diff --git a/src/ac/ac.default.conf b/src/ac/ac.default.conf
index 9b9c4185..ffcb0473 100644
--- a/src/ac/ac.default.conf
+++ b/src/ac/ac.default.conf
@@ -51,7 +51,11 @@
 
 
 
-
+# image_dir
+# Directorie where firmware images are stored
+#
+# Default
+# image_dir=/tftpboot
 
 
 
diff --git a/src/ac/conf.c b/src/ac/conf.c
index ba9d21d8..fb29f47c 100644
--- a/src/ac/conf.c
+++ b/src/ac/conf.c
@@ -104,6 +104,8 @@ int conf_lwapp=1;
 char * conf_lw_control_port=0;
 #endif 
 
+char * conf_image_dir=0;
+
 
 char * conf_control_port=0;
 
@@ -271,10 +273,11 @@ static int init_version()
 	bstr_replace(&conf_cisco_hardware_version,bstr_create_from_cfgstr((char*)conf_cisco_hardware_version));
 
 	/* Cisco software version */
+/*
 	if (!conf_cisco_software_version)
 		conf_cisco_software_version=(bstr_t)strdup(CONF_DEFAULT_CISCO_SOFTWARE_VERSION);
 	bstr_replace(&conf_cisco_software_version,bstr_create_from_cfgstr((char*)conf_cisco_software_version));
-
+*/
 
 
 	
@@ -595,11 +598,10 @@ int read_config(const char * filename){
 		CFG_SIMPLE_STR("dtls_psk",&conf_dtls_psk),
 		
 		CFG_SIMPLE_BOOL("dtls_verify_peer",&conf_dtls_verify_peer),
-
 		CFG_SIMPLE_BOOL("ipv4",&conf_ipv4),
 		CFG_SIMPLE_BOOL("ipv6",&conf_ipv6),
-
 		CFG_SIMPLE_STR("db_file",conf_db_file),
+		CFG_SIMPLE_STR("image_dir",&conf_image_dir),
 
 		CFG_END()
 	};
@@ -663,6 +665,9 @@ int read_config(const char * filename){
 	if (!conf_sslcipher)
 		conf_sslcipher=CAPWAP_CIPHER;
 
+	if (!conf_image_dir)
+		conf_image_dir=CONF_DEFAULT_IMAGE_DIR;
+
 
 	init_listen_addrs();
 	init_mcast_groups();
diff --git a/src/ac/conf.h b/src/ac/conf.h
index 67961f8f..8fb05be4 100644
--- a/src/ac/conf.h
+++ b/src/ac/conf.h
@@ -60,6 +60,7 @@
 
 #define CONF_DEFAULT_CISCO_HARDWARE_VERSION ".x01000001"
 #define CONF_DEFAULT_CISCO_SOFTWARE_VERSION ".x06006E00"
+#define CONF_DEFAULT_IMAGE_DIR "/tftpboot"
 
 
 #ifndef CONF_DEFAULT_CONTROL_PORT
@@ -111,7 +112,7 @@ extern char * conf_dtls_psk;
 extern int conf_dtls_verify_peer;
 char * conf_sslcipher;
 
-
+extern char *conf_image_dir;
 
 
 extern char ** conf_mcast_groups;
diff --git a/src/ac/wtpman.c b/src/ac/wtpman.c
index 5b20b1da..a787da18 100644
--- a/src/ac/wtpman.c
+++ b/src/ac/wtpman.c
@@ -35,7 +35,10 @@
 
 
 /* macro to convert our client ip to a string */
-#define CLIENT_IP (sock_addrtostr((struct sockaddr*)&wtpman->conn->addr, (char[64]){0},64))
+//#define CLIENT_IP (sock_addrtostr((struct sockaddr*)&wtpman->conn->addr, (char[64]){0},64))
+
+#define CLIENT_IP (sock_addr2str(&wtpman->conn->addr))
+
 
 /*
 int conn_handle_echo_request(void * d)
@@ -216,7 +219,7 @@ int wtpman_handle_request(void *p)
 }
 
 
-void send_image_file(struct conn * conn,const char * filename)
+void usend_image_file(struct conn * conn,const char * filename)
 {
 	FILE * infile;
 	infile = fopen(filename,"rb");
@@ -234,7 +237,7 @@ void send_image_file(struct conn * conn,const char * filename)
 
 	struct cwrmsg * cwrmsg;
 	uint8_t  buffer[1024];
-	struct image_data data;
+	struct cwimage_data data;
 	data.data = buffer;
 
 
@@ -441,7 +444,7 @@ static void wtpman_run_run(void *arg)
 	cwmsg_addelem(&conn->req_msg,CWMSGELEM_WTP_NAME,(uint8_t*)"Tube7u83",strlen("Tube7u83")+1);
 	cwmsg_addelem(&conn->req_msg,CWMSGELEM_LOCATION_DATA,(uint8_t*)"Berlin",strlen("Berlin")+1);
 
