diff --git a/daemon/kernel.c b/daemon/kernel.c
index 45a4db352..0d4fc633c 100644
--- a/daemon/kernel.c
+++ b/daemon/kernel.c
@@ -92,6 +92,7 @@ static int kernel_open_table(unsigned int id) {
 			[REMG_PACKET] = sizeof(struct rtpengine_command_packet),
 			[REMG_GET_STATS] = sizeof(struct rtpengine_command_stats),
 			[REMG_GET_RESET_STATS] = sizeof(struct rtpengine_command_stats),
+			[REMG_SEND_RTCP] = sizeof(struct rtpengine_command_send_packet),
 		},
 	};
 
diff --git a/kernel-module/xt_RTPENGINE.c b/kernel-module/xt_RTPENGINE.c
index 1ec80b53b..60f7fb47b 100644
--- a/kernel-module/xt_RTPENGINE.c
+++ b/kernel-module/xt_RTPENGINE.c
@@ -188,6 +188,7 @@ struct re_call;
 struct re_stream;
 struct rtpengine_table;
 struct crypto_aead;
+struct rtpengine_output;
 
 
 
@@ -286,6 +287,11 @@ static int srtp_decrypt_aes_gcm(struct re_crypto_context *, struct rtpengine_srt
 static int srtcp_decrypt_aes_gcm(struct re_crypto_context *, struct rtpengine_srtp *,
 		struct rtp_parsed *, uint64_t *);
 
+static int send_proxy_packet_output(struct sk_buff *skb, struct rtpengine_target *g,
+		int rtp_pt_idx,
+		struct rtpengine_output *o, struct rtp_parsed *rtp, int ssrc_idx,
+		const struct xt_action_param *par);
+
 static void call_put(struct re_call *call);
 static void del_stream(struct re_stream *stream, struct rtpengine_table *);
 static void del_call(struct re_call *call, struct rtpengine_table *);
@@ -502,6 +508,7 @@ struct rtp_parsed {
 	unsigned char			*payload;
 	unsigned int			payload_len;
 	int				ok;
+	int				rtcp;
 };
 
 
@@ -3625,6 +3632,74 @@ static int target_find_ssrc(struct rtpengine_target *g, uint32_t ssrc) {
 	return -2;
 }
 
+static int table_send_rtcp(struct rtpengine_table *t, const struct rtpengine_send_packet_info *info, size_t len)
+{
+	struct rtpengine_target *g;
+	int err = 0;
+	unsigned long flags;
+	struct rtpengine_output *o;
+	struct sk_buff *skb;
+	struct rtp_parsed rtp;
+	int ssrc_idx = -1;
+	const char *data = info->data;
+
+	g = get_target(t, &info->local);
+	if (!g)
+		return -ENOENT;
+
+	err = -ERANGE;
+	if (info->destination_idx >= g->target.num_destinations)
+		goto out;
+
+	_r_lock(&g->outputs_lock, flags);
+	if (g->outputs_unfilled) {
+		_r_unlock(&g->outputs_lock, flags);
+		err = -ENODATA;
+		goto out;
+	}
+
+	o = &g->outputs[info->destination_idx];
+	_r_unlock(&g->outputs_lock, flags);
+
+	// double check addresses for confirmation
+	err = -EBADSLT;
+	if (memcmp(&info->src_addr, &o->output.src_addr, sizeof(o->output.src_addr)))
+		goto out;
+	if (memcmp(&info->dst_addr, &o->output.dst_addr, sizeof(o->output.dst_addr)))
+		goto out;
+
+	err = -ENOMEM;
+	skb = alloc_skb(len + MAX_HEADER + MAX_SKB_TAIL_ROOM, GFP_KERNEL);
+	if (!skb)
+		goto out;
+
+	// reserve head room and copy data in
+	skb_reserve(skb, MAX_HEADER);
+	memcpy(skb_put(skb, len), data, len);
+
+	// rudimentarily set up header
+	memset(&rtp, 0, sizeof(rtp));
+	if (len >= sizeof(struct rtcp_header)) {
+		rtp.rtcp_header = (void *) skb->data;
+		rtp.header_len = sizeof(struct rtcp_header);
+		rtp.payload = skb->data + sizeof(struct rtcp_header);
+		rtp.payload_len = skb->len - sizeof(struct rtcp_header);
+		rtp.rtcp = 1;
+		ssrc_idx = target_find_ssrc(g, rtp.rtcp_header->ssrc);
+		if (ssrc_idx == -2) {
+			kfree_skb(skb);
+			err = -ENOSYS;
+			goto out;
+		}
+	}
+
+	err = send_proxy_packet_output(skb, g, 0, o, &rtp, ssrc_idx, NULL);
+
+out:
+	target_put(g);
+	return err;
+}
+
 
