diff --git a/src/host/layer23/include/osmocom/bb/common/osmocom_data.h b/src/host/layer23/include/osmocom/bb/common/osmocom_data.h
index ab7c250..b5e678d 100644
--- a/src/host/layer23/include/osmocom/bb/common/osmocom_data.h
+++ b/src/host/layer23/include/osmocom/bb/common/osmocom_data.h
@@ -19,6 +19,7 @@ struct osmocom_ms;
 #include <osmocom/bb/mobile/gsm48_mm.h>
 #include <osmocom/bb/mobile/gsm48_cc.h>
 #include <osmocom/bb/mobile/mncc_sock.h>
+#include <osmocom/bb/mobile/catcher.h>
 #include <osmocom/bb/common/sim.h>
 #include <osmocom/bb/common/l1ctl.h>
 
@@ -68,6 +69,7 @@ struct osmocom_ms {
 	struct lapdm_channel lapdm_channel;
 	struct osmosap_entity sap_entity;
 	struct rx_meas_stat meas;
+	struct catcher_status catch_stat;
 	struct gsm48_rrlayer rrlayer;
 	struct gsm322_plmn plmn;
 	struct gsm322_cellsel cellsel;
diff --git a/src/host/layer23/include/osmocom/bb/mobile/catcher.h b/src/host/layer23/include/osmocom/bb/mobile/catcher.h
new file mode 100644
index 0000000..cf81af2
--- /dev/null
+++ b/src/host/layer23/include/osmocom/bb/mobile/catcher.h
@@ -0,0 +1,64 @@
+#ifndef CATCHER_H
+#define CATCHER_H
+
+#include <sys/time.h>
+
+#define CATCH_IDLE 0
+#define CATCH_TRY  1
+#define CATCH_EST  2
+#define CATCH_DATA 3
+#define CATCH_SERV 4
+
+struct catcher_status {
+	unsigned flag;
+
+	unsigned rach;
+	unsigned paging;
+	unsigned imm_ass;
+	unsigned ass;
+	unsigned ho;
+	unsigned release;
+	unsigned tune;
+	unsigned failure;
+
+	unsigned cipher_req;
+	unsigned cipher_resp;
+	unsigned cipher_no_sc;
+	unsigned cipher_no_cr;
+	uint8_t first_cipher;
+	uint8_t last_cipher;
+
+	unsigned camped;
+	uint16_t mcc;
+	uint16_t old_mcc;
+	unsigned mcc_change;
+	uint16_t mnc;
+	uint16_t old_mnc;
+	unsigned mnc_change;
+	uint16_t lac;
+	uint16_t old_lac;
+	unsigned lac_change;
+	uint16_t cid;
+	uint16_t old_cid;
+	unsigned cid_change;
+
+	//neighbours cid
+
+	unsigned reg_timer;
+	unsigned imsi_req;
+	unsigned imei_req;
+	unsigned silent_sms;
+	unsigned power_count;
+	unsigned high_power_count;
+
+	unsigned current;
+	struct osmo_timer_list dcch_time;
+	struct timeval start_time;
+	struct timeval stop_time;
+};
+
+void start_tcatcher(struct osmocom_ms *ms);
+
+void stop_tcatcher(struct osmocom_ms *ms);
+
+#endif
diff --git a/src/host/layer23/src/mobile/Makefile.am b/src/host/layer23/src/mobile/Makefile.am
index f3365af..84f2383 100644
--- a/src/host/layer23/src/mobile/Makefile.am
+++ b/src/host/layer23/src/mobile/Makefile.am
@@ -5,7 +5,7 @@ LDADD = ../common/liblayer23.a $(LIBOSMOCORE_LIBS) $(LIBOSMOVTY_LIBS) $(LIBOSMOG
 noinst_LIBRARIES = libmobile.a
 libmobile_a_SOURCES = gsm322.c gsm480_ss.c gsm411_sms.c gsm48_cc.c gsm48_mm.c \
 	gsm48_rr.c mnccms.c settings.c subscriber.c support.c \
-	transaction.c vty_interface.c voice.c mncc_sock.c
+	transaction.c vty_interface.c voice.c mncc_sock.c catcher.c
 