-	cwmsg_addelem_vendor_specific_payload(&conn->req_msg,CW_VENDOR_ID_CISCO,CWVENDOR_CISCO_RAD_NAME,(uint8_t*)"NudelSuppe",strlen("NudelSuppe"));
+//	cwmsg_addelem_vendor_specific_payload(&conn->req_msg,CW_VENDOR_ID_CISCO,CWVENDOR_CISCO_RAD_NAME,(uint8_t*)"Schlumpf",strlen("Schlumpf"));
 
 	cwrmsg = conn_send_request(conn);
 
@@ -580,6 +583,42 @@ printf("Slept befor join resp\n");
 	
 }
 
+
+static int wtpman_send_image_file(struct wtpman * wtpman,struct cwrmsg * cwrmsg)
+{
+	struct cwimage_data data;
+	memset(&data,0,sizeof(struct cwimage_data));
+	uint8_t id [1025];
+	data.identifier=id;
+	char filename[2048];
+	id[0]=0;
+
+
+	cw_read_image_data_request(&data,cwrmsg->msgelems,cwrmsg->msgelems_len);
+	if (!strlen(id)){
+		cw_dbg(DBG_CW_MSG_ERR, "No image identifier in image data request");
+		cw_send_image_data_response(wtpman->conn,cwrmsg->seqnum,CW_RESULT_FAILURE);
+		return 0;
+	}
+
+	sprintf(filename,"%s/%s",conf_image_dir,id);
+
+	FILE *infile;
+	infile = fopen(filename, "rb");
+	if (infile) {
+		cw_send_image_data_response(wtpman->conn,cwrmsg->seqnum,CW_RESULT_SUCCESS);
+		cw_log(LOG_INFO, "Sending image file %s to %s", filename, sock_addr2str(&wtpman->conn->addr));
+		cw_send_image_file(wtpman->conn, infile);
+		return 1;
+	}
+
+	cw_log(LOG_ERR, "Can't open image file %s:%s", filename, strerror(errno));
+	cw_send_image_data_response(wtpman->conn,cwrmsg->seqnum,CW_RESULT_FAILURE);
+
+	return 0;
+
+}
+
 static void wtpman_run(void *arg)
 {
 	struct wtpman * wtpman = (struct wtpman *)arg;
@@ -613,17 +652,36 @@ static void wtpman_run(void *arg)
 
 
 
-	/* here the WTP has joined, now image update or change state event */
+	/* here the WTP has joined, now we assume an image data request  
+	   or an configuration status request. Nothing else. i
+	   State is Image update 
+	*/
+
+	do {
+		int cfg_status_msgs[] = { CWMSG_IMAGE_DATA_REQUEST, CWMSG_CONFIGURATION_STATUS_REQUEST, -1 };
+		cwrmsg =  conn_wait_for_request(wtpman->conn, cfg_status_msgs, timer);
+
+		if (!cwrmsg){
+			cw_dbg(DBG_CW_MSG_ERR,"No conf status or img data request from %s after %d seconds, WTP died.",
+				sock_addr2str(&wtpman->conn->addr),wtpman->conn->wait_join);
+			wtpman_remove(wtpman);	
+			return;
+		}
+
+		/* Image data request, the WTP wants an update */
+		if (cwrmsg->type==CWMSG_IMAGE_DATA_REQUEST){
+			int rc = wtpman_send_image_file(wtpman,cwrmsg);	
+			if (rc ){
+				wtpman_remove(wtpman);
+				return;
+			}
+
+		}
+
+	} while (cwrmsg->type != CWMSG_CONFIGURATION_STATUS_REQUEST); 
+
 
-	int cfg_status_msgs[] = { CWMSG_IMAGE_DATA_REQUEST, CWMSG_CONFIGURATION_STATUS_REQUEST, -1 };
-	cwrmsg =  conn_wait_for_request(wtpman->conn, cfg_status_msgs, timer);
 
-	if (!cwrmsg){
-		cw_dbg(DBG_CW_MSG_ERR,"No config uration status request from %s after %d seconds, WTP died.",
-			sock_addr2str(&wtpman->conn->addr),wtpman->conn->wait_join);
-		wtpman_remove(wtpman);	
-		return;
-	}
 printf("Have Masseg %d\n",cwrmsg->type);
 	cwread_configuration_status_request(&wtpman->wtpinfo,cwrmsg->msgelems, cwrmsg->msgelems_len);
 	int result_code=0;
@@ -655,12 +713,12 @@ printf("Done\n");
 			break;
 		case CWMSG_IMAGE_DATA_REQUEST:
 			printf("Image update\n!");
-			cwread_image_data_request(0,cwrmsg->msgelems,cwrmsg->msgelems_len);
+			//cwread_image_data_request(0,cwrmsg->msgelems,cwrmsg->msgelems_len);
 
