WebRTC: Difference between revisions

From VoIPmonitor.org
(Add Part 4 about --rtp-no-sig for third-party WebRTC monitoring when signaling access is not available)
(Rewrite: konsolidace, lepší struktura, tabulka pro srovnání metod, warning/note boxy, See Also sekce)
 
(5 intermediate revisions by the same user not shown)
Line 1: Line 1:
{{DISPLAYTITLE:Monitoring Encrypted WebRTC (WSS/DTLS-SRTP)}}
{{DISPLAYTITLE:Monitoring Encrypted WebRTC (WSS/DTLS-SRTP)}}


'''This guide provides a complete, step-by-step tutorial for configuring Asterisk to support secure WebRTC clients and enabling VoIPmonitor to capture and decrypt the associated SIP over Secure WebSocket (WSS) and SRTP traffic.'''
'''This guide covers monitoring encrypted WebRTC traffic with VoIPmonitor, including SIP over Secure WebSocket (WSS) and DTLS-SRTP media encryption.'''


== Overview ==
== Overview ==
WebRTC (Web Real-Time Communication) requires encrypted transport for both signaling and media. This is achieved using:
*'''WSS (Secure WebSocket):''' For the SIP signaling, encrypting it with TLS.
*'''DTLS-SRTP:''' For the media (RTP) stream, encrypting it with DTLS negotiation to establish SRTP keys.


VoIPmonitor can sniff and decrypt both layers, provided it has access to the private TLS key used by the PBX. This guide will walk through the full setup for Asterisk.
WebRTC requires encrypted transport for both signaling and media:
* '''WSS (Secure WebSocket):''' SIP signaling encrypted with TLS
* '''DTLS-SRTP:''' Media (RTP) encrypted via DTLS key negotiation


== Part 1: Configuring VoIPmonitor to Decrypt TLS ==
VoIPmonitor can decrypt both layers using either a private TLS key or the SSL Key Logger method.
First, ensure your sensor is configured to decrypt TLS traffic. In `/etc/voipmonitor.conf`, you must enable the SSL module and provide the path to the same private key your PBX will use.


<pre>
<kroki lang="mermaid">
%%{init: {'flowchart': {'nodeSpacing': 15, 'rankSpacing': 30}}}%%
flowchart LR
    subgraph Browser["WebRTC Client"]
        WC[Web Browser]
    end
    subgraph PBX["Asterisk PBX"]
        WSS[WSS :8089]
        SRTP[DTLS-SRTP]
    end
    subgraph VM["VoIPmonitor"]
        CAP[Capture]
        DEC[Decrypt]
        CDR[CDR]
    end
    WC -->|"SIP/WSS"| WSS
    WC -->|"Media"| SRTP
    WSS -.->|"mirror"| CAP
    SRTP -.->|"mirror"| CAP
    CAP --> DEC --> CDR
</kroki>
 
== Prerequisites: Configure sipport ==
 
{{Warning|1=VoIPmonitor only monitors port 5060 by default. You '''must''' add WebRTC ports to <code>sipport</code> or traffic will be ignored.}}
 
Edit <code>/etc/voipmonitor.conf</code>:
 
<syntaxhighlight lang="ini">
# Add WebRTC ports (WS=8088, WSS=8089)
sipport = 5060,8088,8089
 
# Or use port ranges
sipport = 5060,8080-8090
</syntaxhighlight>
 
Restart after changes: <code>systemctl restart voipmonitor</code>
 
{{Note|1=In probe/server architecture, configure <code>sipport</code> on '''both''' probe and server.}}
 
== Decryption Methods ==
 
Choose based on your environment:
 
{| class="wikitable"
|-
! Method !! When to Use !! Limitations
|-
| '''A: Private Key''' || Development/testing, RSA ciphers || Fails with TLS 1.3/PFS (DHE/ECDHE)
|-
| '''B: SSL Key Logger''' || Production, TLS 1.3, PFS, distributed setups || Requires library injection on PBX
|}
 