 
 
@@ -3641,6 +3716,7 @@ static const size_t min_req_sizes[__REMG_LAST] = {
 	[REMG_PACKET]		= sizeof(struct rtpengine_command_packet),
 	[REMG_GET_STATS]	= sizeof(struct rtpengine_command_stats),
 	[REMG_GET_RESET_STATS]	= sizeof(struct rtpengine_command_stats),
+	[REMG_SEND_RTCP]	= sizeof(struct rtpengine_command_send_packet),
 
 };
 static const size_t max_req_sizes[__REMG_LAST] = {
@@ -3656,6 +3732,7 @@ static const size_t max_req_sizes[__REMG_LAST] = {
 	[REMG_PACKET]		= sizeof(struct rtpengine_command_packet) + 65535,
 	[REMG_GET_STATS]	= sizeof(struct rtpengine_command_stats),
 	[REMG_GET_RESET_STATS]	= sizeof(struct rtpengine_command_stats),
+	[REMG_SEND_RTCP]	= sizeof(struct rtpengine_command_send_packet) + 65535,
 };
 static const size_t input_req_sizes[__REMG_LAST] = {
 	[REMG_GET_STATS]	= sizeof(struct rtpengine_command_stats) - sizeof(struct rtpengine_stats_info),
@@ -3688,6 +3765,7 @@ static inline ssize_t proc_control_read_write(struct file *file, char __user *ub
 		struct rtpengine_command_del_stream *del_stream;
 		struct rtpengine_command_packet *packet;
 		struct rtpengine_command_stats *stats;
+		struct rtpengine_command_send_packet *send_packet;
 
 		char *storage;
 	} msg;
@@ -3811,6 +3889,10 @@ static inline ssize_t proc_control_read_write(struct file *file, char __user *ub
 			err = stream_packet(t, &msg.packet->packet, buflen - sizeof(*msg.packet));
 			break;
 
+		case REMG_SEND_RTCP:
+			err = table_send_rtcp(t, &msg.send_packet->send_packet, buflen - sizeof(*msg.send_packet));
+			break;
+
 		default:
 			printk(KERN_WARNING "xt_RTPENGINE unimplemented op %u\n", cmd);
 			err = -EINVAL;
@@ -4912,7 +4994,30 @@ static struct sk_buff *intercept_skb_copy(struct sk_buff *oskb, const struct re_
 	return ret;
 }
 
-static void proxy_packet_output_rtp(struct sk_buff *skb, struct rtpengine_output *o,
+static void proxy_packet_output_rtcp(struct sk_buff *skb, struct rtpengine_output *o,
+		struct rtp_parsed *rtp, int ssrc_idx)
+{
+	unsigned int pllen;
+	uint64_t pkt_idx;
+	unsigned long flags;
+
+	if (!rtp->rtcp)
+		return;
+
+	// SRTCP
+	if (unlikely(ssrc_idx < 0))
+		ssrc_idx = 0;
+
+	spin_lock_irqsave(&o->encrypt_rtcp.lock, flags);
+	pkt_idx = o->output.encrypt.last_rtcp_index[ssrc_idx]++;
+	spin_unlock_irqrestore(&o->encrypt_rtcp.lock, flags);
+	pllen = rtp->payload_len;
+	srtcp_encrypt(&o->encrypt_rtcp, &o->output.encrypt, rtp, pkt_idx);
+	srtcp_authenticate(&o->encrypt_rtcp, &o->output.encrypt, rtp, pkt_idx);
+	skb_put(skb, rtp->payload_len - pllen);
+}
+
+static void proxy_packet_output_rtXp(struct sk_buff *skb, struct rtpengine_output *o,
 		int rtp_pt_idx,
 		struct rtp_parsed *rtp, int ssrc_idx)
 {
@@ -4920,8 +5025,10 @@ static void proxy_packet_output_rtp(struct sk_buff *skb, struct rtpengine_output
 	uint64_t pkt_idx;
 	int i;
 