 
-			cwsend_image_data_response(wtpman->conn,cwrmsg->seqnum,CW_RESULT_SUCCESS);
+			//cwsend_image_data_response(wtpman->conn,cwrmsg->seqnum,CW_RESULT_SUCCESS);
 
-			send_image_file(wtpman->conn,"/tftpboot/c1130-k9w7-tar.default");
+			//send_image_file(wtpman->conn,"/tftpboot/c1130-k9w7-tar.default");
 		
 	//		send_image_file(wtpman->conn,"/home/tube/Downloads/c1130-k9w7-tar.123-8.JEA3.tar");
 //			send_image_file(wtpman->conn,"/home/tube/Downloads/c1130-k9w8-tar.124-25e.JAP.tar");
diff --git a/src/capwap/Makefile b/src/capwap/Makefile
index bfb87325..e3c954c3 100644
--- a/src/capwap/Makefile
+++ b/src/capwap/Makefile
@@ -83,8 +83,8 @@ CAPWAPOBJS= \
 	   cwsend_discovery_response.o \
 	   cwread_discovery_response.o \
 	   cwsend_discovery_request.o \
-	   cwread_image_data_request.o \
-	   cwsend_image_data_response.o \
+	cw_read_image_data_request.o \
+	cw_send_image_data_response.o \
 	   cwsend_join_request.o \
 	   cwsend_join_response.o \
 	   cwread_join_response.o \
diff --git a/src/capwap/capwap.h b/src/capwap/capwap.h
index 5e878e30..9f06cd0a 100644
--- a/src/capwap/capwap.h
+++ b/src/capwap/capwap.h
@@ -19,6 +19,7 @@
 #ifndef __CAPWAP_H
 #define __CAPWAP_H
 
+#include <stdio.h>
 #include <stdint.h>
 #include <arpa/inet.h>
 
@@ -116,8 +117,8 @@ struct capwap_ctrlhdr
 #define	CWMSG_JOIN_REQUEST			3 + CWIANA_ENTERPRISE_NUMBER*256
 #define CWMSG_JOIN_RESPONSE			4 + CWIANA_ENTERPRISE_NUMBER*256
 
-#define CWMSG_CONFIGURATION_STATUS_REQUEST	5 + CWIANA_ENTERPRISE_NUMBER*256
-#define CWMSG_CONFIGURATION_STATUS_RESPONSE	6 + CWIANA_ENTERPRISE_NUMBER*256
+#define CWMSG_CONFIGURATION_STATUS_REQUEST	5 
+#define CWMSG_CONFIGURATION_STATUS_RESPONSE	6
 
 #define CWMSG_CONFIGURATION_UPDATE_REQUEST	7
 #define CWMSG_CONFIGURATION_UPDATE_RESPONSE	8
@@ -128,11 +129,11 @@ struct capwap_ctrlhdr
 #define CWMSG_CHANGE_STATE_EVENT_REQUEST	11
 #define CWMSG_CHANGE_STATE_EVENT_RESPONSE	12
 
-#define CWMSG_ECHO_REQUEST			13 + CWIANA_ENTERPRISE_NUMBER*256
-#define CWMSG_ECHO_RESPONSE			14 + CWIANA_ENTERPRISE_NUMBER*256
+#define CWMSG_ECHO_REQUEST			13
+#define CWMSG_ECHO_RESPONSE			14
 
-#define CWMSG_IMAGE_DATA_REQUEST		15 + CWIANA_ENTERPRISE_NUMBER*256
-#define CWMSG_IMAGE_DATA_RESPONSE		16 + CWIANA_ENTERPRISE_NUMBER*256
+#define CWMSG_IMAGE_DATA_REQUEST		15 
+#define CWMSG_IMAGE_DATA_RESPONSE		16 
 
 #define CWMSG_RESET_REQUEST			17 + CWIANA_ENTERPRISE_NUMBER*256
 #define CWMSG_RESET_RESPONSE			18 + CWIANA_ENTERPRISE_NUMBER*256
@@ -348,17 +349,21 @@ extern int wtpinfo_set_radioinfo(struct wtpinfo * wtpinfo,uint8_t *msgelem, int
 #define AC_DTLS_POLICY_D		4	/* DTLS Data channel support */		
 
 
-struct image_data{
+
+struct cwimage_data{
 	uint8_t * data;
 	uint8_t type;
 	int len;
+	uint32_t vendor_id;
+	uint8_t *identifier;
 };
 
-struct image_identifier{
+/*
+struct cwimage_identifier{
 	uint32_t vendor_id;
 	char *name;
 };
-
+*/
 
 
 
