100,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI 8000beef/e656aa1f -> 7eb52dfb/e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000beef/e656aa1f -> 7eb52dfb/e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING ATTACH COMPLETE from 0x01020304:1111
 00 00 10 02 01 e6 56 aa 1f 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 08 01 c0 1d 08 03 5e 3a ea 
 
@@ -4124,8 +4124,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI 8000beef/e656aa1f -> 7eb52dfb/e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000beef/e656aa1f -> 7eb52dfb/e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING GMM INFO from 0x15161718:32001
 00 00 10 02 00 e0 98 76 54 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 99 99 99 16 17 18 00 81 00 0e 88 41 c0 15 08 21 bb c1 c6 
 
@@ -4148,8 +4148,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING XID (UL) from 0x01020304:1111
 00 00 10 02 01 e6 56 aa 1f 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 0f 41 fb 01 00 0e 00 64 11 05 16 01 90 66 b3 28 
 
@@ -4208,8 +4208,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING LLC_DISCARDED from 0x01020304:1111
 00 00 00 00 2c 1f 84 e6 56 aa 1f 0f 81 01 04 82 10 02 25 83 00 00 0c 
 
@@ -4232,8 +4232,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING LLC_DISCARDED from 0x15161718:32001
 00 00 00 00 2c 1f 84 e0 98 76 54 0f 81 01 04 82 10 02 25 83 00 00 0c 
 
@@ -4256,8 +4256,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING BVC_SUSPEND from 0x01020304:1111
 00 00 00 00 0b 1f 84 e6 56 aa 1f 1b 86 11 22 33 40 50 60 
 
@@ -4280,8 +4280,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING BVC_SUSPEND_ACK from 0x15161718:32001
 00 00 00 00 0c 1f 84 e0 98 76 54 1b 86 21 63 54 40 50 60 1d 81 01 
 
@@ -4304,8 +4304,8 @@ Peers:
     Attach Request count            : 2
     TLLI cache size                 : 2
     TLLI-Cache: 2
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 --- Establish GPRS connection (SGSN 2, P-TMSI collision) ---
 
 PROCESSING ATTACH REQUEST from 0x01020304:1111
@@ -4330,9 +4330,9 @@ Peers:
     Attach Request count            : 3
     TLLI cache size                 : 3
     TLLI-Cache: 3
-      TLLI 8000feed -> 7e23ef54, IMSI (none), AGE 0, STORED 1, IMSI acquisition in progress
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000feed -> 7e23ef54, IMSI (none), AGE 0, STORED 1, IMSI acquisition in progress, SGSN NSEI 65535
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING IDENT RESPONSE from 0x01020304:1111
 00 00 10 02 01 80 00 fe ed 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 11 01 c0 25 08 16 08 11 12 99 99 99 26 27 28 58 c7 cb 
 
@@ -4355,9 +4355,9 @@ Peers:
     Attach Request count            : 3
     TLLI cache size                 : 3
     TLLI-Cache: 3
-      TLLI 8000feed -> 7e23ef54, IMSI 12199999962728, AGE 0, IMSI matches
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000feed -> 7e23ef54, IMSI 12199999962728, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING IDENT REQUEST from 0x15161718:32001
 00 00 10 02 00 7e 23 ef 54 00 50 20 16 82 02 58 0e 89 41 c0 19 08 15 01 a2 f2 a4 
 
@@ -4380,9 +4380,9 @@ Peers:
     Attach Request count            : 3
     TLLI cache size                 : 3
     TLLI-Cache: 3
-      TLLI 8000feed -> 7e23ef54, IMSI 12199999962728, AGE 0, IMSI matches
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000feed -> 7e23ef54, IMSI 12199999962728, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING IDENT RESPONSE from 0x01020304:1111
 00 00 10 02 01 80 00 fe ed 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 11 01 c0 29 08 16 08 11 12 99 99 99 26 27 28 4f d6 20 
 