-	if (!rtp->ok)
+	if (!rtp->ok) {
+		proxy_packet_output_rtcp(skb, o, rtp, ssrc_idx);
 		return;
+	}
 
 	// pattern rewriting
 	if (rtp_pt_idx >= 0 && o->output.pt_output[rtp_pt_idx].replace_pattern_len) {
@@ -4958,7 +5065,7 @@ static int send_proxy_packet_output(struct sk_buff *skb, struct rtpengine_target
 		struct rtpengine_output *o, struct rtp_parsed *rtp, int ssrc_idx,
 		const struct xt_action_param *par)
 {
-	proxy_packet_output_rtp(skb, o, rtp_pt_idx, rtp, ssrc_idx);
+	proxy_packet_output_rtXp(skb, o, rtp_pt_idx, rtp, ssrc_idx);
 	return send_proxy_packet(skb, &o->output.src_addr, &o->output.dst_addr, o->output.tos, par);
 }
 
diff --git a/kernel-module/xt_RTPENGINE.h b/kernel-module/xt_RTPENGINE.h
index f0a65d9bc..c1b1b1b9a 100644
--- a/kernel-module/xt_RTPENGINE.h
+++ b/kernel-module/xt_RTPENGINE.h
@@ -190,6 +190,7 @@ enum rtpengine_command {
 	REMG_GET_STATS,
 	REMG_GET_RESET_STATS,
 	REMG_DEL_TARGET_STATS,
+	REMG_SEND_RTCP,
 
 	__REMG_LAST
 };
@@ -199,6 +200,14 @@ struct rtpengine_noop_info {
 	size_t				msg_size[__REMG_LAST];
 };
 
+struct rtpengine_send_packet_info {
+	struct re_address		local;
+	unsigned int			destination_idx;
+	struct re_address		src_addr;
+	struct re_address		dst_addr;
+	unsigned char			data[];
+};
+
 struct rtpengine_command_noop {
 	enum rtpengine_command		cmd;
 	struct rtpengine_noop_info	noop;
@@ -256,6 +265,11 @@ struct rtpengine_command_stats {
 	struct rtpengine_stats_info	stats;		// output
 };
 
+struct rtpengine_command_send_packet {
+	enum rtpengine_command		cmd;
+	struct rtpengine_send_packet_info send_packet;
+};
+
 struct rtpengine_list_entry {
 	struct rtpengine_target_info	target;
 	struct rtpengine_stats		stats_in;
diff --git a/tests/kernel-module-test.c b/tests/kernel-module-test.c
index 0ee7efa0b..83e305103 100644
--- a/tests/kernel-module-test.c
+++ b/tests/kernel-module-test.c
@@ -1,4 +1,5 @@
 #include <stdio.h>
+#include <stdlib.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
@@ -9,19 +10,29 @@
 #include <arpa/inet.h>
 #include <string.h>
 #include <signal.h>
-#include "../kernel-module/xt_RTPENGINE.h"
+#include <errno.h>
+#include "xt_RTPENGINE.h"
 
 #define NUM_SOCKETS 41
 #define PORT_BASE 37526
 #define LOCALHOST htonl(0x7f000001)
 #define LEN(x) (sizeof(x)-1)
 
-#define MSG(op, args...) \
+#define MSGLEN(op, buf, len, args...) \
 	printf("exec %s:%i\n", __FILE__, __LINE__); \
-	rm = (struct rtpengine_message) { .cmd = op, .u = { args } }; \
-	ret = write(fd, &rm, sizeof(rm)); \
+	rm = malloc(sizeof(*rm) + len); \
+	*rm = (struct rtpengine_message) { .cmd = op, .u = { args } }; \
+	if (len) \
+		memcpy(&rm->data, buf, len); \
+	ret = write(fd, rm, sizeof(*rm) + len); \
 	printf("ret = %i\n", ret); \
-	assert(ret == sizeof(rm));
+	if (ret == -1) \
+		printf("errno = %s\n", strerror(errno)); \
+	assert(ret == sizeof(*rm) + len); \
+	free(rm);
+
+#define MSG(op, args...) MSGLEN(op, NULL, 0, args)
+#define MSGBUF(op, buf, args...) MSGLEN(op, buf, LEN(buf), args)
 
 #define SND(sock, port, data) \
 	printf("exec %s:%i\n", __FILE__, __LINE__); \
@@ -77,12 +88,12 @@ int main(void) {
 	int fd = open("/proc/rtpengine/0/control", O_RDWR);
 	assert(fd != -1);
 
