WebRTC: Difference between revisions

From VoIPmonitor.org
No edit summary
(Rewrite: konsolidace, lepší struktura, tabulka pro srovnání metod, warning/note boxy, See Also sekce)
 
(6 intermediate revisions by the same user not shown)
Line 1: Line 1:
{{DISPLAYTITLE:Monitoring Encrypted WebRTC (WSS/DTLS-SRTP)}}
{{DISPLAYTITLE:Monitoring Encrypted WebRTC (WSS/DTLS-SRTP)}}


'''This guide provides a complete, step-by-step tutorial for configuring Asterisk to support secure WebRTC clients and enabling VoIPmonitor to capture and decrypt the associated SIP over Secure WebSocket (WSS) and SRTP traffic.'''
'''This guide covers monitoring encrypted WebRTC traffic with VoIPmonitor, including SIP over Secure WebSocket (WSS) and DTLS-SRTP media encryption.'''


== Overview ==
== Overview ==
WebRTC (Web Real-Time Communication) requires encrypted transport for both signaling and media. This is achieved using:
*'''WSS (Secure WebSocket):''' For the SIP signaling, encrypting it with TLS.
*'''DTLS-SRTP:''' For the media (RTP) stream, encrypting it with DTLS negotiation to establish SRTP keys.


VoIPmonitor can sniff and decrypt both layers, provided it has access to the private TLS key used by the PBX. This guide will walk through the full setup for Asterisk.
WebRTC requires encrypted transport for both signaling and media:
* '''WSS (Secure WebSocket):''' SIP signaling encrypted with TLS
* '''DTLS-SRTP:''' Media (RTP) encrypted via DTLS key negotiation


== Part 1: Configuring VoIPmonitor to Decrypt TLS ==
VoIPmonitor can decrypt both layers using either a private TLS key or the SSL Key Logger method.
First, ensure your sensor is configured to decrypt TLS traffic. In `/etc/voipmonitor.conf`, you must enable the SSL module and provide the path to the same private key your PBX will use.


<pre>
<kroki lang="mermaid">
%%{init: {'flowchart': {'nodeSpacing': 15, 'rankSpacing': 30}}}%%
flowchart LR
    subgraph Browser["WebRTC Client"]
        WC[Web Browser]
    end
    subgraph PBX["Asterisk PBX"]
        WSS[WSS :8089]
        SRTP[DTLS-SRTP]
    end
    subgraph VM["VoIPmonitor"]
        CAP[Capture]
        DEC[Decrypt]
        CDR[CDR]
    end
    WC -->|"SIP/WSS"| WSS
    WC -->|"Media"| SRTP
    WSS -.->|"mirror"| CAP
    SRTP -.->|"mirror"| CAP
    CAP --> DEC --> CDR
</kroki>
 
== Prerequisites: Configure sipport ==
 
{{Warning|1=VoIPmonitor only monitors port 5060 by default. You '''must''' add WebRTC ports to <code>sipport</code> or traffic will be ignored.}}
 
Edit <code>/etc/voipmonitor.conf</code>:
 
<syntaxhighlight lang="ini">
# Add WebRTC ports (WS=8088, WSS=8089)
sipport = 5060,8088,8089
 
# Or use port ranges
sipport = 5060,8080-8090
</syntaxhighlight>
 
Restart after changes: <code>systemctl restart voipmonitor</code>
 
{{Note|1=In probe/server architecture, configure <code>sipport</code> on '''both''' probe and server.}}
 
== Decryption Methods ==
 
Choose based on your environment:
 
{| class="wikitable"
|-
! Method !! When to Use !! Limitations
|-
| '''A: Private Key''' || Development/testing, RSA ciphers || Fails with TLS 1.3/PFS (DHE/ECDHE)
|-
| '''B: SSL Key Logger''' || Production, TLS 1.3, PFS, distributed setups || Requires library injection on PBX
|}
 
=== Method A: Private Key ===
 
<syntaxhighlight lang="ini">
# /etc/voipmonitor.conf
# /etc/voipmonitor.conf
ssl = yes
ssl_ipport = 192.168.2.107:8089 /etc/asterisk/keys/asterisk.pem


