diff --git a/src/cntlr.c b/src/cntlr.c
index 481ac045bf83b92ded75973694e62ab54c5a12ff..50b8a5058c723bdc81d88d68fcadc46e18b3d3ea 100644
--- a/src/cntlr.c
+++ b/src/cntlr.c
@@ -677,6 +677,8 @@ struct wifi_radio_element *cntlr_wifi_radio(struct controller *c)
 	if (!radio_el)
 		return NULL;
 
+	INIT_LIST_HEAD(&radio_el->scanlist);
+
 	return radio_el;
 }
 
@@ -704,7 +706,7 @@ struct netif_radio *cntlr_node_add_radio(struct controller *c, struct node *n,
 	}
 	memcpy(r->radio_el->macaddr, radio, 6);
 
-	/* TODO: schedule initial channel scan */
+	/* TODO: schedule first channel scan once scan caps avail */
 
 	return r;
 }
@@ -1052,12 +1054,50 @@ static void radio_clean_iflist(struct netif_radio *r)
 	}
 }
 
+int cntlr_radio_clean_scanlist_el(struct wifi_scanres_element *el)
+{
+	struct wifi_scanres_opclass_element *op = NULL, *otmp;
+	struct wifi_scanres_channel_element *ch = NULL, *ctmp;
+	struct wifi_scanres_neighbor_element *nbr = NULL, *ntmp;
+
+	if (!el)
+		return -1; /* error condition */
+
+	list_for_each_entry_safe(op, otmp, &el->opclass_scanlist, list) {
+		list_for_each_entry_safe(ch, ctmp, &op->channel_scanlist, list) {
+			list_for_each_entry_safe(nbr, ntmp, &ch->nbrlist, list) {
+				list_del(&nbr->list);
+				free(nbr);
+			}
+			list_del(&ch->list);
+			free(ch);
+		}
+		list_del(&op->list);
+		free(op);
+	}
+
+	list_del(&el->list);
+	free(el);
+
+	return 0;
+}
+
+static void radio_clean_radio_el(struct netif_radio *r)
+{
+	struct wifi_scanres_element *b = NULL, *tmp;
+
+	list_for_each_entry_safe(b, tmp, &r->radio_el->scanlist, list) {
+		cntlr_radio_clean_scanlist_el(b);
+	}
+	free(r->radio_el);
+}
+
 static void node_clean_radiolist(struct node *n)
 {
 	struct netif_radio *r = NULL, *tmp;
 
 	list_for_each_entry_safe(r, tmp, &n->radiolist, list) {
-		free(r->radio_el);
+		radio_clean_radio_el(r);
 		list_del(&r->list);
 		radio_clean_iflist(r);
 		free(r);
diff --git a/src/cntlr.h b/src/cntlr.h
index 7c93c8bd6687cbf805b8ac353484e4ff05beb0e6..879e28786ec00d8bade033490e9adc5f295a1dee 100644
--- a/src/cntlr.h
+++ b/src/cntlr.h
@@ -359,6 +359,8 @@ struct bcnreq *cntlr_find_bcnreq(struct controller *c, uint8_t *sta, uint8_t *al
 struct netif_iface *cntlr_get_fbss_by_mac(struct controller *c, struct node *n,
 		uint8_t *mac);
 bool cntlr_resync_config(struct controller *c, bool reload);
+
+int cntlr_radio_clean_scanlist_el(struct wifi_scanres_element *el);
 void free_bcn_metrics(struct controller *c, struct sta *s);
 void free_usta_metrics(struct controller *c, struct sta *s);
 
diff --git a/src/cntlr_map.c b/src/cntlr_map.c
index eff70d3d39e0217564b725f13d0ebc918e62f940..7c8ad2ed147c1e3309f0a3cbf4672971728a154d 100644
--- a/src/cntlr_map.c
+++ b/src/cntlr_map.c
@@ -53,6 +53,7 @@
 #include "cntlr_tlv.h"
 #include "cmdu_validate.h"
 
+/* Max size is 256 as per the Multi-ap r2 spec */
 #define TIMESTAMP_MAX_LEN 256
 
 typedef int (*map_cmdu_handler_t)(void *cntlr, struct cmdu_buff *cmdu);
@@ -947,6 +948,8 @@ static int cntlr_parse_radio_scan_caps(struct controller *c, struct node *n,
 		cntlr_scan_caps_opclass_dump(caps);
 	}
 
+	/* TODO: check re scanlist timestamps & issue channel scan */
+
 	return 0;
 }
 
@@ -2288,20 +2291,239 @@ int handle_backhaul_sta_steer_response(void *cntlr, struct cmdu_buff *cmdu)
 	return 0;
 }
 