-	struct rtpengine_message rm;
+	struct rtpengine_message *rm;
 	int ret;
 
 	MSG(REMG_NOOP,
 		.noop = {
-			.size = sizeof(rm),
+			.size = sizeof(*rm),
 			.last_cmd = __REMG_LAST,
 		},
 	);
@@ -218,6 +229,36 @@ int main(void) {
 	SND(40, 2, "three");
 	EXPF(4, "three", 3);
 
+	// RTCP output
+	MSGBUF(REMG_SEND_RTCP,
+		"foo",
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 2,
+			},
+			.destination_idx = 0,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 3,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 4,
+			},
+		},
+	);
+	EXPF(4, "foo", 3);
+
 	// multi forwarding, incomplete
 	MSG(REMG_ADD_TARGET,
 		.target = {
@@ -371,6 +412,126 @@ int main(void) {
 	EXPF(10, "five", 9);
 	EXPF(12, "five", 11);
 
+	// RTCP output
+	MSGLEN(REMG_SEND_RTCP,
+		"foo",
+		3,
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 8,
+			},
+			.destination_idx = 0,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 9,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 10,
+			},
+		},
+	);
+	EXPF(10, "foo", 9);
+
+	MSGLEN(REMG_SEND_RTCP,
+		"foo",
+		3,
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 8,
+			},
+			.destination_idx = 1,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 11,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 12,
+			},
+		},
+	);
+	EXPF(12, "foo", 11);
+
+	// RTCP output
+	MSGBUF(REMG_SEND_RTCP,
+		"foo",
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 8,
+			},
+			.destination_idx = 0,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 9,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 10,
+			},
+		},
+	);
+	EXPF(10, "foo", 9);
+
+	MSGBUF(REMG_SEND_RTCP,
+		"foo",
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 8,
+			},
+			.destination_idx = 1,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 11,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 12,
+			},
+		},
+	);
+	EXPF(12, "foo", 11);
+
 	// multi forwarding RTP/SRTP
 	MSG(REMG_ADD_TARGET,
 		.target = {
@@ -470,12 +631,12 @@ int main(void) {
 					.session_key_len = 16,
 					.session_salt_len = 14,
 					.rtp_auth_tag_len = 10,
+					.rtcp_auth_tag_len = 10,
 					.master_key = {0xe1, 0xf9, 0x7a, 0x0d, 0x3e, 0x01, 0x8b, 0xe0,
 						0xd6, 0x4f, 0xa3, 0x2c, 0x06, 0xde, 0x41, 0x39},
 					.master_salt = {0x0e, 0xc6, 0x75, 0xad, 0x49, 0x8a, 0xfe, 0xeb,
 						0xb6, 0x96, 0x0b, 0x3a, 0xab, 0xe6},
 				},
-				.ssrc_out = 0x11223344, // ignored
 			},
 		},
 	);
@@ -544,6 +705,7 @@ int main(void) {
 					.session_key_len = 16,
 					.session_salt_len = 14,
 					.rtp_auth_tag_len = 10,
+					.rtcp_auth_tag_len = 10,
 					.master_key = {0xe1, 0xf9, 0x7a, 0x0d, 0x3e, 0x01, 0x8b, 0xe0,
 						0xd6, 0x4f, 0xa3, 0x2c, 0x06, 0xde, 0x41, 0x39},
 					.master_salt = {0x0e, 0xc6, 0x75, 0xad, 0x49, 0x8a, 0xfe, 0xeb,
@@ -559,6 +721,123 @@ int main(void) {
 	EXPF(19, "\x80\x0f\x12\x34\xde\xca\xfb\xad\xca\xfe\xba\xbe\xab\xab\xab\xab\xab\xab\xab\xab\xab\xab\xab\xab\xab\xab\xab\xab", 18);
 	EXPF(21, "\x80\x0f\x12\x34\xde\xca\xfb\xad\xca\xfe\xba\xbe\x4e\x55\xdc\x4c\xe7\x99\x78\xd8\x8c\xa4\xd2\x15\x94\x9d\x24\x02\xb7\x8d\x6a\xcc\x99\xea\x17\x9b\x8d\xbb", 20);
 