@@ -393,9 +398,8 @@ extern void process_join_request(struct wtpinfo * wtpinfo, uint8_t * msg, int le
 extern void process_conf_status_request(struct wtpinfo * wtpinfo, uint8_t * msg, int len);
 
 extern void cwread_discovery_response(struct ac_info * acinfo, uint8_t * msg, int len);
-extern void cwread_image_data_request(struct ac_info * acinfo, uint8_t * msg, int len);
 extern void cwsend_image_data_response(struct conn * conn,int seqnum, int rc);
-extern int cwsend_image_data_request(struct conn * conn, struct image_data * data, struct image_identifier *id );
+extern int cwsend_image_data_request(struct conn * conn, struct cwimage_data * data, struct image_identifier *id );
 extern int cwread_change_state_event_request(struct wtpinfo * wtpinfo, uint8_t * msg, int len);
 extern void cwsend_change_state_event_response(struct conn * conn,int seqnum, struct radioinfo * radioinfo);
 extern int cwread_wtp_event_request(struct wtpinfo * wtpinfo, uint8_t * msg, int len);
@@ -467,15 +471,20 @@ extern int cw_readelem_vendor_specific_payload(void * data, int msgtype, int ele
       18 Message Unexpected (Invalid in Current State)
 
       19 Message Unexpected (Unrecognized Request)
+*/
 
-      20 Failure - Missing Mandatory Message Element
-
+#define CW_RESULT_MISSING_MAND_ELEM				20 
+/*
       21 Failure - Unrecognized Message Element
 
       22 Data Transfer Error (No Information to Transfer)
 
 */
 
+
+
+extern void cw_read_image_data_request(struct cwimage_data *, uint8_t * msg, int len);
+
 extern int cw_readelem_ac_descriptor(struct ac_info * acinfo,int type, uint8_t *msgelem, int len);
 extern int cw_readelem_capwap_local_ip_addr(struct sockaddr * local_ip, int type, uint8_t * msgelem, int len);
 
@@ -483,5 +492,7 @@ extern int cw_readelem_capwap_local_ip_addr(struct sockaddr * local_ip, int type
 
 extern int cw_send_echo_response(struct conn * conn,int seqnum,struct radioinfo * radioinfo);
 extern int cw_handle_echo_request(void * d);
+extern void cw_send_image_file(struct conn *conn, FILE *infile);
+
 
 #endif
diff --git a/src/capwap/conn.h b/src/capwap/conn.h
index 5c0d91da..ef1b3925 100644
--- a/src/capwap/conn.h
+++ b/src/capwap/conn.h
@@ -181,10 +181,10 @@ void connlist_destroy(struct connlist * cl);
 void conn_q_add_packet(struct conn * conn,uint8_t *packet,int len);
 
 struct image_identifier;
-struct image_data;
+struct cwimage_data;
 
 extern void conn_prepare_request(struct conn * conn, int type);
-extern int conn_prepare_image_data_request(struct conn * conn, struct image_data *, struct image_identifier *id );
+extern int conn_prepare_image_data_request(struct conn * conn, struct cwimage_data *, struct image_identifier *id );
 extern void conn_detect_capwap(struct conn * conn, struct wtpinfo * wtpinfo);
 struct cwrmsg * conn_send_request(struct conn * conn);
 struct cwrmsg * conn_wait_for_message(struct conn * conn, time_t timer);
diff --git a/src/capwap/conn_prepare_image_data_request.c b/src/capwap/conn_prepare_image_data_request.c
index cd545717..8b07a4f5 100644
--- a/src/capwap/conn_prepare_image_data_request.c
+++ b/src/capwap/conn_prepare_image_data_request.c
@@ -19,10 +19,9 @@
 #include "capwap.h"
 #include "lwapp.h"
 
-//#include "string.h"		//tube
 
 
-int conn_prepare_image_data_request(struct conn *conn, struct image_data *data,
+int conn_prepare_image_data_request(struct conn *conn, struct cwimage_data *data,
 				    struct image_identifier *id)
 {
 	struct cwmsg *cwmsg = &conn->req_msg;
diff --git a/src/capwap/cw_read_image_data_request.c b/src/capwap/cw_read_image_data_request.c
index 418e850a..efd9e246 100644
--- a/src/capwap/cw_read_image_data_request.c
+++ b/src/capwap/cw_read_image_data_request.c
@@ -3,7 +3,7 @@
 
     libcapwap is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
+    the Free Software Foundation, either version 3 of the License, or
     (at your option) any later version.
 
     libcapwap is distributed in the hope that it will be useful,
@@ -16,64 +16,59 @@
 
 */
 
+/**
+ *@file
+ *@brief Image Data handling
+ */
+#include <string.h>
+
 #include "capwap.h"
-#include "acinfo.h"
 
 #include "cw_log.h"
 #include "cw_util.h"
 
-#include <stdio.h> // tube
+#include <stdio.h> 
 
-int cw_readelem_image_identifier(uint8_t **dst, int type,uint8_t *msgelem, int len)
+int cw_readelem_image_identifier(struct cwimage_data *data, int type,uint8_t *msgelem, int len)
 {
 	if (type != CWMSGELEM_IMAGE_IDENTIFIER)
 		return 0;
 