@@ -4405,9 +4405,9 @@ Peers:
     Attach Request count            : 3
     TLLI cache size                 : 3
     TLLI-Cache: 3
-      TLLI 8000feed -> 7e23ef54, IMSI 12199999962728, AGE 0, IMSI matches
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
-      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0
+      TLLI 8000feed -> 7e23ef54, IMSI 12199999962728, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING ATTACH ACCEPT (P-TMSI 1) from 0x15161718:32001
 00 00 10 02 00 7e 23 ef 54 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 99 99 99 26 27 28 00 81 00 0e 9e 41 c0 1d 08 02 01 49 04 21 63 54 40 50 60 19 cd d7 08 17 16 18 05 f4 ef e2 b7 00 74 91 01 
 
@@ -4428,10 +4428,11 @@ Peers:
     TLLI patched              (SGSN): 16
     P-TMSI patched            (SGSN): 3
     Attach Request count            : 3
-    TLLI cache size                 : 2
-    TLLI-Cache: 2
-      TLLI 8000feed/ead4775a -> 7e23ef54/efe2b700, IMSI 12199999962728, AGE 0, IMSI matches
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
+    TLLI cache size                 : 3
+    TLLI-Cache: 3
+      TLLI 8000feed/ead4775a -> 7e23ef54/efe2b700, IMSI 12199999962728, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING ATTACH COMPLETE from 0x01020304:1111
 00 00 10 02 01 ea d4 77 5a 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 08 01 c0 2d 08 03 43 50 ea 
 
@@ -4452,10 +4453,11 @@ Peers:
     TLLI patched              (SGSN): 16
     P-TMSI patched            (SGSN): 3
     Attach Request count            : 3
-    TLLI cache size                 : 2
-    TLLI-Cache: 2
-      TLLI 8000feed/ead4775a -> 7e23ef54/efe2b700, IMSI 12199999962728, AGE 0, IMSI matches
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
+    TLLI cache size                 : 3
+    TLLI-Cache: 3
+      TLLI 8000feed/ead4775a -> 7e23ef54/efe2b700, IMSI 12199999962728, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 PROCESSING GMM INFO from 0x15161718:32001
 00 00 10 02 00 ef e2 b7 00 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 99 99 99 26 27 28 00 81 00 0e 88 41 c0 21 08 21 ca 60 90 
 
@@ -4476,10 +4478,11 @@ Peers:
     TLLI patched              (SGSN): 17
     P-TMSI patched            (SGSN): 3
     Attach Request count            : 3
-    TLLI cache size                 : 2
-    TLLI-Cache: 2
-      TLLI ead4775a -> efe2b700, IMSI 12199999962728, AGE 0, IMSI matches
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
+    TLLI cache size                 : 3
+    TLLI-Cache: 3
+      TLLI ead4775a -> efe2b700, IMSI 12199999962728, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
 --- Shutdown GPRS connection (SGSN 1) ---
 
 PROCESSING DETACH REQ from 0x01020304:1111
@@ -4488,24 +4491,25 @@ PROCESSING DETACH REQ from 0x01020304:1111
 CALLBACK, event 0, msg length 44, bvci 0x1002
 00 00 10 02 01 c0 0f 73 04 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 15 01 c0 31 08 05 01 18 05 f4 ef e2 b7 00 19 03 b9 97 cb 57 e6 15 
 
-NS UNITDATA MESSAGE to BSS, BVCI 0x1002, msg length 24 (gprs_ns_sendmsg)
-MESSAGE to BSS at 0x01020304:1111, msg length 28
-00 00 10 02 00 c0 0f 73 04 00 50 20 16 82 02 58 0e 00 09 41 c4 01 08 06 00 11 f5 c0 
+NS UNITDATA MESSAGE to SGSN, BVCI 0x1002, msg length 44 (gprs_ns_sendmsg)
+MESSAGE to SGSN at 0x05060708:32000, msg length 48
+00 00 10 02 01 ef e2 b7 00 00 00 04 08 88 21 63 54 40 50 60 12 34 00 80 0e 00 15 01 c0 31 08 05 01 18 05 f4 ef e2 b7 00 19 03 b9 97 cb 57 e6 15 
 