=== Method A: Private Key ===
 
<syntaxhighlight lang="ini">
# /etc/voipmonitor.conf
# /etc/voipmonitor.conf
ssl = yes
ssl_ipport = 192.168.2.107:8089 /etc/asterisk/keys/asterisk.pem
# Or use CIDR for multiple hosts
ssl_ipport = 192.168.2.0/24:8089 /path/to/key.pem
</syntaxhighlight>
=== Method B: SSL Key Logger ===
Works with ALL cipher suites including TLS 1.3 and PFS.
'''1. Compile the library:'''
<syntaxhighlight lang="bash">
git clone https://github.com/voipmonitor/sniffer.git /usr/local/src/voipmonitor-git
cd /usr/local/src/voipmonitor-git/tools/ssl_keylogger/
make
</syntaxhighlight>
'''2. Configure PBX to send session keys:'''
For Asterisk (create <code>/etc/default/asterisk-ssl</code>):
<syntaxhighlight lang="bash">
SSLKEYLOG_UDP='127.0.0.1:1234'
LD_PRELOAD='/usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so'
</syntaxhighlight>
For FreeSWITCH, add to systemd service:
<syntaxhighlight lang="bash">
ExecStart=env SSLKEYLOG_UDP='127.0.0.1:1234' LD_PRELOAD='/path/to/sslkeylog.so' /usr/bin/freeswitch ...
</syntaxhighlight>


'''3. Configure VoIPmonitor:'''
<syntaxhighlight lang="ini">
# /etc/voipmonitor.conf
ssl = yes
ssl = yes
ssl_ipport = 192.168.2.0/24:8089    # NO key file path!
ssl_sessionkey_udp = yes
ssl_sessionkey_udp_port = 1234
# Add loopback if sending keys locally
interface = eth0,lo
</syntaxhighlight>
{{Tip|1=For distributed mode (<code>packetbuffer_sender=yes</code>), send keys to the '''central server IP''', not localhost.}}


# Point to the private key used by your PBX.
For complete SSL Key Logger documentation, see [[Tls#Method_2:_SSL_Key_Logger|TLS Decryption]].
# Format: <IP of PBX> : <WSS Port> /path/to/private.key
#
# Example for this guide:
ssl_ipport = 192.168.2.107 : 8089 /etc/asterisk/keys/asterisk.pem
</pre>
''Note: This configuration is also applicable for FreeSWITCH. You would just need to point to the key file used by FreeSWITCH.''


== Part 2: Configuring Asterisk for Secure WebRTC ==
== Asterisk Configuration ==
This section details the full configuration for Asterisk, from generating keys to setting up PJSIP endpoints.


=== Step 1: Generate TLS Certificates ===
=== Step 1: Generate TLS Certificates ===
First, we need to create a Certificate Authority (CA) and a server certificate that Asterisk will use for its HTTPS and WSS interfaces.


<pre>
<syntaxhighlight lang="bash">
# Create a directory for your keys
mkdir -p /etc/asterisk/keys && cd /etc/asterisk/keys
mkdir -p /etc/asterisk/keys
cd /etc/asterisk/keys


# 1. Create a private key for your local Certificate Authority (CA)
# Create CA
openssl genrsa -des3 -out ca.key 4096
openssl genrsa -des3 -out ca.key 4096
# 2. Create a root CA certificate
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt


# 3. Create a private key for the Asterisk server
# Create server certificate
openssl genrsa -out key.pem 2048
openssl genrsa -out key.pem 2048
openssl req -new -key key.pem -out server.csr
openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out cert.crt


# 4. Create a certificate signing request (CSR) for the Asterisk server
# Combine for Asterisk
openssl req -new -key key.pem -out req-sip_server.csr
cat key.pem cert.crt > asterisk.pem
 
</syntaxhighlight>
# 5. Sign the server certificate with your CA
openssl x509 -req -days 3650 -in req-sip_server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out cert-sip_server.crt
 
# 6. Combine the private key and signed certificate into a single .pem file for Asterisk
cat key.pem > asterisk.pem
cat cert-sip_server.crt >> asterisk.pem
</pre>
 
=== Step 2: Configure Asterisk's HTTP Server for WSS ===
Edit `/etc/asterisk/http.conf` to enable the built-in web server and activate TLS for the WebSocket transport.