+	// RTCP/SRTCP output
+	MSGBUF(REMG_SEND_RTCP,
+		"\x81\xc8\x00\x0c\x00\x00\x16\x1cxxxxxxxx\x00\x00\x26\xc0\x00\x00\x00\x25\x00\x00\x18\xdc\x00\x00\x12\x34\x06\x00\x00\x01\x00\x00\x04\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05\x00\x00\x16\x1c\x01\x0cqwertyuiopas\x00\x00",
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 13,
+			},
+			.destination_idx = 0,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 14,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 15,
+			},
+		},
+	);
+	EXPF(15, "\x81\xc8\x00\x0c\x00\x00\x16\x1cxxxxxxxx\x00\x00\x26\xc0\x00\x00\x00\x25\x00\x00\x18\xdc\x00\x00\x12\x34\x06\x00\x00\x01\x00\x00\x04\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05\x00\x00\x16\x1c\x01\x0cqwertyuiopas\x00\x00", 14);
+
+	MSGBUF(REMG_SEND_RTCP,
+		"\x81\xc8\x00\x0c\x00\x00\x16\x1cxxxxxxxx\x00\x00\x26\xc0\x00\x00\x00\x25\x00\x00\x18\xdc\x00\x00\x12\x34\x06\x00\x00\x01\x00\x00\x04\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05\x00\x00\x16\x1c\x01\x0cqwertyuiopas\x00\x00",
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 13,
+			},
+			.destination_idx = 1,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 16,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 17,
+			},
+		},
+	);
+	EXPF(17, "\x81\xc8\x00\x0c\x00\x00\x16\x1c\x1c\xbb\xae\x0a\x56\x45\x3d\x64\x42\xe8\x47\x9d\xad\x5e\xad\xe1\x86\x48\x31\x43\xe3\x96\x93\x53\xa9\x4e\xed\x80\xd8\x50\xd3\x6b\xe6\x5e\xaf\x53\x19\xd1\xcb\x72\x2b\xcf\x8c\x10\x67\x8f\x12\x76\x74\xf1\x1d\x09\x30\x55\xb5\xb7\x9f\xef\xb4\x8b\xde\x32\x30\x5b\x80\x9f\x79\xed\x80\x00\x00\x00\x8d\x1f\x12\x4d\x03\x9e\x47\x7e\x76\xbc", 16);
+
+	MSGBUF(REMG_SEND_RTCP,
+		"\x81\xc8\x00\x0c\x00\x00\x16\x1cxxxxxxxx\x00\x00\x26\xc0\x00\x00\x00\x25\x00\x00\x18\xdc\x00\x00\x12\x34\x06\x00\x00\x01\x00\x00\x04\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05\x00\x00\x16\x1c\x01\x0cqwertyuiopas\x00\x00",
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 13,
+			},
+			.destination_idx = 3,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 20,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 21,
+			},
+		},
+	);
+	EXPF(21, "\x81\xc8\x00\x0c\x00\x00\x16\x1c\x1c\xbb\xae\x0a\x56\x45\x3d\x64\x42\xe8\x47\x9d\xad\x5e\xad\xe1\x86\x48\x31\x43\xe3\x96\x93\x53\xa9\x4e\xed\x80\xd8\x50\xd3\x6b\xe6\x5e\xaf\x53\x19\xd1\xcb\x72\x2b\xcf\x8c\x10\x67\x8f\x12\x76\x74\xf1\x1d\x09\x30\x55\xb5\xb7\x9f\xef\xb4\x8b\xde\x32\x30\x5b\x80\x9f\x79\xed\x80\x00\x00\x00\x8d\x1f\x12\x4d\x03\x9e\x47\x7e\x76\xbc", 20);