-	uint32_t vendor_id = ntohl(*((uint32_t*)msgelem));
-	printf("Vendor id %d\n",vendor_id);
-	
-	int i;
-	for(i=0; i<len; i++){
-		printf("%c",msgelem[i]);
+	data->vendor_id = ntohl(*((uint32_t*)msgelem));
+
+	if (len >= 1024) {
+		cw_dbg(DBG_CW_MSG_ERR,"Image identifier too long (>1024), truncating");
+		len = 1024;
+	}
+	
+	if ( data->identifier ){
+		memcpy(data->identifier,msgelem,len);
+		*(data->identifier+len)=0;
 	}
-	printf("\n");
 
 	return 1;
 }
 
-static int imgdata_request(void * a,int type,uint8_t* msgelem,int len)
+static int imgdata_request(void * ptr,int type,uint8_t* msgelem,int len)
 {
-printf("HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH oioioioioi here\n");
-	cw_dbg_msgelem(CWMSG_DISCOVERY_REQUEST, type, msgelem, len);
+	cw_dbg_msgelem(CWMSG_IMAGE_DATA_REQUEST, type, msgelem, len);
+
 
-//	struct ac_info * acinfo = (struct ac_info *)a;
 	cw_dbg(DBG_ALL,"Reading image data req msgelem, type=%d - %s ,len=%d\n",type,cw_msgelemtostr(type),len);
 
-	if (cw_readelem_image_identifier(0,type,msgelem,len))
+	if (cw_readelem_image_identifier(ptr,type,msgelem,len))
 		return 1;
 
-/*	if (acinfo_readelem_ac_descriptor(acinfo,type,msgelem,len)) 
-		return 1;
-
-	if (acinfo_readelem_ac_name(acinfo,type,msgelem,len)) 
-		return 1;
-	
-	if (acinfo_readelem_ctrl_ip_addr(acinfo,type,msgelem,len)) 
-		return 1;
-*/
 	return 0;
 }
 
 
-
-void cwread_image_data_request(struct ac_info * acinfo, uint8_t * msg, int len)
+/**
+ * Read an image data request message
+ */
+void cw_read_image_data_request(struct cwimage_data *data, uint8_t * msg, int len)
 {
-	printf("RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRrrr im data eqi\n");
-	printf("RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRrrr im data eqi\n");
-	printf("RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRrrr im data eqi\n");
-	printf("RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRrrr im data eqi\n");
-	printf("RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRrrr im data eqi\n");
-	cw_foreach_msgelem(msg,len,imgdata_request,NULL);
+	cw_foreach_msgelem(msg,len,imgdata_request,data);
 }
 
 
diff --git a/src/capwap/cwsend_image_data_response.c b/src/capwap/cw_send_image_data_response.c
similarity index 88%
rename from src/capwap/cwsend_image_data_response.c
rename to src/capwap/cw_send_image_data_response.c
index 1f80ba77..1832c845 100644
--- a/src/capwap/cwsend_image_data_response.c
+++ b/src/capwap/cw_send_image_data_response.c
@@ -17,12 +17,17 @@
 
 */
 
+/**
+ * @file 
+ * @brief Implements cw_send_image_data_response
+ */
+
 #include "sock.h"
 #include "capwap.h"
 #include "cw_log.h"
 
 
-void cwsend_image_data_response(struct conn * conn,int seqnum, int rc)
+void cw_send_image_data_response(struct conn * conn,int seqnum, int rc)
 {
 	cw_dbg(DBG_CW_MSG,"Sending image data response to %s, seq = %d",sock_addr2str(&conn->addr),seqnum);
 
diff --git a/src/capwap/cw_send_image_file.c b/src/capwap/cw_send_image_file.c
index 5ab77c33..83c55d50 100644
--- a/src/capwap/cw_send_image_file.c
+++ b/src/capwap/cw_send_image_file.c
@@ -38,8 +38,10 @@
  * Send an image file to an AP
  * 
  */ 
-void cw_send_image_file(struct conn *conn, const char *filename)
+void cw_send_image_file(struct conn *conn, FILE *infile)
 {
+
+/*
 	FILE *infile;
 	infile = fopen(filename, "rb");
 	if (!infile) {
@@ -49,10 +51,12 @@ void cw_send_image_file(struct conn *conn, const char *filename)
 
 
 	cw_log(LOG_INFO, "Sending image file %s to %s", filename, sock_addr2str(&conn->addr));
+*/
 
 	struct cwrmsg *cwrmsg;
 	uint8_t buffer[1024];	/* buffer MUST be 1024 */
-	struct image_data data;
+	struct cwimage_data data;
+	memset(&data,0,sizeof(struct cwimage_data));
 	data.data = buffer;
 