<pre>
=== Step 2: Configure HTTP Server ===
; /etc/asterisk/http.conf


<code>/etc/asterisk/http.conf</code>:
<syntaxhighlight lang="ini">
[general]
[general]
enabled = yes
enabled = yes
bindaddr = 0.0.0.0
bindaddr = 0.0.0.0
bindport = 8088 ; Port for unencrypted WS
bindport = 8088         ; WS (unencrypted)
 
tlsenable = yes
tlsenable = yes
tlsbindaddr = 0.0.0.0:8089 ; Port for encrypted WSS
tlsbindaddr = 0.0.0.0:8089 ; WSS (encrypted)
tlscertfile = /etc/asterisk/keys/asterisk.pem
tlscertfile = /etc/asterisk/keys/asterisk.pem
tlscipher = AES128-SHA
tlscipher = AES128-SHA
</pre>
</syntaxhighlight>
 
=== Step 3: Configure RTP Settings ===
Edit `/etc/asterisk/rtp.conf` and ensure ICE support is enabled, which is essential for WebRTC clients to traverse NAT.


<pre>
=== Step 3: Configure RTP ===
; /etc/asterisk/rtp.conf


<code>/etc/asterisk/rtp.conf</code>:
<syntaxhighlight lang="ini">
[general]
[general]
icesupport = yes
icesupport = yes
; You can optionally configure a public STUN server
; stunaddr = stun.l.google.com:19302
; stunaddr = stun.l.google.com:19302
</pre>
</syntaxhighlight>


=== Step 4: Configure PJSIP for WebRTC ===
=== Step 4: Configure PJSIP ===
This is the core configuration. We will set up UDP, WS, and WSS transports, and then create endpoints that require DTLS encryption.


;First, disable the old chan_sip module in `/etc/asterisk/modules.conf` to avoid conflicts:
Disable old chan_sip in <code>/etc/asterisk/modules.conf</code>:
<pre>
<syntaxhighlight lang="ini">
; /etc/asterisk/modules.conf
noload => chan_sip.so
noload => chan_sip.so
</pre>
</syntaxhighlight>
 
;Next, configure `/etc/asterisk/pjsip.conf`:
<pre>
; /etc/asterisk/pjsip.conf


<code>/etc/asterisk/pjsip.conf</code>:
<syntaxhighlight lang="ini">
[global]
[global]
type = global
type = global
user_agent = MyAsteriskPBX
realm = 192.168.2.107
realm = 192.168.2.107 ; Use your Asterisk server's IP or domain


; --- Transports ---
; --- Transports ---
Line 109: Line 176:
protocol = udp
protocol = udp
bind = 0.0.0.0:5060
bind = 0.0.0.0:5060
[transport-ws]
type = transport
protocol = ws
bind = 0.0.0.0:8088


[transport-wss]
[transport-wss]
Line 120: Line 182:
bind = 0.0.0.0:8089
bind = 0.0.0.0:8089


; --- WebRTC Endpoint Template ---
; --- WebRTC Template ---
; We create a template to avoid repeating settings
[webrtc-template](!)
[webrtc-endpoint-template](!)
type = endpoint
type = endpoint
disallow = all
disallow = all
allow = opus,ulaw,alaw
allow = opus,ulaw,alaw
context = internal-webrtc
context = internal-webrtc
auth = webrtc-auth
aors = webrtc-aor
; Require DTLS encryption for media
media_encryption = dtls
media_encryption = dtls
dtls_verify = fingerprint
dtls_verify = fingerprint
Line 138: Line 195:
use_avpf = yes
use_avpf = yes
ice_support = yes
ice_support = yes
media_use_received_transport = yes
rtcp_mux = yes
rtcp_mux = yes


; --- Define Users (101 and 102) ---
; --- User 101 ---
[101](webrtc-endpoint-template) ; Inherits from the template
[101](webrtc-template)
[webrtc-auth](+)
auth = 101-auth
aors = 101-aor
 
[101-auth]
type = auth
type = auth
auth_type = userpass
auth_type = userpass
username = 101
username = 101
password = your_strong_password_101
password = secret101
[webrtc-aor](+)
type = aor
max_contacts = 1


[102](webrtc-endpoint-template) ; Inherits from the template
[101-aor]
[webrtc-auth](+)
type = auth
auth_type = userpass
username = 102
password = your_strong_password_102
[webrtc-aor](+)
type = aor
type = aor
max_contacts = 1
max_contacts = 1
</pre>
</syntaxhighlight>


=== Step 5: Create a Basic Dialplan ===
=== Step 5: Dialplan ===
Edit `/etc/asterisk/extensions.conf` to allow the two users to call each other.
 