# Or use CIDR for multiple hosts
ssl_ipport = 192.168.2.0/24:8089 /path/to/key.pem
</syntaxhighlight>
=== Method B: SSL Key Logger ===
Works with ALL cipher suites including TLS 1.3 and PFS.
'''1. Compile the library:'''
<syntaxhighlight lang="bash">
git clone https://github.com/voipmonitor/sniffer.git /usr/local/src/voipmonitor-git
cd /usr/local/src/voipmonitor-git/tools/ssl_keylogger/
make
</syntaxhighlight>
'''2. Configure PBX to send session keys:'''
For Asterisk (create <code>/etc/default/asterisk-ssl</code>):
<syntaxhighlight lang="bash">
SSLKEYLOG_UDP='127.0.0.1:1234'
LD_PRELOAD='/usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so'
</syntaxhighlight>
For FreeSWITCH, add to systemd service:
<syntaxhighlight lang="bash">
ExecStart=env SSLKEYLOG_UDP='127.0.0.1:1234' LD_PRELOAD='/path/to/sslkeylog.so' /usr/bin/freeswitch ...
</syntaxhighlight>
'''3. Configure VoIPmonitor:'''
<syntaxhighlight lang="ini">
# /etc/voipmonitor.conf
ssl = yes
ssl = yes
ssl_ipport = 192.168.2.0/24:8089    # NO key file path!
ssl_sessionkey_udp = yes
ssl_sessionkey_udp_port = 1234


# Point to the private key used by your PBX.
# Add loopback if sending keys locally
# Format: <IP of PBX> : <WSS Port> /path/to/private.key
interface = eth0,lo
#
</syntaxhighlight>
# Example for this guide:
ssl_ipport = 192.168.2.107 : 8089 /etc/asterisk/keys/asterisk.pem
</pre>
''Note: This configuration is also applicable for FreeSWITCH. You would just need to point to the key file used by FreeSWITCH.''


== Part 2: Configuring Asterisk for Secure WebRTC ==
{{Tip|1=For distributed mode (<code>packetbuffer_sender=yes</code>), send keys to the '''central server IP''', not localhost.}}
This section details the full configuration for Asterisk, from generating keys to setting up PJSIP endpoints.
 
For complete SSL Key Logger documentation, see [[Tls#Method_2:_SSL_Key_Logger|TLS Decryption]].
 
== Asterisk Configuration ==


=== Step 1: Generate TLS Certificates ===
=== Step 1: Generate TLS Certificates ===
First, we need to create a Certificate Authority (CA) and a server certificate that Asterisk will use for its HTTPS and WSS interfaces.


<pre>
<syntaxhighlight lang="bash">
# Create a directory for your keys
mkdir -p /etc/asterisk/keys && cd /etc/asterisk/keys
mkdir -p /etc/asterisk/keys
cd /etc/asterisk/keys


# 1. Create a private key for your local Certificate Authority (CA)
# Create CA
openssl genrsa -des3 -out ca.key 4096
openssl genrsa -des3 -out ca.key 4096
# 2. Create a root CA certificate
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt


# 3. Create a private key for the Asterisk server
# Create server certificate
openssl genrsa -out key.pem 2048
openssl genrsa -out key.pem 2048
openssl req -new -key key.pem -out server.csr
openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out cert.crt


# 4. Create a certificate signing request (CSR) for the Asterisk server
# Combine for Asterisk
openssl req -new -key key.pem -out req-sip_server.csr
cat key.pem cert.crt > asterisk.pem
 
</syntaxhighlight>
# 5. Sign the server certificate with your CA
openssl x509 -req -days 3650 -in req-sip_server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out cert-sip_server.crt
 
# 6. Combine the private key and signed certificate into a single .pem file for Asterisk
cat key.pem > asterisk.pem
cat cert-sip_server.crt >> asterisk.pem
</pre>
 
=== Step 2: Configure Asterisk's HTTP Server for WSS ===
Edit `/etc/asterisk/http.conf` to enable the built-in web server and activate TLS for the WebSocket transport.