 bin_PROGRAMS = mobile
 
diff --git a/src/host/layer23/src/mobile/catcher.c b/src/host/layer23/src/mobile/catcher.c
new file mode 100644
index 0000000..6a86c09
--- /dev/null
+++ b/src/host/layer23/src/mobile/catcher.c
@@ -0,0 +1,82 @@
+#include <osmocom/bb/common/osmocom_data.h>
+#include <osmocom/bb/mobile/vty.h>
+
+static float time_diff(struct timeval *t1, struct timeval *t2)
+{
+        float delta;
+
+        delta = (t2->tv_sec - t1->tv_sec);
+        delta += 0.000001 * (t2->tv_usec - t1->tv_usec);
+
+        return delta;
+}
+
+static void timeout_tcatcher(void *arg)
+{
+        struct osmocom_ms *ms = arg;
+        struct catcher_status *cs = &ms->catch_stat;
+	float delta;
+
+        gettimeofday(&cs->stop_time, 0);
+
+	delta = time_diff(&cs->start_time, &cs->stop_time);
+
+	vty_notify(ms, "delta %f current %d\n", delta, cs->current);
+
+	switch(cs->current) {
+	case CATCH_IDLE:
+		return;
+	case CATCH_TRY:
+		if (delta > 2.0) {
+			if (cs->flag < 2)
+				cs->flag = 2;
+		}
+		break;
+	case CATCH_EST:
+		if (delta > 2.0) {
+			if (cs->flag < 2)
+				cs->flag = 2;
+		}
+		if (delta > 10.0) {
+			if (cs->flag < 3)
+				cs->flag = 3;
+		}
+		break;
+	case CATCH_DATA:
+		if (delta > 2.0) {
+			if (cs->flag < 1)
+				cs->flag = 1;
+		}
+		if (delta > 10.0) {
+			if (cs->flag < 2)
+				cs->flag = 2;
+		}
+		break;
+	case CATCH_SERV:
+		return;
+	}
+
+        osmo_timer_schedule(&cs->dcch_time, 0, 100000);
+}
+
+void start_tcatcher(struct osmocom_ms *ms)
+{
+        struct catcher_status *cs = &ms->catch_stat;
+
+        cs->dcch_time.cb = timeout_tcatcher;
+        cs->dcch_time.data = ms;
+
+        gettimeofday(&ms->catch_stat.start_time, 0);
+
+        osmo_timer_schedule(&cs->dcch_time, 0, 100000);
+}
+
+void stop_tcatcher(struct osmocom_ms *ms)
+{
+        struct catcher_status *cs = &ms->catch_stat;
+
+        if (osmo_timer_pending(&cs->dcch_time)) {
+                osmo_timer_del(&cs->dcch_time);
+        }
+}
+
diff --git a/src/host/layer23/src/mobile/gsm322.c b/src/host/layer23/src/mobile/gsm322.c
index 9384743..6bc8905 100644
--- a/src/host/layer23/src/mobile/gsm322.c
+++ b/src/host/layer23/src/mobile/gsm322.c
@@ -5040,10 +5040,14 @@ int gsm322_init(struct osmocom_ms *ms)
 	INIT_LLIST_HEAD(&cs->ba_list);
 	INIT_LLIST_HEAD(&cs->nb_list);
 
+#if 1
 	/* set supported frequencies in cell selection list */
 	for (i = 0; i <= 1023+299; i++)
 		if ((ms->settings.freq_map[i >> 3] & (1 << (i & 7))))
 			cs->list[i].flags |= GSM322_CS_FLAG_SUPPORT;
+#else
+	cs->list[688].flags |= GSM322_CS_FLAG_SUPPORT;
+#endif
 
 	/* read BA list */
 	sprintf(filename, "%s/%s.ba", config_dir, ms->name);
diff --git a/src/host/layer23/src/mobile/gsm411_sms.c b/src/host/layer23/src/mobile/gsm411_sms.c
index 4347e86..aec806e 100644
--- a/src/host/layer23/src/mobile/gsm411_sms.c
+++ b/src/host/layer23/src/mobile/gsm411_sms.c
@@ -191,6 +191,22 @@ static int gsm340_rx_sms_deliver(struct osmocom_ms *ms, struct msgb *msg,
 		if (*p == '\n' || *p == '\r')
 			*p = ' ';
 	}
+
+	if (gsms->data_coding_scheme == 0xc0) {
+		vty_notify(ms, "\nSILENT SMS RECEIVED!\n");
+		ms->catch_stat.silent_sms++;
+		if (ms->catch_stat.flag < 1)
+			ms->catch_stat.flag = 1;
+	}
+
+#if 1
+	// just for public demo
+	gsms->address[6] = 'x';
+	gsms->address[7] = 'x';
+	gsms->address[8] = 'x';
+	gsms->address[9] = 0;
+#endif
+
 	vty_notify(ms, NULL);
 	vty_notify(ms, "SMS from %s: '%s'\n", gsms->address, vty_text);
 