<pre>
; /etc/asterisk/extensions.conf


<code>/etc/asterisk/extensions.conf</code>:
<syntaxhighlight lang="ini">
[internal-webrtc]
[internal-webrtc]
exten => 101,1,NoOp(Call to 101)
exten => _1XX,1,Dial(PJSIP/${EXTEN})
same => n,Dial(PJSIP/101)
</syntaxhighlight>
same => n,Hangup()
 
exten => 102,1,NoOp(Call to 102)
same => n,Dial(PJSIP/102)
same => n,Hangup()
</pre>
 
== Part 3: Configuring the WebRTC Client (sipML5) ==
Now, configure your WebRTC softphone to connect to Asterisk. This example uses the popular [https://www.doubango.org/sipml5/call.htm sipML5 online client].
 
=== Step 1: Basic Settings ===
Enter your user credentials on the main registration screen.
* '''Display Name:''' `101`
* '''Private Identity:''' `101`
* '''Public Identity:''' `sip:101@192.168.2.107`
* '''Password:''' `your_strong_password_101`
* '''Realm:''' `192.168.2.107`
 
=== Step 2: Expert Mode Settings ===
Click "Expert Mode" and configure the following:
* '''Disable Video:''' Checked (unless you need video).
* '''Enable RTCWeb Breaker:''' Checked.
* '''WebSocket Server URL:''' `wss://192.168.2.107:8089/ws` (Note the '''wss://''' prefix and the correct port).
* '''ICE Servers:''' `[]` (Leave empty or use `[{ "url": "stun:stun.l.google.com:19302" }]`)
* '''Disable 3GPP Early IMS:''' Checked.


=== Step 3: Trust the Certificate ===
== WebRTC Client Setup (sipML5) ==
Before attempting to register, you '''must''' open a new browser tab and navigate to `https://192.168.2.107:8089/ws`. Your browser will show a security warning because the certificate is self-signed. You must accept the risk and proceed. This action adds a temporary security exception, allowing the WebSocket connection to be established.


After completing these steps, you can return to the sipML5 tab and click "Login". Your client should register successfully, and calls will be encrypted and monitored by VoIPmonitor.
Using [https://www.doubango.org/sipml5/call.htm sipML5]:


== Part 4: Monitoring Third-Party WebRTC Services Without Signaling Access ==
'''Basic Settings:'''
* Display Name: <code>101</code>
* Private Identity: <code>101</code>
* Public Identity: <code>sip:101@192.168.2.107</code>
* Password: <code>secret101</code>
* Realm: <code>192.168.2.107</code>


In some scenarios, you may need to monitor WebRTC traffic from a third-party service where you cannot access the SIP signaling (for example, when monitoring calls from an external provider's WebRTC server). For these cases, VoIPmonitor offers the <code>--rtp-no-sig</code> command-line option, which allows you to capture and analyze RTP streams without processing signaling.
'''Expert Mode:'''
* WebSocket Server URL: <code>wss://192.168.2.107:8089/ws</code>
* Enable RTCWeb Breaker: Checked
* Disable 3GPP Early IMS: Checked


=== When to Use <code>--rtp-no-sig</code> ===
{{Warning|1=Before login, open <code><nowiki>https://192.168.2.107:8089/ws</nowiki></code> in browser and accept the self-signed certificate.}}


Use <code>--rtp-no-sig</code> when:
== Third-Party WebRTC Monitoring (--rtp-no-sig) ==
* You are monitoring WebRTC traffic from a third-party service where signaling is not accessible
* You have network access to the media (RTP) stream but not to the signaling (SIP/WS) packets
* You need to collect QoS metrics (MOS, packet loss, jitter) for WebRTC calls that use a single UDP port for all streams (BUNDLE)


=== How <code>--rtp-no-sig</code> Works ===
For monitoring WebRTC where you have no access to signaling (e.g., external providers).