<pre>
=== Step 2: Configure HTTP Server ===
; /etc/asterisk/http.conf


<code>/etc/asterisk/http.conf</code>:
<syntaxhighlight lang="ini">
[general]
[general]
enabled = yes
enabled = yes
bindaddr = 0.0.0.0
bindaddr = 0.0.0.0
bindport = 8088 ; Port for unencrypted WS
bindport = 8088         ; WS (unencrypted)
 
tlsenable = yes
tlsenable = yes
tlsbindaddr = 0.0.0.0:8089 ; Port for encrypted WSS
tlsbindaddr = 0.0.0.0:8089 ; WSS (encrypted)
tlscertfile = /etc/asterisk/keys/asterisk.pem
tlscertfile = /etc/asterisk/keys/asterisk.pem
tlscipher = AES128-SHA
tlscipher = AES128-SHA
</pre>
</syntaxhighlight>
 
=== Step 3: Configure RTP Settings ===
Edit `/etc/asterisk/rtp.conf` and ensure ICE support is enabled, which is essential for WebRTC clients to traverse NAT.


<pre>
=== Step 3: Configure RTP ===
; /etc/asterisk/rtp.conf


<code>/etc/asterisk/rtp.conf</code>:
<syntaxhighlight lang="ini">
[general]
[general]
icesupport = yes
icesupport = yes
; You can optionally configure a public STUN server
; stunaddr = stun.l.google.com:19302
; stunaddr = stun.l.google.com:19302
</pre>
</syntaxhighlight>


=== Step 4: Configure PJSIP for WebRTC ===
=== Step 4: Configure PJSIP ===
This is the core configuration. We will set up UDP, WS, and WSS transports, and then create endpoints that require DTLS encryption.


;First, disable the old chan_sip module in `/etc/asterisk/modules.conf` to avoid conflicts:
Disable old chan_sip in <code>/etc/asterisk/modules.conf</code>:
<pre>
<syntaxhighlight lang="ini">
; /etc/asterisk/modules.conf
noload => chan_sip.so
noload => chan_sip.so
</pre>
</syntaxhighlight>
 
;Next, configure `/etc/asterisk/pjsip.conf`:
<pre>
; /etc/asterisk/pjsip.conf


<code>/etc/asterisk/pjsip.conf</code>:
<syntaxhighlight lang="ini">
[global]
[global]
type = global
type = global
user_agent = MyAsteriskPBX
realm = 192.168.2.107
realm = 192.168.2.107 ; Use your Asterisk server's IP or domain


; --- Transports ---
; --- Transports ---
Line 109: Line 176:
protocol = udp
protocol = udp
bind = 0.0.0.0:5060
bind = 0.0.0.0:5060
[transport-ws]
type = transport
protocol = ws
bind = 0.0.0.0:8088


[transport-wss]
[transport-wss]
Line 120: Line 182:
bind = 0.0.0.0:8089
bind = 0.0.0.0:8089


; --- WebRTC Endpoint Template ---
; --- WebRTC Template ---
; We create a template to avoid repeating settings
[webrtc-template](!)
[webrtc-endpoint-template](!)
type = endpoint
type = endpoint
disallow = all
disallow = all
allow = opus,ulaw,alaw
allow = opus,ulaw,alaw
context = internal-webrtc
context = internal-webrtc
auth = webrtc-auth
aors = webrtc-aor
; Require DTLS encryption for media
media_encryption = dtls
media_encryption = dtls
dtls_verify = fingerprint
dtls_verify = fingerprint
Line 138: Line 195:
use_avpf = yes
use_avpf = yes
ice_support = yes
ice_support = yes
media_use_received_transport = yes
rtcp_mux = yes
rtcp_mux = yes


; --- Define Users (101 and 102) ---
; --- User 101 ---
[101](webrtc-endpoint-template) ; Inherits from the template
[101](webrtc-template)
[webrtc-auth](+)
auth = 101-auth
aors = 101-aor
 
[101-auth]
type = auth
type = auth
auth_type = userpass
auth_type = userpass
username = 101
username = 101
password = your_strong_password_101
password = secret101
[webrtc-aor](+)
 