 
@@ -87,5 +91,4 @@ void cw_send_image_file(struct conn *conn, const char *filename)
 
 	} while (!feof(infile));
 
-	fclose(infile);
 }
diff --git a/src/capwap/cwmsg.h b/src/capwap/cwmsg.h
index 173d400b..cf7a6d8c 100644
--- a/src/capwap/cwmsg.h
+++ b/src/capwap/cwmsg.h
@@ -5,6 +5,7 @@
 
 #include "radioinfo.h"
 #include "acinfo.h"
+#include "wtpinfo.h"
 
 struct cwmsg{
 	uint8_t * buffer;
@@ -28,7 +29,7 @@ extern void cwmsg_init(struct cwmsg * cwmsg, uint8_t *buffer, int type, int seqn
 extern void cwmsg_addelem(struct cwmsg *msg,int type, const uint8_t *elem, int len);
 extern void cwmsg_vaddelem(struct cwmsg *msg,int type,int n, ...);
 
-extern void cwmsg_addelem_ac_descriptor(struct cwmsg *msg,struct ac_info * acinfo);
+extern void cwmsg_addelem_ac_descriptor(struct cwmsg *msg,struct ac_info * acinfo,struct wtpinfo * wtpinfo);
 extern void cwmsg_addelem_ac_timestamp(struct cwmsg *msg);
 
 
diff --git a/src/capwap/cwmsg_addelem_ac_descriptor.c b/src/capwap/cwmsg_addelem_ac_descriptor.c
index 1b706c63..788cc875 100644
--- a/src/capwap/cwmsg_addelem_ac_descriptor.c
+++ b/src/capwap/cwmsg_addelem_ac_descriptor.c
@@ -23,6 +23,7 @@
 
 #include <string.h>
 #include "capwap.h"
+#include "wtpinfo.h"
 
 
 static int add_subelem(uint8_t * buffer,int type, uint32_t vendor,bstr_t version)
@@ -40,8 +41,9 @@ static int add_subelem(uint8_t * buffer,int type, uint32_t vendor,bstr_t version
  * Add an ac descriptor message element.
  * @param msg pointer to the message
  * @param acinfo acinfo structure where data is taken from
+ * @param wtpinfo WTP which whants the AC descriptor
  */
-void cwmsg_addelem_ac_descriptor(struct cwmsg *msg,struct ac_info * acinfo)
+void cwmsg_addelem_ac_descriptor(struct cwmsg *msg,struct ac_info * acinfo,struct wtpinfo *wtpinfo)
 {
 	uint8_t buffer[600];
 	uint8_t * acd = buffer;
@@ -55,14 +57,29 @@ void cwmsg_addelem_ac_descriptor(struct cwmsg *msg,struct ac_info * acinfo)
 
 	switch (msg->capwap_mode){
 		case CWMODE_CISCO:
+		{
+
+			/* If no cisco software version is set, take software version
+			  from WTP */
+			bstr_t c_version;
+			if (!acinfo->cisco_software_version)
+				c_version = wtpinfo->software_version;
+			else	
+				c_version = acinfo->cisco_software_version;
+		
+			/* If we don't have a WTP software version, use normal software
+			   version, not cisco software version */ 	
+			if (!c_version)
+				c_version=acinfo->software_version;
+				
 			/* It seems to be very important, that the software version sub-elemnt is 
-			   sent first. If not, the WTP gets confused and thinks the AP has
+			   sent first. If not, the Cisco WTP gets confused and thinks the AP has
 			   version 0.0.0.0. Tested with an 8.0.110.0 image on a LAP 1131a */
 
-			len+=add_subelem(buffer+len,1,CW_VENDOR_ID_CISCO,acinfo->cisco_software_version);
+			len+=add_subelem(buffer+len,1,CW_VENDOR_ID_CISCO,c_version);
 			len+=add_subelem(buffer+len,0,CW_VENDOR_ID_CISCO,acinfo->cisco_hardware_version);
-
 			break;
+		}
 		default:
 			len+=add_subelem(buffer+len,5,0,acinfo->software_version);
 			len+=add_subelem(buffer+len,4,0,acinfo->hardware_version);
diff --git a/src/capwap/cwsend_discovery_response.c b/src/capwap/cwsend_discovery_response.c
index a4d705ad..73891b87 100644
--- a/src/capwap/cwsend_discovery_response.c
+++ b/src/capwap/cwsend_discovery_response.c
@@ -29,20 +29,23 @@
 
 #include "cw_log.h"
 