+
+	MSGBUF(REMG_SEND_RTCP,
+		"\x81\xc8\x00\x0c\x00\x00\x16\x1cxxxxxxxx\x00\x00\x26\xc0\x00\x00\x00\x25\x00\x00\x18\xdc\x00\x00\x12\x34\x06\x00\x00\x01\x00\x00\x04\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05\x00\x00\x16\x1c\x01\x0cqwertyuiopas\x00\x00",
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 13,
+			},
+			.destination_idx = 3,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 20,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 21,
+			},
+		},
+	);
+	EXPF(21, "\x81\xc8\x00\x0c\x00\x00\x16\x1c\xd0\x93\x46\xcf\xb7\xce\x6d\x5a\x3f\xcb\xbc\x2c\xf6\x6b\xa0\xc7\x8a\x24\x17\xa1\x00\x6f\x60\x03\xd0\xec\xa9\x54\x89\x55\x08\xb2\x36\xf0\xd4\xef\x18\xd9\xcb\x8e\x73\xf8\x24\xce\x15\x30\xb3\x59\xc6\xe3\xd0\xce\x60\x2f\xb3\xed\xea\xe7\x23\x93\x80\x10\x60\x7f\x39\x86\xf0\x6c\x80\x00\x00\x01\xfe\x43\x8f\x15\x0a\x7c\xfd\x6b\xfa\xe0", 20);
+
 	// SRTP suites
 	// AES CM 128
 	// encrypt
@@ -876,5 +1155,228 @@ int main(void) {
 	SND(40, 27, "\x80\x08\x44\x0d\xc2\x3e\xd8\xc0\x21\x9f\x0b\x2e\xd0\x42\xf4\x50\xbb\x7d\x73\xab\xb9\x4e\xd8\x65\xe8\xbf\xeb\xfb\xdc\xdf\xf3\xa6\x63\x58\x84\x37\x49\xc9\xc9\x61\xd9\x43\x51\xde\xfa\x1f\xe5\x34\x9d\x05\x30\x0f\x06\x4f\xb1\x81\x13\x8c\x84\xb2\x26\x93\x0c\x8f\xf1\x6a\x97\x7b\x8c\xe0\xc8\x0a\x66\xe3\xdc\xe4\xd3\xec\x4e\xa5\x8d\x58\x55\x71\x2a\x19\x7c\xad\x55\x46\xe9\xcb\xb4\x79\xde\x8c\x2f\x33\xea\x70\x1b\x08\x4f\xf4\xf4\x2f\x2c\xe6\xb8\x5e\x2a\x65\xab\x06\x74\xbf\xc4\xb1\xc8\x27\x54\x53\xaf\xe8\xca\x1f\x75\xfa\x23\xe9\x6b\x2b\x3e\xed\x4d\x67\x4c\x71\x4c\x53\x74\x4b\x1e\xa7\x5b\x75\x49\x6b\xb3\x64\x6b\x0e\xa5\x12\x8f\x46\x2b\x7d\x17\x54\x2a\x75\xd1\x42\x6b\x7a\xbf\x0e\xd7\x19\x4a\x96\xea\xd9\xd1\xc8\x12\x30\xc3\x33\x4f\xc6\xa6\x0e\x36\xe0\x1f\x0c");
 	EXPF(29, "\x80\x08\x44\x0d\xc2\x3e\xd8\xc0\x21\x9f\x0b\x2e\x57\x55\x55\xd5\xd6\xd1\xd1\xd1\xd4\x55\x57\x56\x54\xd5\xd6\xd4\x55\xd5\xd4\xd1\xd0\xd7\xd4\x54\x54\x55\x55\x57\x51\x56\x56\x55\xd7\xd1\xd6\xd7\xd7\xd7\xd0\xd1\xd1\xd7\x55\x56\x51\x50\x51\x56\x50\x50\x52\x53\xd5\xdc\xdc\xd1\x55\x56\xd5\xdd\xdc\xd3\x57\x53\x53\x54\x57\x54\x54\x54\x54\xd5\x55\xd4\xd6\xd7\x54\x57\x56\x54\x55\x57\x5d\x5c\x53\x56\xd7\xd6\xd4\xd5\xd4\xd6\xd1\xd6\xd7\xd4\x55\x55\xd5\x55\x55\xd1\xd3\xd0\xd3\xdd\xd1\xd0\xd0\xd1\xd6\xd6\xd5\x55\x55\x56\x50\x53\x5f\x5e\x5f\x5d\x50\x56\x50\x56\x54\xd4\xd7\xd6\x55\x53\x5d\x56\xd6\xd0\xd6\x56\x5d\x5f\x51\xd0\xd3\xd4\x54\x54\xd4\xd1\xd6\xd6\xd1\xd1\xd6\xd4\xd5\x55\xd6\xd7\x55\x57", 26);
 