-result (DETACH REQ) = 0
+result (DETACH REQ) = 48
 
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
-    RAID patched              (BSS ): 16
+    RAID patched              (BSS ): 17
     RAID patched              (SGSN): 5
-    TLLI patched              (BSS ): 17
+    TLLI patched              (BSS ): 18
     TLLI patched              (SGSN): 17
     P-TMSI patched            (SGSN): 3
     Attach Request count            : 3
-    TLLI cache size                 : 2
-    TLLI-Cache: 2
-      TLLI ead4775a -> efe2b700, IMSI 12199999962728, AGE 0, IMSI matches
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
+    TLLI cache size                 : 3
+    TLLI-Cache: 3
+      TLLI c00f7304 -> efe2b700, IMSI 12131415161718, AGE 0, SGSN NSEI 256
+      TLLI ead4775a -> efe2b700, IMSI 12199999962728, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
 PROCESSING DETACH ACC from 0x05060708:32000
 00 00 10 02 00 ef e2 b7 00 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 89 41 c0 25 08 06 00 4d 09 cd 
 
@@ -4514,21 +4518,22 @@ CALLBACK, event 0, msg length 67, bvci 0x1002
 
 NS UNITDATA MESSAGE to BSS, BVCI 0x1002, msg length 67 (gprs_ns_sendmsg)
 MESSAGE to BSS at 0x01020304:1111, msg length 71
-00 00 10 02 00 ea d4 77 5a 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 89 41 c0 25 08 06 00 4d 09 cd 
+00 00 10 02 00 c0 0f 73 04 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 13 14 15 16 17 18 00 81 00 0e 89 41 c0 25 08 06 00 4d 09 cd 
 
 result (DETACH ACC) = 71
 
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
-    RAID patched              (BSS ): 16
+    RAID patched              (BSS ): 17
     RAID patched              (SGSN): 5
-    TLLI patched              (BSS ): 17
+    TLLI patched              (BSS ): 18
     TLLI patched              (SGSN): 18
     P-TMSI patched            (SGSN): 3
     Attach Request count            : 3
-    TLLI cache size                 : 1
-    TLLI-Cache: 1
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
+    TLLI cache size                 : 2
+    TLLI-Cache: 2
+      TLLI ead4775a -> efe2b700, IMSI 12199999962728, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
 --- Shutdown GPRS connection (SGSN 2) ---
 
 PROCESSING DETACH REQ from 0x01020304:1111
@@ -4545,16 +4550,17 @@ result (DETACH REQ) = 0
 
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
-    RAID patched              (BSS ): 17
+    RAID patched              (BSS ): 18
     RAID patched              (SGSN): 5
-    TLLI patched              (BSS ): 18
+    TLLI patched              (BSS ): 19
     TLLI patched              (SGSN): 18
     P-TMSI patched            (BSS ): 1
     P-TMSI patched            (SGSN): 3
     Attach Request count            : 3
-    TLLI cache size                 : 1
-    TLLI-Cache: 1
-      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches
+    TLLI cache size                 : 2
+    TLLI-Cache: 2
+      TLLI e656aa1f -> e0987654, IMSI 12199999961718, AGE 0, IMSI matches, SGSN NSEI 258
+      TLLI ead4775a -> efe2b700, IMSI 12199999962728, AGE 0, IMSI matches, SGSN NSEI 258
 PROCESSING DETACH ACC from 0x15161718:32001
 00 00 10 02 00 e0 98 76 54 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 99 99 99 16 17 18 00 81 00 0e 89 41 c0 29 08 06 00 be c3 6f 
 
@@ -4569,14 +4575,16 @@ result (DETACH ACC) = 71
 
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
-    RAID patched              (BSS ): 17
+    RAID patched              (BSS ): 18
     RAID patched              (SGSN): 5
-    TLLI patched              (BSS ): 18
+    TLLI patched              (BSS ): 19
     TLLI patched              (SGSN): 19
     P-TMSI patched            (BSS ): 1
     P-TMSI patched            (SGSN): 3
     Attach Request count            : 3
-    TLLI-Cache: 0
+    TLLI cache size                 : 1
+    TLLI-Cache: 1
+      TLLI ead4775a -> efe2b700, IMSI 12199999962728, AGE 0, IMSI matches, SGSN NSEI 258
 --- Shutdown GPRS connection (SGSN 2, P-TMSI 1) ---
 