+static struct wifi_scanres_element *find_scanres_el(struct controller *c,
+		uint8_t *radio, char *timestamp)
+{
+	struct netif_radio *r = NULL;
+	struct wifi_scanres_element *b = NULL;
+
+	r = find_radio_by_mac(c, radio);
+	if (!r)
+		return NULL;
+
+	if (list_empty(&r->radio_el->scanlist))
+		return NULL;
+
+	list_for_each_entry(b, &r->radio_el->scanlist, list) {
+		if (!strncmp(timestamp, b->tsp, strlen(timestamp)))
+			return b;
+	}
+
+	return NULL;
+}
+
+static struct wifi_scanres_element *get_scanlist_element(struct controller *c,
+		uint8_t *radio, char *timestamp)
+{
+	struct wifi_scanres_element *b = NULL;
+	struct netif_radio *r;
+
+	/* Try to reuse element for data from same radio and time */
+	b = find_scanres_el(c, radio, timestamp);
+	if (!b) {
+		/* add new element */
+		r = find_radio_by_mac(c, radio);
+		if (!r)
+			return NULL;
+
+		b = calloc(1, sizeof(*b));
+		if (!b)
+			return NULL;
+
+		list_add(&b->list, &r->radio_el->scanlist);
+		r->radio_el->num_scanresult++;
+
+		strncpy(b->tsp, timestamp, sizeof(b->tsp) - 1);
+
+		/* Initialize opclass list for the measurement */
+		INIT_LIST_HEAD(&b->opclass_scanlist);
+	}
+
+	return b;
+}
+
+static int add_scanres_element(struct controller *c,
+		struct tlv_channel_scan_result *tlv, char *timestamp)
+{
+	struct wifi_scanres_element *el = NULL;
+	struct wifi_scanres_opclass_element *op = NULL, *otmp = NULL;
+	struct wifi_scanres_channel_element *ch = NULL, *ctmp = NULL;
+	uint8_t *tv_data = NULL;
+	int offset = 0;
+
+	/* Reuse old or add new element to the list */
+	el = get_scanlist_element(c, tlv->radio, timestamp);
+	if (!el)
+		return -1; /* error condition */
+
+	list_for_each_entry(otmp, &el->opclass_scanlist, list) {
+		if (otmp->opclass == tlv->opclass) {
+			op = otmp;
+			break;
+		}
+	}
+
+	if (!op) {
+		op = calloc(1, sizeof(*op));
+		if (!op)
+			goto error; /* error condition */
+
+		/* add opclass element to the list */
+		list_add(&op->list, &el->opclass_scanlist);
+		el->num_opclass_scanned++;
+
+		op->opclass = tlv->opclass;
+
+		/* Initialize channel list for this measurement */
+		INIT_LIST_HEAD(&op->channel_scanlist);
+	}
+
+	list_for_each_entry(ctmp, &op->channel_scanlist, list) {
+		if (ctmp->channel == tlv->channel) {
+			dbg("%s: channel %d already on the list\n", __func__, tlv->channel);
+			goto error; /* error condition */
+		}
+	}
+
+	ch = calloc(1, sizeof(*ch));
+	if (!ch)
+		goto error; /* error condition */
+
+	/* add channel element to the list */
+	list_add(&ch->list, &op->channel_scanlist);
+	op->num_channels_scanned++;
+
+	/* channel */
+	ch->channel = tlv->channel;
+
+	/* tsp */
+	memset(ch->tsp, 0, sizeof(ch->tsp)); /* null term */
+	memcpy(ch->tsp, tlv->detail[0].tsp.timestamp,
+		sizeof(ch->tsp) - 1 < tlv->detail[0].tsp.len ?
+		sizeof(ch->tsp) - 1 : tlv->detail[0].tsp.len);
+
+	/* don't use struct detail anylonger due to variable tsp len */
+	tv_data = (uint8_t*)&tlv->detail[0];
+	offset += sizeof(tlv->detail[0].tsp) + tlv->detail[0].tsp.len;
+
+	ch->utilization = tv_data[offset];
+	offset++; /* uint8_t utilization; */
+	ch->anpi = tv_data[offset];
+	offset++; /* uint8_t noise; */
+	ch->num_neighbors = BUF_GET_BE16(tv_data[offset]);
+	offset += 2; /* uint16_t num_neighbor; */
+
+	dbg("%s: channel %d, tsp: %s, util: %d, noise: %d, num_nbr: %d\n",
+	    __func__, ch->channel, ch->tsp, ch->utilization, ch->anpi, ch->num_neighbors);
+
+	INIT_LIST_HEAD(&ch->nbrlist);
+
+	/* Initialize nbrlist for this channel of current measurement */
+	if (ch->num_neighbors) {
+		int i;
+		struct wifi_scanres_neighbor_element *nbr = NULL;
+
+		for (i = 0; i < ch->num_neighbors; i++) {
+			uint8_t len = 0, ssidlen;
+			uint8_t info = 0x00;
+			uint8_t bw_len;
+
+			nbr = calloc(1, sizeof(*nbr));
+			if (!nbr)
+				goto error; /* error condition */
+
+			/* add nbr element to the list */
+			list_add(&nbr->list, &ch->nbrlist);
+
+			memcpy(nbr->bssid, &tv_data[offset], 6);
+			offset += 6;
+			ssidlen = tv_data[offset++];
+			len = (ssidlen + 1 > sizeof(nbr->ssid)
+					? sizeof(nbr->ssid) : ssidlen + 1);
+			snprintf(nbr->ssid, len, "%s", (char *)&tv_data[offset]);
+			offset += ssidlen;
+			nbr->rssi = rcpi_to_rssi((int)tv_data[offset]);
+			offset++;
+			bw_len = tv_data[offset++];
+			nbr->bw = atoi((char *)&tv_data[offset]);
+			offset += bw_len;
+			info = tv_data[offset];
+			offset++;
+
+			if (info & CH_SCAN_RESULT_BSSLOAD_PRESENT) {
+				nbr->utilization = tv_data[offset];
+				offset++;
+				nbr->num_stations = BUF_GET_BE16(tv_data[offset]);
+				offset += 2;
+			}
+		}
+	}
+	return 0;
+
+error:
+	cntlr_radio_clean_scanlist_el(el);
+	return -1;
+}
+
+static int cntlr_radio_update_scanlist(void *cntlr, char *timestamp,
+		struct tlv **tv_scan, int num_result)
+{
+	struct controller *c = (struct controller *) cntlr;
+	int i;
+
+	/* Go trhough all results */
+	for (i = 0; i < num_result; i++) {
+		struct tlv_channel_scan_result *tlv=
+				(struct tlv_channel_scan_result *)tv_scan[i]->data;
+
+		dbg("%s: radio " MACFMT " scan status: %d, opclass/channel: %d/%d\n",
+		    __func__,  MAC2STR(tlv->radio), tlv->status,
+		    tlv->opclass, tlv->channel);
+
+		/* Skip unsuccesfull scans */
+		if (tlv->status != CH_SCAN_STATUS_SUCCESS)
+			continue;
+
+		if (add_scanres_element(c, tlv, timestamp))
+			return -1;
+	}
+
+	return 0;
+}
+
 int handle_channel_scan_report(void *cntlr, struct cmdu_buff *cmdu)
 {
 	dbg("%s: --->\n", __func__);
 