+	// RTCP/SRTCP output
+	MSGBUF(REMG_SEND_RTCP, send_packet,
+		"\x81\xc8\x00\x0c\x00\x00\x16\x1cxxxxxxxx\x00\x00\x26\xc0\x00\x00\x00\x25\x00\x00\x18\xdc\x00\x00\x12\x34\x06\x00\x00\x01\x00\x00\x04\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05\x00\x00\x16\x1c\x01\x0cqwertyuiopas\x00\x00",
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 26,
+			},
+			.destination_idx = 0,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 27,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 28,
+			},
+	);
+	EXPF(28, "\x81\xc8\x00\x0c\x00\x00\x16\x1c\x96\xe5\xb7\xf4\x34\x2e\xed\xfa\x59\xed\x4d\x77\x30\x96\x2a\xb3\x62\x5b\xe9\x4d\x06\xfe\x70\xb2\x9a\x4b\xb9\x27\x14\x78\x64\x15\x0c\xe6\xe6\x0d\xcc\x2f\x7f\x5f\x21\xf3\xfa\x03\x6f\xd2\xc1\xb5\x9c\x12\x76\x1b\x68\xe8\x12\xc8\xa7\x6d\x79\xce\x13\x14\xce\x33\x36\x58\x98\x6f\xe7\x95\xb5\x35\x0c\x25\x92\xbe\x2e\xb3\xb6\x2d\x51\x38\xfb\x09\x80\x00\x00\x00", 27);
+
+	// SRTCP SSRC index tracking
+	MSG(REMG_ADD_TARGET,
+		.target = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 30,
+			},
+			.expected_src = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = 5555,
+			},
+			.decrypt = {
+				.cipher = REC_NULL,
+				.hmac = REH_NULL,
+			},
+			.src_mismatch = MSM_IGNORE,
+			.num_destinations = 1,
+			.rtp = 1,
+
+			.num_payload_types = 1,
+			.payload_types = {
+				{
+					.pt_num = 0xf,
+					.clock_rate = 8000,
+				},
+			},
+
+			.ssrc = {htonl(0x12345678), htonl(0x87654321), 0, 0,},
+		},
+	);
+	MSG(REMG_ADD_DESTINATION,
+		.destination = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 30,
+			},
+			.num = 0,
+			.output = {
+				.src_addr = {
+					.family = AF_INET,
+					.u = {
+						.ipv4 = LOCALHOST,
+					},
+					.port = PORT_BASE + 31,
+				},
+				.dst_addr = {
+					.family = AF_INET,
+					.u = {
+						.ipv4 = LOCALHOST,
+					},
+					.port = PORT_BASE + 32,
+				},
+				.encrypt = {
+					.cipher = REC_AES_CM_128,
+					.hmac = REH_HMAC_SHA1,
+					.master_key_len = 16,
+					.master_salt_len = 14,
+					.session_key_len = 16,
+					.session_salt_len = 14,
+					.rtp_auth_tag_len = 10,
+					.rtcp_auth_tag_len = 10,
+					.master_key = {0xe1, 0xf9, 0x7a, 0x0d, 0x3e, 0x01, 0x8b, 0xe0,
+						0xd6, 0x4f, 0xa3, 0x2c, 0x06, 0xde, 0x41, 0x39},
+					.master_salt = {0x0e, 0xc6, 0x75, 0xad, 0x49, 0x8a, 0xfe, 0xeb,
+						0xb6, 0x96, 0x0b, 0x3a, 0xab, 0xe6},
+				},
+			},
+		},
+	);
+
+	MSGBUF(REMG_SEND_RTCP,
+		"\x81\xc8\x00\x0c\x12\x34\x56\x78xxxxxxxx\x00\x00\x26\xc0\x00\x00\x00\x25\x00\x00\x18\xdc\x00\x00\x12\x34\x06\x00\x00\x01\x00\x00\x04\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05\x00\x00\x16\x1c\x01\x0cqwertyuiopas\x00\x00",
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 30,
+			},
+			.destination_idx = 0,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 31,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 32,
+			},
+		},
+	);