-void cwsend_discovery_response(struct conn * conn,int seqnum, struct radioinfo * radioinfo,  struct ac_info * acinfo, struct wtpinfo * wtpinfo)
+void cwsend_discovery_response(struct conn *conn, int seqnum, struct radioinfo *radioinfo,
+			       struct ac_info *acinfo, struct wtpinfo *wtpinfo)
 {
-	cw_dbg(DBG_CW_MSG,"Sending discovery response to %s, seq = %d",sock_addr2str(&conn->addr),seqnum);
+	cw_dbg(DBG_CW_MSG, "Sending discovery response to %s, seq = %d", sock_addr2str(&conn->addr),
+	       seqnum);
 
-	struct cwmsg * cwmsg = &conn->resp_msg;	
-	cwmsg_init(cwmsg,conn->resp_buffer,CWMSG_DISCOVERY_RESPONSE,seqnum,NULL);
+	struct cwmsg *cwmsg = &conn->resp_msg;
+	cwmsg_init(cwmsg, conn->resp_buffer, CWMSG_DISCOVERY_RESPONSE, seqnum, NULL);
 	cwmsg->capwap_mode = conn->capwap_mode;
 
-	
-	cwmsg_addelem_ac_descriptor(cwmsg,acinfo);
-	cwmsg_addelem(cwmsg,CWMSGELEM_AC_NAME,(uint8_t*)acinfo->ac_name,strlen((char*)acinfo->ac_name));
 
-	cwmsg_addelem_wtp_radio_infos(cwmsg,acinfo->radioinfos);
-	cwmsg_addelem_ctrl_ip_addrs(cwmsg,acinfo);
+	cwmsg_addelem_ac_descriptor(cwmsg, acinfo,wtpinfo);
+	cwmsg_addelem(cwmsg, CWMSGELEM_AC_NAME, (uint8_t *) acinfo->ac_name,
+		      strlen((char *) acinfo->ac_name));
+
+	cwmsg_addelem_wtp_radio_infos(cwmsg, acinfo->radioinfos);
+	cwmsg_addelem_ctrl_ip_addrs(cwmsg, acinfo);
 
 
 	/* Send Cisco-specific message elements if needed  */
@@ -53,11 +56,10 @@ void cwsend_discovery_response(struct conn * conn,int seqnum, struct radioinfo *
 			break;
 		default:
 			break;
-		
+
 	}
 
 
-	
-	conn_send_response(conn,cwmsg,seqnum);
-}
 
+	conn_send_response(conn, cwmsg, seqnum);
+}
diff --git a/src/capwap/cwsend_join_response.c b/src/capwap/cwsend_join_response.c
index 12c32836..0c09b22b 100644
--- a/src/capwap/cwsend_join_response.c
+++ b/src/capwap/cwsend_join_response.c
@@ -6,47 +6,46 @@
 #include "capwap_cisco.h"
 #include "conn.h"
 
-void cwsend_join_response(struct conn * conn,int seqnum, int rc, struct radioinfo * radioinfo, struct ac_info * acinfo, struct wtpinfo * wtpinfo)
+void cwsend_join_response(struct conn *conn, int seqnum, int rc, struct radioinfo *radioinfo,
+			  struct ac_info *acinfo, struct wtpinfo *wtpinfo)
 {
-	struct cwmsg * cwmsg = &conn->resp_msg;	
-	cwmsg_init(cwmsg,conn->resp_buffer,CWMSG_JOIN_RESPONSE,seqnum,NULL);
-	cwmsg->capwap_mode=conn->capwap_mode;
+	struct cwmsg *cwmsg = &conn->resp_msg;
+	cwmsg_init(cwmsg, conn->resp_buffer, CWMSG_JOIN_RESPONSE, seqnum, NULL);
+	cwmsg->capwap_mode = conn->capwap_mode;
 
 	/* mandatory messagesg elements */
-	cwmsg_addelem_result_code(cwmsg,rc);
-	cwmsg_addelem_ac_descriptor(cwmsg,acinfo);
-	cwmsg_addelem(cwmsg,CWMSGELEM_AC_NAME,acinfo->ac_name,strlen((char*)acinfo->ac_name));
-	cwmsg_addelem(cwmsg,CWMSGELEM_ECN_SUPPORT,&acinfo->ecn_support,sizeof(uint8_t));
-	cwmsg_addelem_ctrl_ip_addrs(cwmsg,acinfo);
-//	cwmsg_addelem_cw_local_ip_addr(cwmsg,conn);
+	cwmsg_addelem_result_code(cwmsg, rc);
+
+	cwmsg_addelem_ac_descriptor(cwmsg, acinfo,wtpinfo);
+	cwmsg_addelem(cwmsg, CWMSGELEM_AC_NAME, acinfo->ac_name, strlen((char *) acinfo->ac_name));
+	cwmsg_addelem(cwmsg, CWMSGELEM_ECN_SUPPORT, &acinfo->ecn_support, sizeof(uint8_t));
+	cwmsg_addelem_ctrl_ip_addrs(cwmsg, acinfo);
+//      cwmsg_addelem_cw_local_ip_addr(cwmsg,conn);
 