[101-aor]
type = aor
type = aor
max_contacts = 1
max_contacts = 1
</syntaxhighlight>
=== Step 5: Dialplan ===
<code>/etc/asterisk/extensions.conf</code>:
<syntaxhighlight lang="ini">
[internal-webrtc]
exten => _1XX,1,Dial(PJSIP/${EXTEN})
</syntaxhighlight>


[102](webrtc-endpoint-template) ; Inherits from the template
== WebRTC Client Setup (sipML5) ==
[webrtc-auth](+)
 
type = auth
Using [https://www.doubango.org/sipml5/call.htm sipML5]:
auth_type = userpass
 
username = 102
'''Basic Settings:'''
password = your_strong_password_102
* Display Name: <code>101</code>
[webrtc-aor](+)
* Private Identity: <code>101</code>
type = aor
* Public Identity: <code>sip:101@192.168.2.107</code>
max_contacts = 1
* Password: <code>secret101</code>
</pre>
* Realm: <code>192.168.2.107</code>
 
'''Expert Mode:'''
* WebSocket Server URL: <code>wss://192.168.2.107:8089/ws</code>
* Enable RTCWeb Breaker: Checked
* Disable 3GPP Early IMS: Checked
 
{{Warning|1=Before login, open <code><nowiki>https://192.168.2.107:8089/ws</nowiki></code> in browser and accept the self-signed certificate.}}
 
== Third-Party WebRTC Monitoring (--rtp-no-sig) ==
 
For monitoring WebRTC where you have no access to signaling (e.g., external providers).
 
=== When to Use ===
* Third-party WebRTC service without signaling access
* Only media (RTP) stream is accessible
* Need QoS metrics without decryption


=== Step 5: Create a Basic Dialplan ===
=== Configuration ===
Edit `/etc/asterisk/extensions.conf` to allow the two users to call each other.


<pre>
<syntaxhighlight lang="bash">
; /etc/asterisk/extensions.conf
# Start with --rtp-no-sig flag
voipmonitor --rtp-no-sig --interface eth0


[internal-webrtc]
# Or add to systemd service ExecStart line
exten => 101,1,NoOp(Call to 101)
</syntaxhighlight>
same => n,Dial(PJSIP/101)
same => n,Hangup()


exten => 102,1,NoOp(Call to 102)
'''Behavior:'''
same => n,Dial(PJSIP/102)
* CDRs created from RTP packets using SSRC identifiers
same => n,Hangup()
* QoS metrics (MOS, jitter, packet loss) collected without decryption
</pre>
* Caller ID and call direction unavailable


== Part 3: Configuring the WebRTC Client (sipML5) ==
=== With Audio Replay ===
Now, configure your WebRTC softphone to connect to Asterisk. This example uses the popular [https://www.doubango.org/sipml5/call.htm sipML5 online client].


=== Step 1: Basic Settings ===
Combine <code>--rtp-no-sig</code> with SSL Key Logger for full monitoring:
Enter your user credentials on the main registration screen.
* '''Display Name:''' `101`
* '''Private Identity:''' `101`
* '''Public Identity:''' `sip:101@192.168.2.107`
* '''Password:''' `your_strong_password_101`
* '''Realm:''' `192.168.2.107`


=== Step 2: Expert Mode Settings ===
<syntaxhighlight lang="ini">
Click "Expert Mode" and configure the following:
# On WebRTC server
* '''Disable Video:''' Checked (unless you need video).
SSLKEYLOG_UDP='10.0.0.10:1234'
* '''Enable RTCWeb Breaker:''' Checked.
LD_PRELOAD='/path/to/sslkeylog.so'
* '''WebSocket Server URL:''' `wss://192.168.2.107:8089/ws` (Note the '''wss://''' prefix and the correct port).
* '''ICE Servers:''' `[]` (Leave empty or use `[{ "url": "stun:stun.l.google.com:19302" }]`)
* '''Disable 3GPP Early IMS:''' Checked.