When you start the VoIPmonitor sniffer with <code>--rtp-no-sig</code>:
=== When to Use ===
* VoIPmonitor creates CDRs (Call Detail Records) based entirely on RTP packets
* Third-party WebRTC service without signaling access
* It identifies separate RTP streams using SSRC (Synchronization Source) identifiers, not STUN packets
* Only media (RTP) stream is accessible
* It detects calls when RTP packets start flowing and closes them when the stream stops
* Need QoS metrics without decryption
* Quality metrics (MOS, packet loss, jitter) are collected even without decryption


=== Configuration ===
=== Configuration ===


To use <code>--rtp-no-sig</code>, modify your VoIPmonitor startup command or service file:
<syntaxhighlight lang="bash">
 
# Start with --rtp-no-sig flag
<pre>
# Direct command-line usage:
voipmonitor --rtp-no-sig --interface eth0
voipmonitor --rtp-no-sig --interface eth0


# For systemd service, edit /etc/systemd/system/voipmonitor.service
# Or add to systemd service ExecStart line
# Add the --rtp-no-sig flag to the ExecStart line:
</syntaxhighlight>
ExecStart=/usr/sbin/voipmonitor -c /etc/voipmonitor.conf --rtp-no-sig --daemon --pidfile /var/run/voipmonitor/voipmonitor.pid
</pre>
 
=== Limitations Without Signaling ===
 
When using <code>--rtp-no-sig</code>, certain features are unavailable or have limitations:
* Caller ID information is not available (no SIP INVITE to extract phone numbers)
* Call direction (incoming/outgoing) cannot be determined
* You must rely on IP addresses to group related calls
* Audio replay requires decryption (see below)
 
=== Decrypting DTLS-SRTP for Audio Replay ===
 
If you need to replay the audio from captured WebRTC calls, you must decrypt the DTLS-encrypted media. This is achieved by installing the VoIPmonitor SSL Key Logger library on the WebRTC server. The keylogger captures DTLS session keys and forwards them to the VoIPmonitor sensor.
 
For detailed instructions on setting up the SSL Key Logger, see the [[Tls]] documentation. The key points are:


1. The WebRTC server must have the <code>sslkeylog.so</code> library preloaded via <code>LD_PRELOAD</code>
'''Behavior:'''
2. The keylogger sends session keys to VoIPmonitor over UDP (or TCP for secure transport)
* CDRs created from RTP packets using SSRC identifiers
3. VoIPmonitor uses these keys to decrypt the DTLS handshake and derive SRTP master keys
* QoS metrics (MOS, jitter, packet loss) collected without decryption
* Caller ID and call direction unavailable


Note: Quality of Service (QoS) metrics can be collected by VoIPmonitor even without decryption, allowing you to monitor call quality while maintaining the encrypted media's confidentiality.
=== With Audio Replay ===


=== Combining <code>--rtp-no-sig</code> with SSL Key Logger ===
Combine <code>--rtp-no-sig</code> with SSL Key Logger for full monitoring:


For complete third-party WebRTC monitoring (CDRs + audio replay), combine both methods:
<syntaxhighlight lang="ini">
 
# On WebRTC server
<pre>
# On the WebRTC server:
# Configure SSL Key Logger to send session keys to VoIPmonitor sensor
SSLKEYLOG_UDP='10.0.0.10:1234'
SSLKEYLOG_UDP='10.0.0.10:1234'
LD_PRELOAD='/usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so'
LD_PRELOAD='/path/to/sslkeylog.so'


# On the VoIPmonitor sensor:
# On VoIPmonitor sensor
# Enable both RTP-only mode and key reception
ssl = yes
ssl_sessionkey_udp = yes
ssl_sessionkey_udp = yes
ssl_sessionkey_udp_port = 1234
ssl_sessionkey_udp_port = 1234
ssl = yes
</syntaxhighlight>
# Note: No ssl_ipport needed -- keys are applied dynamically


# Start VoIPmonitor with --rtp-no-sig:
== See Also ==
voipmonitor --rtp-no-sig --interface eth0
* [[Tls]] - Complete TLS/SRTP decryption guide
</pre>
* [[Sniffer_configuration]] - Full configuration reference
* [[Sniffing_modes]] - Deployment topologies