 
 	/* */
-//	cwmsg_addelem_image_identifier(cwmsg,CW_VENDOR_ID_CISCO,(uint8_t*)"/tobias",strlen("/tobias"));
+//      cwmsg_addelem_image_identifier(cwmsg,CW_VENDOR_ID_CISCO,(uint8_t*)"/tobias",strlen("/tobias"));
 
 
-	uint8_t buffer[]="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
-	buffer[0]=0;	/* Mwar Type */
-	buffer[1]=1;	/* h/w version */
-	buffer[2]=2;	/* h/w Release */
-	buffer[3]=0;	/* h/w Maint */
-	buffer[4]=3;	/* h/w Build */
+	uint8_t buffer[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+	buffer[0] = 0;		/* Mwar Type */
+	buffer[1] = 1;		/* h/w version */
+	buffer[2] = 2;		/* h/w Release */
+	buffer[3] = 0;		/* h/w Maint */
+	buffer[4] = 3;		/* h/w Build */
 
-	buffer[5]=5;	/* s/w version */
-	buffer[6]=0;	/* s/w Release */
-	buffer[7]=19;	/* s/w Maint */
-	buffer[8]=2;	/* s/w Build */
+	buffer[5] = 5;		/* s/w version */
+	buffer[6] = 0;		/* s/w Release */
+	buffer[7] = 19;		/* s/w Maint */
+	buffer[8] = 2;		/* s/w Build */
 
-	*((uint16_t*)(buffer+9))=htons(13); /* Active MS */
-	*((uint16_t*)(buffer+9+2))=htons(23); /* Supported MS */
-	*((uint16_t*)(buffer+9+4))=htons(5); /* Active RAD's */
-	*((uint16_t*)(buffer+9+6))=htons(15); /* Supported RAD's */
-//	cwmsg_addelem_vendor_specific_payload(cwmsg,CW_VENDOR_ID_CISCO, CWVENDOR_CISCO_MWAR, buffer,34);
+	*((uint16_t *) (buffer + 9)) = htons(13);	/* Active MS */
+	*((uint16_t *) (buffer + 9 + 2)) = htons(23);	/* Supported MS */
+	*((uint16_t *) (buffer + 9 + 4)) = htons(5);	/* Active RAD's */
+	*((uint16_t *) (buffer + 9 + 6)) = htons(15);	/* Supported RAD's */
+//      cwmsg_addelem_vendor_specific_payload(cwmsg,CW_VENDOR_ID_CISCO, CWVENDOR_CISCO_MWAR, buffer,34);
 
-	
-	conn_send_response(conn,cwmsg,seqnum);
+
+	conn_send_response(conn, cwmsg, seqnum);
 
 }
-
-
-
diff --git a/src/capwap/wtpinfo_print.c b/src/capwap/wtpinfo_print.c
index 6c3967b2..c3ef79d7 100644
--- a/src/capwap/wtpinfo_print.c
+++ b/src/capwap/wtpinfo_print.c
@@ -209,7 +209,11 @@ for (i0=0; i0<10; i0++){
 
 
 	s+=sprintf (s,"\tSoftware Version: ");
-	s+=version_print(s,wtpinfo->software_version,wtpinfo->software_version_len,wtpinfo->software_vendor_id);
+//	s+=version_print(s,wtpinfo->software_version,wtpinfo->software_version_len,wtpinfo->software_vendor_id);
+	s+=cw_format_version(s,wtpinfo->software_version,wtpinfo->software_vendor_id,"Not set");
+	s+=sprintf (s,"\n");
+
+
 	s+=sprintf (s,"\tHardware Version: ");
 	s+=version_print(s,wtpinfo->hardware_version,wtpinfo->hardware_version_len,wtpinfo->hardware_vendor_id);
 	s+=sprintf (s,"\tBootloader Version: ");
diff --git a/src/capwap/wtpinfo_readelem_wtp_descriptor.c b/src/capwap/wtpinfo_readelem_wtp_descriptor.c
index f4785822..8023eb7a 100644
--- a/src/capwap/wtpinfo_readelem_wtp_descriptor.c
+++ b/src/capwap/wtpinfo_readelem_wtp_descriptor.c
@@ -92,7 +92,8 @@ static int wtpinfo_readelem_wtp_descriptor_(struct wtpinfo * wtpinfo, int type,
 				break;
 			case CWMSGSUBELEM_WTP_DESCRIPTOR_SOFTWARE_VERSION:
 				wtpinfo->software_vendor_id=vendor_id;
-				cw_setstr(&wtpinfo->software_version,msgelem+i,sublen);
+
+				bstr_replace(&wtpinfo->software_version,bstr_create(msgelem+i,sublen));
 				wtpinfo->software_version_len=sublen;
 				break;
 			case CWMSGSUBELEM_WTP_DESCRIPTOR_BOOTLOADER_VERSION: