LTE S1-AP interface over point-to-point link?

[Kam Nasim]

Folks,

In NS3, the S1 control plane model in LTE/EPC is an "abstract" model, meaning no PDUS are exchanged and everything is done logically through callbacks.

I am working on a project, where I need to sniff eNodeB-MME and MME-SGW messages. I have a TAP device setup which is able to sniff traffic between my EnodeBs and SGW/PGW and I would like to do the same with MME.

Is there any plan of supporting a "real" MME model(similar to PGW) where ACTUAL PDUs are exchanged over point to point links?

Any suggestions on how to do so? I was thinking of modifying the callbacks in EpcEnbApplication  such as  DoInitialUeMessage() and DoInitialContextSetupRequest()  and create a TAP link here that talks to my sniffer but this feels really hacky :(

Any help I can get on the matter would be really appreciated!

--Kam