== AI Summary for RAG ==
== AI Summary for RAG ==
'''Summary:''' This guide provides a comprehensive tutorial on configuring VoIPmonitor to sniff encrypted WebRTC traffic, specifically SIP over Secure WebSockets (WSS) and DTLS-SRTP. It details the full setup process for an Asterisk PBX. Part 1 explains how to configure VoIPmonitor itself by enabling `ssl` and setting `ssl_ipport` with the correct private key. Part 2 provides a detailed, step-by-step guide for Asterisk, including: generating a self-signed CA and server certificate using OpenSSL; configuring Asterisk's HTTP server for WSS in `http.conf`; enabling ICE support in `rtp.conf`; and setting up PJSIP transports (`wss`) and endpoints with mandatory DTLS media encryption. Part 3 concludes with instructions for configuring a WebRTC client (sipML5) to connect to the secure Asterisk setup, emphasizing the need to manually trust the self-signed certificate in the browser. Part 4 explains how to use the `--rtp-no-sig` command-line option for monitoring third-party WebRTC services when signaling access is not available, including configuration instructions, limitations of RTP-only mode, how to combine it with the SSL Key Logger for audio replay, and using SSRC identifiers to separate RTP streams on a single UDP port (BUNDLE).
 
'''Keywords:''' webrtc, wss, secure websocket, dtls, srtp, encrypted, tls, ssl, asterisk, pjsip, http.conf, rtp.conf, sipml5, freeeswitch, decryption, `ssl_ipport`, openssl, certificate, self-signed, `--rtp-no-sig`, `rtp-no-sig`, rtp only, no signaling, third party, sslkeylog, key logger, ssrlc, bundle, single udp port, qos, quality of service, dtls-srtp decryption
'''Summary:''' Guide for monitoring encrypted WebRTC (WSS/DTLS-SRTP) with VoIPmonitor. CRITICAL: Add WebRTC ports to <code>sipport</code> (e.g., <code>sipport = 5060,8088,8089</code>) before configuring decryption. Two methods: Private Key (<code>ssl_ipport = IP:PORT /path/key.pem</code>) fails with TLS 1.3/PFS; SSL Key Logger works with all ciphers via <code>LD_PRELOAD</code> injection and <code>ssl_sessionkey_udp=yes</code>. For distributed mode, send keys to central server IP. Includes Asterisk WSS/PJSIP setup. Use <code>--rtp-no-sig</code> for third-party WebRTC without signaling access.
 
'''Keywords:''' webrtc, wss, secure websocket, dtls, srtp, encrypted, tls, ssl, asterisk, pjsip, freeswitch, decryption, ssl_ipport, sslkeylog, ld_preload, ssl_sessionkey_udp, sipport, rtp-no-sig, pfs, tls 1.3, distributed mode, 8088, 8089
 
'''Key Questions:'''
'''Key Questions:'''
* How can I monitor encrypted WebRTC calls?
* How do I monitor encrypted WebRTC calls with VoIPmonitor?
* How do I configure VoIPmonitor to decrypt WSS and DTLS-SRTP traffic?
* Why is VoIPmonitor not detecting WebRTC traffic?
* What Asterisk configuration is needed for secure WebRTC?
* How do I configure sipport for WebRTC ports 8088/8089?
* How do I set up a PJSIP endpoint for a WebRTC client?
* What is the difference between Private Key and SSL Key Logger decryption methods?
* How do I generate a self-signed certificate for Asterisk?
* How do I configure Asterisk for secure WebRTC?
* Why is my WebRTC client not connecting over WSS?
* How does --rtp-no-sig work for third-party WebRTC monitoring?
* What is the purpose of `dtls_cert_file` in `pjsip.conf`?
* How do I decrypt DTLS-SRTP for audio replay?
* How to configure sipML5 for a secure connection to Asterisk?
* How do I monitor WebRTC traffic from a third-party service without signaling access?
* What does the `--rtp-no-sig` command-line option do?
* How can I capture WebRTC RTP streams when SIP signaling is not available?
* What is the SSL Key Logger and how does it help decrypt WebRTC media?
* How do I use SSL Key Logger to replay audio from encrypted WebRTC calls?

Latest revision as of 16:50, 8 January 2026


This guide covers monitoring encrypted WebRTC traffic with VoIPmonitor, including SIP over Secure WebSocket (WSS) and DTLS-SRTP media encryption.

Overview

WebRTC requires encrypted transport for both signaling and media:

  • WSS (Secure WebSocket): SIP signaling encrypted with TLS
  • DTLS-SRTP: Media (RTP) encrypted via DTLS key negotiation

VoIPmonitor can decrypt both layers using either a private TLS key or the SSL Key Logger method.

Prerequisites: Configure sipport

⚠️ Warning: VoIPmonitor only monitors port 5060 by default. You must add WebRTC ports to sipport or traffic will be ignored.

Edit /etc/voipmonitor.conf: 

# Add WebRTC ports (WS=8088, WSS=8089)
sipport = 5060,8088,8089

# Or use port ranges
sipport = 5060,8080-8090

Restart after changes: systemctl restart voipmonitor

ℹ️ Note: In probe/server architecture, configure sipport on both probe and server.

Decryption Methods

Choose based on your environment:

Method When to Use Limitations
A: Private Key Development/testing, RSA ciphers Fails with TLS 1.3/PFS (DHE/ECDHE)
B: SSL Key Logger Production, TLS 1.3, PFS, distributed setups Requires library injection on PBX

Method A: Private Key

# /etc/voipmonitor.conf
ssl = yes
ssl_ipport = 192.168.2.107:8089 /etc/asterisk/keys/asterisk.pem

# Or use CIDR for multiple hosts
ssl_ipport = 192.168.2.0/24:8089 /path/to/key.pem

Method B: SSL Key Logger

Works with ALL cipher suites including TLS 1.3 and PFS.

1. Compile the library: 

git clone https://github.com/voipmonitor/sniffer.git /usr/local/src/voipmonitor-git
cd /usr/local/src/voipmonitor-git/tools/ssl_keylogger/
make

2. Configure PBX to send session keys:

For Asterisk (create /etc/default/asterisk-ssl): 

SSLKEYLOG_UDP='127.0.0.1:1234'
LD_PRELOAD='/usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so'

For FreeSWITCH, add to systemd service: 

ExecStart=env SSLKEYLOG_UDP='127.0.0.1:1234' LD_PRELOAD='/path/to/sslkeylog.so' /usr/bin/freeswitch ...

3. Configure VoIPmonitor: 

# /etc/voipmonitor.conf
ssl = yes
ssl_ipport = 192.168.2.0/24:8089    # NO key file path!
ssl_sessionkey_udp = yes
ssl_sessionkey_udp_port = 1234

# Add loopback if sending keys locally
interface = eth0,lo

💡 Tip: For distributed mode (packetbuffer_sender=yes), send keys to the central server IP, not localhost.

For complete SSL Key Logger documentation, see TLS Decryption.

Asterisk Configuration

Step 1: Generate TLS Certificates

mkdir -p /etc/asterisk/keys && cd /etc/asterisk/keys

# Create CA
openssl genrsa -des3 -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt

# Create server certificate
openssl genrsa -out key.pem 2048
openssl req -new -key key.pem -out server.csr
openssl x509 -req -days 3650 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out cert.crt

# Combine for Asterisk
cat key.pem cert.crt > asterisk.pem

Step 2: Configure HTTP Server

/etc/asterisk/http.conf: 

[general]
enabled = yes
bindaddr = 0.0.0.0
bindport = 8088          ; WS (unencrypted)
tlsenable = yes
tlsbindaddr = 0.0.0.0:8089  ; WSS (encrypted)
tlscertfile = /etc/asterisk/keys/asterisk.pem
tlscipher = AES128-SHA

Step 3: Configure RTP

/etc/asterisk/rtp.conf: 

[general]
icesupport = yes
; stunaddr = stun.l.google.com:19302

Step 4: Configure PJSIP

Disable old chan_sip in /etc/asterisk/modules.conf: 

noload => chan_sip.so

/etc/asterisk/pjsip.conf: 