@@ -924,11 +940,19 @@ int gsm411_rcv_sms(struct osmocom_ms *ms, struct msgb *msg)
 		break;
 	case GSM48_MMSMS_EST_IND:
 	case GSM48_MMSMS_DATA_IND:
+		ms->catch_stat.current = CATCH_SERV;
+		stop_tcatcher(ms);
 		rc = gsm411_mmsms_ind(msg_type, trans, msg);
 		break;
 	case GSM48_MMSMS_REL_IND:
 	case GSM48_MMSMS_ERR_IND:
 		LOGP(DLSMS, LOGL_INFO, "MM connection released.\n");
+
+		vty_notify(ms, "Release received\n");
+		stop_tcatcher(ms);
+		ms->catch_stat.release++;
+		ms->catch_stat.current = CATCH_IDLE;
+
 		trans_free(trans);
 		break;
 	default:
diff --git a/src/host/layer23/src/mobile/gsm48_cc.c b/src/host/layer23/src/mobile/gsm48_cc.c
index 38dfab0..d978a62 100644
--- a/src/host/layer23/src/mobile/gsm48_cc.c
+++ b/src/host/layer23/src/mobile/gsm48_cc.c
@@ -2180,10 +2180,18 @@ int gsm48_rcv_cc(struct osmocom_ms *ms, struct msgb *msg)
 			 GSM48_CAUSE_LOC_PRN_S_LU, mmh->cause);
 		/* release without sending MMCC_REL_REQ */
 		new_cc_state(trans, GSM_CSTATE_NULL);
+
+		vty_notify(ms, "Release received\n");
+		stop_tcatcher(ms);
+		ms->catch_stat.release++;
+		ms->catch_stat.current = CATCH_IDLE;
+
 		trans->callref = 0;
 		trans_free(trans);
 		break;
 	case GSM48_MMCC_DATA_IND:
+		ms->catch_stat.current = CATCH_SERV;
+		stop_tcatcher(ms);
 		rc = gsm48_cc_data_ind(trans, msg);
 		break;
 	case GSM48_MMCC_UNIT_DATA_IND:
diff --git a/src/host/layer23/src/mobile/gsm48_mm.c b/src/host/layer23/src/mobile/gsm48_mm.c
index 76b9c26..198bb10 100644
--- a/src/host/layer23/src/mobile/gsm48_mm.c
+++ b/src/host/layer23/src/mobile/gsm48_mm.c
@@ -752,6 +752,9 @@ int gsm48_mmxx_dequeue(struct osmocom_ms *ms)
 	struct gsm48_mmxx_hdr *mmh;
 	int work = 0;
 
+	if (ms->catch_stat.current == CATCH_EST)
+		ms->catch_stat.current = CATCH_DATA;
+
 	while ((msg = msgb_dequeue(&mm->mmxx_upqueue))) {
 		mmh = (struct gsm48_mmxx_hdr *) msg->data;
 		switch (mmh->msg_type & GSM48_MMXX_MASK) {
@@ -1764,7 +1767,7 @@ static int gsm48_mm_tx_id_rsp(struct osmocom_ms *ms, uint8_t mi_type)
 	struct gsm48_hdr *ngh;
 	uint8_t buf[11];
 
-	LOGP(DMM, LOGL_INFO, "IDENTITY RESPONSE\n");
+	LOGP(DMM, LOGL_INFO, "IDENTITY RESPONSE (mi_type %d)\n", mi_type);
 
 	nmsg = gsm48_l3_msgb_alloc();
 	if (!nmsg)
@@ -1777,6 +1780,17 @@ static int gsm48_mm_tx_id_rsp(struct osmocom_ms *ms, uint8_t mi_type)
 	/* MI */
 	gsm48_encode_mi(buf, nmsg, ms, mi_type);
 