 PROCESSING DETACH REQ from 0x01020304:1111
@@ -4585,22 +4593,24 @@ PROCESSING DETACH REQ from 0x01020304:1111
 CALLBACK, event 0, msg length 44, bvci 0x1002
 00 00 10 02 01 ea d4 77 5a 00 00 04 08 88 11 22 33 40 50 60 12 34 00 80 0e 00 15 01 c0 39 08 05 01 18 05 f4 ef e2 b7 00 19 03 b9 97 cb 44 b6 8a 
 
-NS UNITDATA MESSAGE to BSS, BVCI 0x1002, msg length 24 (gprs_ns_sendmsg)
-MESSAGE to BSS at 0x01020304:1111, msg length 28
-00 00 10 02 00 ea d4 77 5a 00 50 20 16 82 02 58 0e 00 09 41 c4 01 08 06 00 11 f5 c0 
+NS UNITDATA MESSAGE to SGSN 2, BVCI 0x1002, msg length 44 (gprs_ns_sendmsg)
+MESSAGE to SGSN 2 at 0x15161718:32001, msg length 48
+00 00 10 02 01 ef e2 b7 00 00 00 04 08 88 21 63 54 40 50 60 12 34 00 80 0e 00 15 01 c0 39 08 05 01 18 05 f4 ef e2 b7 00 19 03 b9 97 cb 44 b6 8a 
 
 result (DETACH REQ) = 0
 
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
-    RAID patched              (BSS ): 17
+    RAID patched              (BSS ): 19
     RAID patched              (SGSN): 5
-    TLLI patched              (BSS ): 18
+    TLLI patched              (BSS ): 20
     TLLI patched              (SGSN): 19
     P-TMSI patched            (BSS ): 1
     P-TMSI patched            (SGSN): 3
     Attach Request count            : 3
-    TLLI-Cache: 0
+    TLLI cache size                 : 1
+    TLLI-Cache: 1
+      TLLI ead4775a -> efe2b700, IMSI 12199999962728, AGE 0, IMSI matches, SGSN NSEI 258
 PROCESSING DETACH ACC from 0x15161718:32001
 00 00 10 02 00 ef e2 b7 00 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 99 99 99 26 27 28 00 81 00 0e 89 41 c0 2d 08 06 00 86 7c c7 
 
@@ -4609,20 +4619,19 @@ CALLBACK, event 0, msg length 67, bvci 0x1002
 
 NS UNITDATA MESSAGE to BSS, BVCI 0x1002, msg length 67 (gprs_ns_sendmsg)
 MESSAGE to BSS at 0x01020304:1111, msg length 71
-00 00 10 02 00 ef e2 b7 00 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 99 99 99 26 27 28 00 81 00 0e 89 41 c0 2d 08 06 00 86 7c c7 
+00 00 10 02 00 ea d4 77 5a 00 50 20 16 82 02 58 13 99 18 b3 43 2b 25 96 62 00 60 80 9a c2 c6 62 00 60 80 ba c8 c6 62 00 60 80 00 0a 82 08 02 0d 88 11 12 99 99 99 26 27 28 00 81 00 0e 89 41 c0 2d 08 06 00 86 7c c7 
 
 result (DETACH ACC) = 71
 
 Peers:
   NSEI 4096, BVCI 4098, not blocked, RAI 112-332-16464-96
-    RAID patched              (BSS ): 17
+    RAID patched              (BSS ): 19
     RAID patched              (SGSN): 5
-    TLLI patched              (BSS ): 18
-    TLLI patched              (SGSN): 19
+    TLLI patched              (BSS ): 20
+    TLLI patched              (SGSN): 20
     P-TMSI patched            (BSS ): 1
     P-TMSI patched            (SGSN): 3
     Attach Request count            : 3
-    TLLI from SGSN unknown          : 1
     TLLI-Cache: 0
 Gbproxy global:
     Invalid BVC Identifier          : 1