=== Step 3: Trust the Certificate ===
# On VoIPmonitor sensor
Before attempting to register, you '''must''' open a new browser tab and navigate to `https://192.168.2.107:8089/ws`. Your browser will show a security warning because the certificate is self-signed. You must accept the risk and proceed. This action adds a temporary security exception, allowing the WebSocket connection to be established.
ssl = yes
ssl_sessionkey_udp = yes
ssl_sessionkey_udp_port = 1234
</syntaxhighlight>


After completing these steps, you can return to the sipML5 tab and click "Login". Your client should register successfully, and calls will be encrypted and monitored by VoIPmonitor.
== See Also ==
* [[Tls]] - Complete TLS/SRTP decryption guide
* [[Sniffer_configuration]] - Full configuration reference
* [[Sniffing_modes]] - Deployment topologies


== AI Summary for RAG ==
== AI Summary for RAG ==
'''Summary:''' This guide provides a comprehensive tutorial on configuring VoIPmonitor to sniff encrypted WebRTC traffic, specifically SIP over Secure WebSockets (WSS) and DTLS-SRTP. It details the full setup process for an Asterisk PBX. Part 1 explains how to configure VoIPmonitor itself by enabling `ssl` and setting `ssl_ipport` with the correct private key. Part 2 provides a detailed, step-by-step guide for Asterisk, including: generating a self-signed CA and server certificate using OpenSSL; configuring Asterisk's HTTP server for WSS in `http.conf`; enabling ICE support in `rtp.conf`; and setting up PJSIP transports (`wss`) and endpoints with mandatory DTLS media encryption. Part 3 concludes with instructions for configuring a WebRTC client (sipML5) to connect to the secure Asterisk setup, emphasizing the need to manually trust the self-signed certificate in the browser.
 
'''Keywords:''' webrtc, wss, secure websocket, dtls, srtp, encrypted, tls, ssl, asterisk, pjsip, http.conf, rtp.conf, sipml5, freeeswitch, decryption, `ssl_ipport`, openssl, certificate, self-signed
'''Summary:''' Guide for monitoring encrypted WebRTC (WSS/DTLS-SRTP) with VoIPmonitor. CRITICAL: Add WebRTC ports to <code>sipport</code> (e.g., <code>sipport = 5060,8088,8089</code>) before configuring decryption. Two methods: Private Key (<code>ssl_ipport = IP:PORT /path/key.pem</code>) fails with TLS 1.3/PFS; SSL Key Logger works with all ciphers via <code>LD_PRELOAD</code> injection and <code>ssl_sessionkey_udp=yes</code>. For distributed mode, send keys to central server IP. Includes Asterisk WSS/PJSIP setup. Use <code>--rtp-no-sig</code> for third-party WebRTC without signaling access.
 
'''Keywords:''' webrtc, wss, secure websocket, dtls, srtp, encrypted, tls, ssl, asterisk, pjsip, freeswitch, decryption, ssl_ipport, sslkeylog, ld_preload, ssl_sessionkey_udp, sipport, rtp-no-sig, pfs, tls 1.3, distributed mode, 8088, 8089
 
'''Key Questions:'''
'''Key Questions:'''
* How can I monitor encrypted WebRTC calls?
* How do I monitor encrypted WebRTC calls with VoIPmonitor?
* How do I configure VoIPmonitor to decrypt WSS and DTLS-SRTP traffic?
* Why is VoIPmonitor not detecting WebRTC traffic?
* What Asterisk configuration is needed for secure WebRTC?
* How do I configure sipport for WebRTC ports 8088/8089?
* How do I set up a PJSIP endpoint for a WebRTC client?
* What is the difference between Private Key and SSL Key Logger decryption methods?
* How do I generate a self-signed certificate for Asterisk?
* How do I configure Asterisk for secure WebRTC?
* Why is my WebRTC client not connecting over WSS?
* How does --rtp-no-sig work for third-party WebRTC monitoring?
* What is the purpose of `dtls_cert_file` in `pjsip.conf`?
* How do I decrypt DTLS-SRTP for audio replay?
* How to configure sipML5 for a secure connection to Asterisk?

Latest revision as of 16:50, 8 January 2026


This guide covers monitoring encrypted WebRTC traffic with VoIPmonitor, including SIP over Secure WebSocket (WSS) and DTLS-SRTP media encryption.

Overview

WebRTC requires encrypted transport for both signaling and media:

  • WSS (Secure WebSocket): SIP signaling encrypted with TLS
  • DTLS-SRTP: Media (RTP) encrypted via DTLS key negotiation

VoIPmonitor can decrypt both layers using either a private TLS key or the SSL Key Logger method.

Prerequisites: Configure sipport

⚠️ Warning: VoIPmonitor only monitors port 5060 by default. You must add WebRTC ports to sipport or traffic will be ignored.

Edit /etc/voipmonitor.conf: 

# Add WebRTC ports (WS=8088, WSS=8089)
sipport = 5060,8088,8089

# Or use port ranges
sipport = 5060,8080-8090

Restart after changes: systemctl restart voipmonitor

ℹ️ Note: In probe/server architecture, configure sipport on both probe and server.

Decryption Methods

Choose based on your environment:

Method When to Use Limitations
A: Private Key Development/testing, RSA ciphers Fails with TLS 1.3/PFS (DHE/ECDHE)
B: SSL Key Logger Production, TLS 1.3, PFS, distributed setups Requires library injection on PBX

Method A: Private Key

# /etc/voipmonitor.conf
ssl = yes
ssl_ipport = 192.168.2.107:8089 /etc/asterisk/keys/asterisk.pem

# Or use CIDR for multiple hosts
ssl_ipport = 192.168.2.0/24:8089 /path/to/key.pem

Method B: SSL Key Logger

Works with ALL cipher suites including TLS 1.3 and PFS.

1. Compile the library: 

git clone https://github.com/voipmonitor/sniffer.git /usr/local/src/voipmonitor-git
cd /usr/local/src/voipmonitor-git/tools/ssl_keylogger/
make

2. Configure PBX to send session keys:

For Asterisk (create /etc/default/asterisk-ssl): 

SSLKEYLOG_UDP='127.0.0.1:1234'
LD_PRELOAD='/usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so'

For FreeSWITCH, add to systemd service: 

ExecStart=env SSLKEYLOG_UDP='127.0.0.1:1234' LD_PRELOAD='/path/to/sslkeylog.so' /usr/bin/freeswitch ...

3. Configure VoIPmonitor: 

# /etc/voipmonitor.conf
ssl = yes
ssl_ipport = 192.168.2.0/24:8089    # NO key file path!
ssl_sessionkey_udp = yes
ssl_sessionkey_udp_port = 1234

# Add loopback if sending keys locally
interface = eth0,lo

💡 Tip: For distributed mode (packetbuffer_sender=yes), send keys to the central server IP, not localhost.

For complete SSL Key Logger documentation, see TLS Decryption.

Asterisk Configuration

Step 1: Generate TLS Certificates

mkdir -p /etc/asterisk/keys && cd /etc/asterisk/keys

# Create CA
openssl genrsa -des3 -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt

# Create server certificate
openssl genrsa -out key.pem 2048
openssl req -new -key key.pem -out server.csr
openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out cert.crt

# Combine for Asterisk
cat key.pem cert.crt > asterisk.pem

Step 2: Configure HTTP Server

/etc/asterisk/http.conf: 

[general]
enabled = yes
bindaddr = 0.0.0.0
bindport = 8088          ; WS (unencrypted)
tlsenable = yes
tlsbindaddr = 0.0.0.0:8089  ; WSS (encrypted)
tlscertfile = /etc/asterisk/keys/asterisk.pem
tlscipher = AES128-SHA

Step 3: Configure RTP

/etc/asterisk/rtp.conf: 

[general]
icesupport = yes
; stunaddr = stun.l.google.com:19302

Step 4: Configure PJSIP

Disable old chan_sip in /etc/asterisk/modules.conf: 

noload => chan_sip.so

/etc/asterisk/pjsip.conf: 

[global]
type = global
realm = 192.168.2.107

; --- Transports ---
[transport-udp]
type = transport
protocol = udp
bind = 0.0.0.0:5060