+	EXPF(32, "\x81\xc8\x00\x0c\x12\x34\x56\x78\x09\x11\x4b\x0c\x97\xba\x5c\x20\x2c\x0c\x52\x0c\xea\x0c\xe6\x5b\x8f\x66\xad\x0d\x0b\x84\xb7\x9e\x0c\x6b\x80\xbc\xb1\x94\xb3\x1a\x0a\x1a\x30\x18\x06\xc7\x14\x91\x5a\xb1\xae\xd1\xee\x23\x64\x54\x82\x65\x27\x9c\x3e\xcd\xdc\x87\xff\x68\x84\x7c\x17\x6d\xd7\xc8\xae\xb6\x4b\x73\x80\x00\x00\x00\x00\x0b\x24\x46\x81\xdd\x28\x6b\xe8\xac", 31);
+
+	MSGBUF(REMG_SEND_RTCP,
+		"\x81\xc8\x00\x0c\x12\x34\x56\x78xxxxxxxx\x00\x00\x26\xc0\x00\x00\x00\x25\x00\x00\x18\xdc\x00\x00\x12\x34\x06\x00\x00\x01\x00\x00\x04\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05\x00\x00\x16\x1c\x01\x0cqwertyuiopas\x00\x00",
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 30,
+			},
+			.destination_idx = 0,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 31,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 32,
+			},
+		},
+	);
+	EXPF(32, "\x81\xc8\x00\x0c\x12\x34\x56\x78\x04\xf8\xc2\xb5\x4e\x74\xc8\xa2\x35\x9d\x2f\x11\x67\x2f\xb9\xee\x89\xf9\xd8\xd7\x27\x80\xf6\xe5\x06\xff\xae\x5f\x7b\x3e\xd1\x7b\xa9\x35\xac\x48\x21\xf6\x52\xfc\x8e\xab\x1e\xa1\x62\x36\x45\x2f\x4d\xb0\x75\x36\xdf\x63\x48\xdc\xae\x7d\x4c\x56\x2b\x0d\x21\xc9\x0b\xbb\x81\x55\x80\x00\x00\x01\x3b\xb6\x51\x08\x1d\xb6\x0b\xc2\x62\x4b", 31);
+
+	MSGBUF(REMG_SEND_RTCP,
+		"\x81\xc8\x00\x0c\x87\x65\x43\x21xxxxxxxx\x00\x00\x26\xc0\x00\x00\x00\x25\x00\x00\x18\xdc\x00\x00\x12\x34\x06\x00\x00\x01\x00\x00\x04\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05\x00\x00\x16\x1c\x01\x0cqwertyuiopas\x00\x00",
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 30,
+			},
+			.destination_idx = 0,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 31,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 32,
+			},
+		},
+	);
+	EXPF(32, "\x81\xc8\x00\x0c\x87\x65\x43\x21\xe0\x5d\x5d\x6e\x68\xc4\xcc\x58\xd8\xed\xfb\x58\x9f\xdc\xac\x39\x11\x36\x63\x69\xa1\xf9\x12\x22\x0d\x85\xec\x55\x93\xf7\xf3\x8d\xfd\x39\xe9\x55\xee\x70\x73\x0c\x55\xf4\x41\x6e\x68\xe7\xa9\x1c\x25\x50\x3f\x3c\x3a\xa7\x49\x3a\x38\xee\xf3\x95\x4b\x78\x9f\x6e\x07\x16\x78\x2f\x80\x00\x00\x00\x74\x3b\xc2\xd6\x6a\x20\xa5\x20\xd6\x9a", 31);
+
+	MSGBUF(REMG_SEND_RTCP,
+		"\x81\xc8\x00\x0c\x87\x65\x43\x21xxxxxxxx\x00\x00\x26\xc0\x00\x00\x00\x25\x00\x00\x18\xdc\x00\x00\x12\x34\x06\x00\x00\x01\x00\x00\x04\x0d\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xca\x00\x05\x00\x00\x16\x1c\x01\x0cqwertyuiopas\x00\x00",
+		.send_packet = {
+			.local = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 30,
+			},
+			.destination_idx = 0,
+			.src_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 31,
+			},
+			.dst_addr = {
+				.family = AF_INET,
+				.u = {
+					.ipv4 = LOCALHOST,
+				},
+				.port = PORT_BASE + 32,
+			},
+		},
+	);
+	EXPF(32, "\x81\xc8\x00\x0c\x87\x65\x43\x21\xa8\xf0\x49\x6a\x19\x93\x12\xb7\x15\x08\xaf\xea\x9f\xb8\x07\x51\x0b\x21\xfc\xd2\xcd\x34\x80\x9b\x17\x3d\xfe\xf6\x34\x74\x09\x33\xdb\x77\xb8\xfc\x24\x27\x52\xdf\x47\xe0\xe2\x42\x51\x8b\x99\x56\x3f\x86\x3b\x4f\xe1\x1a\x2e\xc1\xaa\x19\x3f\xae\xae\x0e\xd8\x6d\x0d\xd1\x72\xa4\x80\x00\x00\x01\x86\xe0\x95\x0b\x40\x1f\xa0\x75\x18\x71", 31);
+
 	return 0;
 }