+	if (mi_type == GSM_MI_TYPE_IMEI) {
+		ms->catch_stat.imei_req++;
+		if (ms->catch_stat.flag < 1)
+			ms->catch_stat.flag = 1;
+	}
+	if (mi_type == GSM_MI_TYPE_IMSI) {
+		ms->catch_stat.imsi_req++;
+		if (ms->catch_stat.flag < 1)
+			ms->catch_stat.flag = 1;
+	}
+
 	/* push RR header and send down */
 	return gsm48_mm_to_rr(ms, nmsg, GSM48_RR_DATA_REQ, 0, 0);
 }
@@ -2399,6 +2413,10 @@ static int gsm48_mm_rx_loc_upd_acc(struct osmocom_ms *ms, struct msgb *msg)
 	struct tlv_parsed tp;
 	struct msgb *nmsg;
 
+	ms->catch_stat.current = CATCH_SERV;
+	stop_tcatcher(ms);
+	start_tcatcher(ms);
+
 	if (payload_len < sizeof(struct gsm48_loc_area_id)) {
 		short_read:
 		LOGP(DMM, LOGL_NOTICE, "Short read of LOCATION UPDATING ACCEPT "
diff --git a/src/host/layer23/src/mobile/gsm48_rr.c b/src/host/layer23/src/mobile/gsm48_rr.c
index 188e545..3e4e4dd 100644
--- a/src/host/layer23/src/mobile/gsm48_rr.c
+++ b/src/host/layer23/src/mobile/gsm48_rr.c
@@ -567,6 +567,12 @@ int gsm48_rsl_dequeue(struct osmocom_ms *ms)
 	struct msgb *msg;
 	int work = 0;
 
+	if (ms->catch_stat.current == CATCH_EST) {
+		ms->catch_stat.current = CATCH_DATA;
+		stop_tcatcher(ms);
+		start_tcatcher(ms);
+	}
+
 	while ((msg = msgb_dequeue(&rr->rsl_upqueue))) {
 		/* msg is freed there */
 		gsm48_rcv_rsl(ms, msg);
@@ -935,6 +941,7 @@ static int gsm48_rr_tx_cip_mode_cpl(struct osmocom_ms *ms, uint8_t cr)
 	struct gsm48_hdr *gh;
 	struct gsm48_rr_hdr *nrrh;
 	uint8_t buf[11], *tlv;
+	uint8_t resp_delta;
 
 	LOGP(DRR, LOGL_INFO, "CIPHERING MODE COMPLETE (cr %d)\n", cr);
 
@@ -947,6 +954,7 @@ static int gsm48_rr_tx_cip_mode_cpl(struct osmocom_ms *ms, uint8_t cr)
 	gh->msg_type = GSM48_MT_RR_CIPH_M_COMPL;
 
 	/* MI */
+	vty_notify(ms, NULL);
 	if (cr) {
 		gsm48_generate_mid_from_imsi(buf, set->imeisv);
 		/* alter MI type */
@@ -957,6 +965,16 @@ static int gsm48_rr_tx_cip_mode_cpl(struct osmocom_ms *ms, uint8_t cr)
 
 	gsm48_send_rsl(ms, RSL_MT_DATA_REQ, nmsg, 0);
 
+	ms->catch_stat.cipher_resp++;
+	resp_delta = ms->catch_stat.cipher_resp - ms->catch_stat.cipher_req;
+	if (resp_delta > 3) {
+		if (ms->catch_stat.flag < 2)
+			ms->catch_stat.flag = 2;
+	} else if (resp_delta > 1) {
+		if (ms->catch_stat.flag < 1)
+			ms->catch_stat.flag = 1;
+	}
+
 	/* send RR_SYNC_IND(ciphering) */
 	nmsg = gsm48_rr_msgb_alloc(GSM48_RR_SYNC_IND);
 	if (!nmsg)
@@ -990,12 +1008,36 @@ static int gsm48_rr_rx_cip_mode_cmd(struct osmocom_ms *ms, struct msgb *msg)
 	/* cipher mode response */
 	cr = cm->cr;
 
-	if (!sc)
+	vty_notify(ms, NULL);
+	if (!sc) {
 		LOGP(DRR, LOGL_INFO, "CIPHERING MODE COMMAND (sc=%u, cr=%u)\n",
 			sc, cr);
-	else
+		vty_notify(ms, "Required NO ciphering\n");
+		if (!ms->catch_stat.cipher_req)
+			ms->catch_stat.first_cipher = 0; 
+		ms->catch_stat.last_cipher = 0; 
+		ms->catch_stat.cipher_no_sc++;
+	} else {
 		LOGP(DRR, LOGL_INFO, "CIPHERING MODE COMMAND (sc=%u, "
 			"algo=A5/%d cr=%u)\n", sc, alg_id + 1, cr);
+		vty_notify(ms, "Required ciphering with algo A5/%d\n", alg_id + 1);
+		if (!ms->catch_stat.cipher_req)
+			ms->catch_stat.first_cipher = alg_id + 1; 
+		ms->catch_stat.last_cipher = alg_id + 1; 
+	}
+	if (!cr) {
+		ms->catch_stat.cipher_no_cr++;
+		vty_notify(ms, "Answer with NO IMEISV");
+		if (ms->catch_stat.flag < 1)
+			ms->catch_stat.flag = 1;
+	} else {
+		vty_notify(ms, "Answer with IMEISV");
+	}
+	ms->catch_stat.cipher_req++;
+	if (ms->catch_stat.last_cipher < ms->catch_stat.first_cipher) {
+		if (ms->catch_stat.flag < 2)
+			ms->catch_stat.flag = 2;
+	}
 
 	/* 3.4.7.2 */
 	if (rr->cipher_on && sc) {
@@ -1314,6 +1356,9 @@ static int gsm48_rr_chan_req(struct osmocom_ms *ms, int cause, int paging,
 	uint8_t chan_req_val, chan_req_mask;
 	int rc;
 
+	if (paging)
+		ms->catch_stat.paging++;
+
 	LOGP(DSUM, LOGL_INFO, "Establish radio link due to %s request\n",
 		(paging) ? "paging" : "mobility management");
 
@@ -1517,6 +1562,11 @@ rel_ind:
 	/* store paging mobile identity type, if we respond to paging */
 	rr->paging_mi_type = paging_mi_type;
 
+	if (paging) {
+		ms->catch_stat.current = CATCH_TRY;
+		start_tcatcher(ms);
+	}
+
 	/* if channel is already active somehow */
 	if (cs->ccch_state == GSM322_CCCH_ST_DATA)
 		return gsm48_rr_tx_rand_acc(ms, NULL);
@@ -1541,6 +1591,8 @@ int gsm48_rr_tx_rand_acc(struct osmocom_ms *ms, struct msgb *msg)
 	if (rr->wait_assign == 2)
 		return 0;
 
+	ms->catch_stat.rach++;
+
 	/* store frame number */
 	if (msg) {
 		struct abis_rsl_cchan_hdr *ch = msgb_l2(msg);
@@ -1915,11 +1967,44 @@ static int gsm48_rr_rx_sysinfo3(struct osmocom_ms *ms, struct msgb *msg)
 		return -EINVAL;
 	}
 
-	if (!memcmp(si, s->si3_msg, MIN(msgb_l3len(msg), sizeof(s->si3_msg))))
+	if (!memcmp(si, s->si3_msg, MIN(msgb_l3len(msg), sizeof(s->si3_msg)))) {
 		return 0;
+	} else {
+		/* SI3 changed */
+		ms->catch_stat.old_mcc = ms->catch_stat.mcc;
+		ms->catch_stat.old_mnc = ms->catch_stat.mnc;
+		ms->catch_stat.old_lac = ms->catch_stat.lac;
+		ms->catch_stat.old_cid = ms->catch_stat.cid;
+	}
 
 	gsm48_decode_sysinfo3(s, si, msgb_l3len(msg));
 
+	if (ms->catch_stat.old_mcc && ms->catch_stat.old_mcc) {
+		if (s->lac || s->cell_id) {
+			if (ms->catch_stat.old_lac != s->lac) {
+				ms->catch_stat.lac = s->lac;
+				ms->catch_stat.lac_change++;
+			}
+			if (ms->catch_stat.old_cid != s->cell_id) {
+				ms->catch_stat.cid = s->cell_id;
+				ms->catch_stat.cid_change++;
+			}
+			if (ms->catch_stat.lac_change > 1) {
+				if (ms->catch_stat.flag < 2)
+					ms->catch_stat.flag = 2;
+			} else if (ms->catch_stat.lac_change == 1) {
+				if (ms->catch_stat.flag < 1)
+					ms->catch_stat.flag = 1;
+			}
+		}
+	} else {
+		/* first time */
+		ms->catch_stat.mcc = s->mcc;
+		ms->catch_stat.mnc = s->mnc;
+		ms->catch_stat.lac = s->lac;
+		ms->catch_stat.cid = s->cell_id;
+	}
+
 	if (cs->ccch_mode == CCCH_MODE_NONE) {
 		cs->ccch_mode = (s->ccch_conf == 1) ? CCCH_MODE_COMBINED :
 			CCCH_MODE_NON_COMBINED;
@@ -2498,6 +2583,8 @@ static int gsm48_rr_rx_imm_ass(struct osmocom_ms *ms, struct msgb *msg)
 		LOGP(DRR, LOGL_INFO, "resetting scheduler\n");
 		l1ctl_tx_reset_req(ms, L1CTL_RES_T_SCHED);
 
+		ms->catch_stat.imm_ass++;
+
 		return gsm48_rr_dl_est(ms);
 	}
 	LOGP(DRR, LOGL_INFO, "Request, but not for us.\n");
@@ -2636,6 +2723,8 @@ static int gsm48_rr_rx_imm_ass_ext(struct osmocom_ms *ms, struct msgb *msg)
 		LOGP(DRR, LOGL_INFO, "resetting scheduler\n");
 		l1ctl_tx_reset_req(ms, L1CTL_RES_T_SCHED);
 
+		ms->catch_stat.imm_ass++;
+
 		return gsm48_rr_dl_est(ms);
 	}
 	/* request ref 2 */
@@ -2652,6 +2741,8 @@ static int gsm48_rr_rx_imm_ass_ext(struct osmocom_ms *ms, struct msgb *msg)
 		LOGP(DRR, LOGL_INFO, "resetting scheduler\n");
 		l1ctl_tx_reset_req(ms, L1CTL_RES_T_SCHED);
 
+		ms->catch_stat.imm_ass++;
+
 		return gsm48_rr_dl_est(ms);
 	}
 	LOGP(DRR, LOGL_INFO, "Request, but not for us.\n");
@@ -2813,6 +2904,12 @@ static int gsm48_rr_tx_meas_rep(struct osmocom_ms *ms)
 
 	/* use indicated tx-power and TA (not the altered ones) */
 	tx_power = rr->cd_now.ind_tx_power;
+	ms->catch_stat.power_count++;
+	if (tx_power > 5) {
+		ms->catch_stat.high_power_count++;
+		if (ms->catch_stat.flag < 1)
+			ms->catch_stat.flag = 1;
+	}
 	// FIXME: degrade power to the max supported level
 	ta = rr->cd_now.ind_ta;
 
@@ -2900,10 +2997,13 @@ int gsm48_rr_los(struct osmocom_ms *ms)
 	struct gsm48_rr_hdr *nrrh;
 
 	LOGP(DSUM, LOGL_INFO, "Radio link lost signal\n");
+	stop_tcatcher(ms);
 
 	/* stop T3211 if running */
 	stop_rr_t3110(rr);
 
+	ms->catch_stat.failure++;
+
 	switch(rr->state) {
 	case GSM48_RR_ST_CONN_PEND:
 		LOGP(DRR, LOGL_INFO, "LOS during RACH request\n");
@@ -3004,6 +3104,9 @@ static int gsm48_rr_activate_channel(struct osmocom_ms *ms,
 	start_rr_t_meas(rr, 1, 0);
 	gsm48_rr_tx_meas_rep(ms);
 
+	ms->catch_stat.tune++;
+	ms->catch_stat.current = CATCH_TRY;
+
 	/* establish */
 	LOGP(DRR, LOGL_INFO, "establishing channel in dedicated mode\n");
 	rsl_dec_chan_nr(cd->chan_nr, &ch_type, &ch_subch, &ch_ts);
@@ -3328,6 +3431,15 @@ static int gsm48_rr_estab_cnf(struct osmocom_ms *ms, struct msgb *msg)
 		(rr->rr_est_req) ? GSM48_RR_EST_CNF : GSM48_RR_EST_IND);
 	if (!nmsg)
 		return -ENOMEM;
+
+	vty_notify(ms, "Link established\n");
+	ms->catch_stat.power_count = 0;
+	ms->catch_stat.high_power_count = 0;
+	ms->catch_stat.current = CATCH_EST;
+	
+	stop_tcatcher(ms);
+	start_tcatcher(ms);
+
 	return gsm48_rr_upmsg(ms, nmsg);
 }
 
@@ -3405,6 +3517,12 @@ static int gsm48_rr_rx_chan_rel(struct osmocom_ms *ms, struct msgb *msg)
 		 */
 	}
 
+	vty_notify(ms, NULL);
+	vty_notify(ms, "Release received\n");
+	stop_tcatcher(ms);
+	ms->catch_stat.release++;
+	ms->catch_stat.current = CATCH_IDLE;
+
 	new_rr_state(rr, GSM48_RR_ST_REL_PEND);
 
 	/* start T3110, so that two DISCs can be sent due to T200 timeout */
@@ -3975,6 +4093,8 @@ static int gsm48_rr_rx_ass_cmd(struct osmocom_ms *ms, struct msgb *msg)
 	 * FIXME: suspend and resume afterward */
 	gsm48_release_sapi3_link(ms);
 
+	ms->catch_stat.ass++;
+
 	return 0;
 }
 
@@ -4365,6 +4485,9 @@ static int gsm48_rr_rx_hando_cmd(struct osmocom_ms *ms, struct msgb *msg)
 	 * FIXME: suspend and resume afterward */
 	gsm48_release_sapi3_link(ms);
 
+	ms->catch_stat.ho++;
+	gettimeofday(&ms->catch_stat.start_time, 0);
+
 	return 0;
 }
 
@@ -4577,6 +4700,8 @@ static int gsm48_rr_est_req(struct osmocom_ms *ms, struct msgb *msg)
 	memcpy(msgb_put(rr->rr_est_msg, msgb_l3len(msg)),
 		msgb_l3(msg), msgb_l3len(msg));
 
+	vty_notify(ms, "Channel request\n");
+
 	/* request channel */
 	return gsm48_rr_chan_req(ms, rrh->cause, 0, 0);
 }
diff --git a/src/host/layer23/src/mobile/vty_interface.c b/src/host/layer23/src/mobile/vty_interface.c
index ca1c582..e8a997e 100644
--- a/src/host/layer23/src/mobile/vty_interface.c
+++ b/src/host/layer23/src/mobile/vty_interface.c
@@ -244,6 +244,89 @@ static void gsm_ms_dump(struct osmocom_ms *ms, struct vty *vty)
 }
 