[transport-wss]
type = transport
protocol = wss
bind = 0.0.0.0:8089

; --- WebRTC Template ---
[webrtc-template](!)
type = endpoint
disallow = all
allow = opus,ulaw,alaw
context = internal-webrtc
media_encryption = dtls
dtls_verify = fingerprint
dtls_cert_file = /etc/asterisk/keys/asterisk.pem
dtls_ca_file = /etc/asterisk/keys/ca.crt
dtls_setup = actpass
use_avpf = yes
ice_support = yes
rtcp_mux = yes

; --- User 101 ---
[101](webrtc-template)
auth = 101-auth
aors = 101-aor

[101-auth]
type = auth
auth_type = userpass
username = 101
password = secret101

[101-aor]
type = aor
max_contacts = 1

Step 5: Dialplan

/etc/asterisk/extensions.conf: 

[internal-webrtc]
exten => _1XX,1,Dial(PJSIP/${EXTEN})

WebRTC Client Setup (sipML5)

Using sipML5:

Basic Settings:

  • Display Name: 101
  • Private Identity: 101
  • Public Identity: sip:101@192.168.2.107
  • Password: secret101
  • Realm: 192.168.2.107

Expert Mode:

  • WebSocket Server URL: wss://192.168.2.107:8089/ws
  • Enable RTCWeb Breaker: Checked
  • Disable 3GPP Early IMS: Checked

⚠️ Warning: Before login, open https://192.168.2.107:8089/ws in browser and accept the self-signed certificate.

Third-Party WebRTC Monitoring (--rtp-no-sig)

For monitoring WebRTC where you have no access to signaling (e.g., external providers).

When to Use

  • Third-party WebRTC service without signaling access
  • Only media (RTP) stream is accessible
  • Need QoS metrics without decryption

Configuration

# Start with --rtp-no-sig flag
voipmonitor --rtp-no-sig --interface eth0

# Or add to systemd service ExecStart line

Behavior:

  • CDRs created from RTP packets using SSRC identifiers
  • QoS metrics (MOS, jitter, packet loss) collected without decryption
  • Caller ID and call direction unavailable

With Audio Replay

Combine --rtp-no-sig with SSL Key Logger for full monitoring: 

# On WebRTC server
SSLKEYLOG_UDP='10.0.0.10:1234'
LD_PRELOAD='/path/to/sslkeylog.so'

# On VoIPmonitor sensor
ssl = yes
ssl_sessionkey_udp = yes
ssl_sessionkey_udp_port = 1234

See Also

AI Summary for RAG

Summary: Guide for monitoring encrypted WebRTC (WSS/DTLS-SRTP) with VoIPmonitor. CRITICAL: Add WebRTC ports to sipport (e.g., sipport = 5060,8088,8089) before configuring decryption. Two methods: Private Key (ssl_ipport = IP:PORT /path/key.pem) fails with TLS 1.3/PFS; SSL Key Logger works with all ciphers via LD_PRELOAD injection and ssl_sessionkey_udp=yes. For distributed mode, send keys to central server IP. Includes Asterisk WSS/PJSIP setup. Use --rtp-no-sig for third-party WebRTC without signaling access.

Keywords: webrtc, wss, secure websocket, dtls, srtp, encrypted, tls, ssl, asterisk, pjsip, freeswitch, decryption, ssl_ipport, sslkeylog, ld_preload, ssl_sessionkey_udp, sipport, rtp-no-sig, pfs, tls 1.3, distributed mode, 8088, 8089

Key Questions:

  • How do I monitor encrypted WebRTC calls with VoIPmonitor?
  • Why is VoIPmonitor not detecting WebRTC traffic?
  • How do I configure sipport for WebRTC ports 8088/8089?
  • What is the difference between Private Key and SSL Key Logger decryption methods?
  • How do I configure Asterisk for secure WebRTC?
  • How does --rtp-no-sig work for third-party WebRTC monitoring?
  • How do I decrypt DTLS-SRTP for audio replay?
Retrieved from "https://www.voipmonitor.org/doc/index.php?title=WebRTC&oldid=10171"