-	int num = 256;
+	int num_result = 256;
 	struct tlv *tv_tsp[1][16];
 	struct tlv *tv_scan[256];
+	char timestamp[TIMESTAMP_MAX_LEN] = {0};
+	int len;
+	struct tlv_timestamp *p = NULL;
+	uint8_t *tv_data = NULL;
 
-	if (!validate_channel_scan_report(cmdu, tv_tsp, tv_scan, &num)) {
+	/* TODO: remove outdated entries from all radio scanlists */
+
+	if (!validate_channel_scan_report(cmdu, tv_tsp, tv_scan, &num_result)) {
 		dbg("cmdu validation: [CHANNEL_SCAN_REPORT] failed\n");
 		return -1;
 	}
 
-	return 0;
+	tv_data = (uint8_t *)tv_tsp[0][0]->data;
+	p = (struct tlv_timestamp *)tv_data;
+
+	if (p->len > (TIMESTAMP_MAX_LEN - 1))
+		return -1;
+
+	memset(timestamp, 0, sizeof(timestamp));
+	len = (p->len > sizeof(timestamp) - 1
+		? sizeof(timestamp) - 1 : p->len);
+	memcpy(timestamp, p->timestamp, len);
+
+	dbg("%s: timestamp = %s\n", __func__, timestamp);
+
+	return cntlr_radio_update_scanlist(cntlr, timestamp, tv_scan, num_result);
 }
 
 int handle_sta_disassoc_stats(void *cntlr, struct cmdu_buff *cmdu)
diff --git a/src/utils/utils.c b/src/utils/utils.c
index 14468f66a253d219aed083ad549508e3a8bf96f5..603369a54f6502b217afae9f48229b6fd8f2fc70 100644
--- a/src/utils/utils.c
+++ b/src/utils/utils.c
@@ -621,3 +621,25 @@ int writeto_configfile(const char *filename, void *in, size_t len)
 	close(fp);
 	return 0;
 }
+
+uint8_t rssi_to_rcpi(int rssi)
+{
+    if (!rssi)
+        return 255;
+    else if (rssi < -110)
+        return 0;
+    else if (rssi > 0)
+        return 220;
+    else
+        return (rssi + 110) * 2;
+}
+
+int rcpi_to_rssi(uint8_t rcpi)
+{
+	/* FIXME: */
+
+	if (rcpi > 220)
+		return 0;
+	else
+		return ((rcpi / 2) - 110);
+}
diff --git a/src/utils/utils.h b/src/utils/utils.h
index 9de337fa842674097a1e715d281c641c845e8561..dec1fb5f67d87559dcd1c3dc3f7c8db4ac459113 100644
--- a/src/utils/utils.h
+++ b/src/utils/utils.h
@@ -174,4 +174,7 @@ void do_daemonize(const char *pidfile);
 
 int writeto_configfile(const char *filename, void *in, size_t len);
 int readfrom_configfile(const char *filename, uint8_t **out, uint32_t *olen);
+
+uint8_t rssi_to_rcpi(int rssi);
+int rcpi_to_rssi(uint8_t rcpi);
 #endif /* UTILS_H */