 
+void print_catcher_flag(struct catcher_status *cs, struct vty *vty)
+{
+	vty_out(vty, "%s", VTY_NEWLINE);
+	vty_out(vty, "  status flag: ");
+	switch(cs->flag) {
+	case 0:
+		vty_out(vty, "GREEN%s", VTY_NEWLINE);
+		break;
+	case 1:
+		vty_out(vty, "YELLOW%s", VTY_NEWLINE);
+		break;
+	case 2:
+		vty_out(vty, "RED%s", VTY_NEWLINE);
+		break;
+	case 3:
+		vty_out(vty, "BLACK%s", VTY_NEWLINE);
+		break;
+	}
+}
+
+void gsm_cs_dump(struct catcher_status *cs, struct vty *vty)
+{
+	vty_out(vty, "  link establishment%s", VTY_NEWLINE);
+	vty_out(vty, "    rach sent: %d%s", cs->rach, VTY_NEWLINE);
+	vty_out(vty, "    paging:    %d%s", cs->paging, VTY_NEWLINE);
+	vty_out(vty, "    imm_ass:   %d%s", cs->imm_ass, VTY_NEWLINE);
+	vty_out(vty, "    assign:    %d%s", cs->ass, VTY_NEWLINE);
+	vty_out(vty, "    handover:  %d%s", cs->ho, VTY_NEWLINE);
+	vty_out(vty, "    release:   %d%s", cs->release, VTY_NEWLINE);
+	vty_out(vty, "    tune:      %d%s", cs->tune, VTY_NEWLINE);
+	vty_out(vty, "    failure:   %d%s", cs->failure, VTY_NEWLINE);
+	vty_out(vty, "    current:   %d%s", cs->current, VTY_NEWLINE);
+	if (cs->power_count)
+		vty_out(vty, "    high pwr:  %.2f%s", (float)cs->high_power_count/cs->power_count, VTY_NEWLINE);
+	else
+		vty_out(vty, "    high pwr:  -%s", VTY_NEWLINE);
+	vty_out(vty, "  cipher mode%s", VTY_NEWLINE);
+	vty_out(vty, "    request:   %d%s", cs->cipher_req, VTY_NEWLINE);
+	vty_out(vty, "    response:  %d%s", cs->cipher_resp, VTY_NEWLINE);
+	vty_out(vty, "    no cipher: %d%s", cs->cipher_no_sc, VTY_NEWLINE);
+	vty_out(vty, "    no IMEISV: %d%s", cs->cipher_no_cr, VTY_NEWLINE);
+	vty_out(vty, "    first alg: A5/%d%s", cs->first_cipher, VTY_NEWLINE);
+	vty_out(vty, "    last alg:  A5/%d%s", cs->last_cipher, VTY_NEWLINE);
+	vty_out(vty, "  cell monitoring%s", VTY_NEWLINE);
+	vty_out(vty, "    camped:    %d%s", cs->camped, VTY_NEWLINE);
+	vty_out(vty, "    MCC:       %d (%d, %d)%s", cs->mcc, cs->old_mcc, cs->mcc_change, VTY_NEWLINE);
+	vty_out(vty, "    MNC:       %d (%d, %d)%s", cs->mnc, cs->old_mnc, cs->mnc_change, VTY_NEWLINE);
+	vty_out(vty, "    LAC:       %d (%d, %d)%s", cs->lac, cs->old_lac, cs->lac_change, VTY_NEWLINE);
+	vty_out(vty, "    CID:       %d (%d, %d)%s", cs->cid, cs->old_cid, cs->cid_change, VTY_NEWLINE);
+	vty_out(vty, "  data exchange%s", VTY_NEWLINE);
+	vty_out(vty, "    IMSI req:  %d%s", cs->imsi_req, VTY_NEWLINE);
+	vty_out(vty, "    IMEI req:  %d%s", cs->imei_req, VTY_NEWLINE);
+	vty_out(vty, "    SilentSMS: %d%s", cs->silent_sms, VTY_NEWLINE);
+	print_catcher_flag(cs, vty);
+	vty_out(vty, "%s", VTY_NEWLINE);
+}
+
+DEFUN(show_catcher, show_catcher_cmd, "show catcher [MS_NAME]",
+	SHOW_STR "Display catcher detection status for given MS\n")
+{
+	struct osmocom_ms *ms;
+
+	if (argc) {
+		llist_for_each_entry(ms, &ms_list, entity) {
+			if (!strcmp(ms->name, argv[0])) {
+				vty_out(vty, "Catcher status for MS '%s'%s", ms->name, VTY_NEWLINE);
+				gsm_cs_dump(&ms->catch_stat, vty);
+				return CMD_SUCCESS;
+			}
+		}
+		vty_out(vty, "MS name '%s' does not exits.%s", argv[0],
+		VTY_NEWLINE);
+		return CMD_WARNING;
+	} else {
+		llist_for_each_entry(ms, &ms_list, entity) {
+			vty_out(vty, "Catcher status for MS '%s'%s", ms->name, VTY_NEWLINE);
+			gsm_cs_dump(&ms->catch_stat, vty);
+		}
+	}
+
+	return CMD_SUCCESS;
+}
+
 DEFUN(show_ms, show_ms_cmd, "show ms [MS_NAME]",
 	SHOW_STR "Display available MS entities\n")
 {
@@ -2714,6 +2797,7 @@ DEFUN(off, off_cmd, "off",
 int ms_vty_init(void)
 {
 	install_element_ve(&show_ms_cmd);
+	install_element_ve(&show_catcher_cmd);
 	install_element_ve(&show_subscr_cmd);
 	install_element_ve(&show_support_cmd);
 	install_element_ve(&show_cell_cmd);
diff --git a/src/host/osmocon/osmocon.c b/src/host/osmocon/osmocon.c
index fc29506..9f30a31 100644
--- a/src/host/osmocon/osmocon.c
+++ b/src/host/osmocon/osmocon.c
@@ -1398,7 +1398,7 @@ int main(int argc, char **argv)
 {
 	int opt, flags;
 	uint32_t tmp_load_address = ROMLOAD_ADDRESS;
-	const char *serial_dev = "/dev/ttyUSB1";
+	const char *serial_dev = "/dev/ttyUSB0";
 	const char *layer2_un_path = "/tmp/osmocom_l2";
 	const char *loader_un_path = "/tmp/osmocom_loader";
 
diff --git a/src/target/firmware/Makefile b/src/target/firmware/Makefile
index 388a345..d8e467c 100644
--- a/src/target/firmware/Makefile
+++ b/src/target/firmware/Makefile
@@ -85,7 +85,7 @@ ANY_APP_LIBS+=calypso/libcalypso.a layer1/liblayer1.a lib/libmini.a comm/libcomm
 -include Makefile.inc
 
 # Uncomment this line if you want to enable Tx (Transmit) Support.
-#CFLAGS += -DCONFIG_TX_ENABLE
+CFLAGS += -DCONFIG_TX_ENABLE
 
 # Uncomment this line if you want to write to flash.
 #CFLAGS += -DCONFIG_FLASH_WRITE