[global]
type = global
realm = 192.168.2.107

; --- Transports ---
[transport-udp]
type = transport
protocol = udp
bind = 0.0.0.0:5060

[transport-wss]
type = transport
protocol = wss
bind = 0.0.0.0:8089

; --- WebRTC Template ---
[webrtc-template](!)
type = endpoint
disallow = all
allow = opus,ulaw,alaw
context = internal-webrtc
media_encryption = dtls
dtls_verify = fingerprint
dtls_cert_file = /etc/asterisk/keys/asterisk.pem
dtls_ca_file = /etc/asterisk/keys/ca.crt
dtls_setup = actpass
use_avpf = yes
ice_support = yes
rtcp_mux = yes

; --- User 101 ---
[101](webrtc-template)
auth = 101-auth
aors = 101-aor

[101-auth]
type = auth
auth_type = userpass
username = 101
password = secret101

[101-aor]
type = aor
max_contacts = 1

Step 5: Dialplan

/etc/asterisk/extensions.conf: 

[internal-webrtc]
exten => _1XX,1,Dial(PJSIP/${EXTEN})

WebRTC Client Setup (sipML5)

Using sipML5:

Basic Settings:

  • Display Name: 101
  • Private Identity: 101
  • Public Identity: sip:101@192.168.2.107
  • Password: secret101
  • Realm: 192.168.2.107

Expert Mode:

  • WebSocket Server URL: wss://192.168.2.107:8089/ws
  • Enable RTCWeb Breaker: Checked
  • Disable 3GPP Early IMS: Checked

⚠️ Warning: Before login, open https://192.168.2.107:8089/ws in browser and accept the self-signed certificate.

Third-Party WebRTC Monitoring (--rtp-no-sig)

For monitoring WebRTC where you have no access to signaling (e.g., external providers).

When to Use

  • Third-party WebRTC service without signaling access
  • Only media (RTP) stream is accessible
  • Need QoS metrics without decryption

Configuration

# Start with --rtp-no-sig flag
voipmonitor --rtp-no-sig --interface eth0

# Or add to systemd service ExecStart line

Behavior:

  • CDRs created from RTP packets using SSRC identifiers
  • QoS metrics (MOS, jitter, packet loss) collected without decryption
  • Caller ID and call direction unavailable

With Audio Replay

Combine --rtp-no-sig with SSL Key Logger for full monitoring: 

# On WebRTC server
SSLKEYLOG_UDP='10.0.0.10:1234'
LD_PRELOAD='/path/to/sslkeylog.so'

# On VoIPmonitor sensor
ssl = yes
ssl_sessionkey_udp = yes
ssl_sessionkey_udp_port = 1234

See Also

AI Summary for RAG

Summary: Guide for monitoring encrypted WebRTC (WSS/DTLS-SRTP) with VoIPmonitor. CRITICAL: Add WebRTC ports to sipport (e.g., sipport = 5060,8088,8089) before configuring decryption. Two methods: Private Key (ssl_ipport = IP:PORT /path/key.pem) fails with TLS 1.3/PFS; SSL Key Logger works with all ciphers via LD_PRELOAD injection and ssl_sessionkey_udp=yes. For distributed mode, send keys to central server IP. Includes Asterisk WSS/PJSIP setup. Use --rtp-no-sig for third-party WebRTC without signaling access.

Keywords: webrtc, wss, secure websocket, dtls, srtp, encrypted, tls, ssl, asterisk, pjsip, freeswitch, decryption, ssl_ipport, sslkeylog, ld_preload, ssl_sessionkey_udp, sipport, rtp-no-sig, pfs, tls 1.3, distributed mode, 8088, 8089

Key Questions:

  • How do I monitor encrypted WebRTC calls with VoIPmonitor?
  • Why is VoIPmonitor not detecting WebRTC traffic?
  • How do I configure sipport for WebRTC ports 8088/8089?
  • What is the difference between Private Key and SSL Key Logger decryption methods?
  • How do I configure Asterisk for secure WebRTC?
  • How does --rtp-no-sig work for third-party WebRTC monitoring?
  • How do I decrypt DTLS-SRTP for audio replay?
Retrieved from "https://www.voipmonitor.org/doc/index.php?title=WebRTC&oldid=10171"