<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><font face="monospace">If you are not able to decode the WebRTC
TLS connection in Wireshark, it's possible you are dealing with
a TLS 1.3 connection.</font></p>
<p><font face="monospace">In TLS 1.3, there is an extra "secrets"
file which must be plugged into Wireshark before it can decode
the communication, which contains transient data (per
connection!). It is no longer sufficient to go to Edit ->
Preferences -> Protocols -> TLS / SSL -> <b>RSA keys
list</b> and plug in your private key. In that same dialog
box, the field <b>(Pre)-Master-Secret log filename</b> also
becomes mandatory.<br>
</font></p>
<p><font face="monospace">Now, how to obtain the Master-Secret
file? In Chrome/Firefox as well as in cURL, you should find
support for the <b>SSLKEYLOGFILE=</b> environment variable.
Just make sure to set this variable to the desired filepath
before running the WebRTC client and it <i>should</i> dump the
secrets there. Which will ultimately get picked up by Wireshark
and the traffic will decode.</font></p>
<p><font face="monospace">Good luck! :)<br>
</font></p>
<pre class="moz-signature" cols="72">Liviu Chircu
<a class="moz-txt-link-abbreviated" href="http://www.twitter.com/liviuchircu">www.twitter.com/liviuchircu</a> | <a class="moz-txt-link-abbreviated" href="http://www.opensips-solutions.com">www.opensips-solutions.com</a>
OpenSIPS Summit 2024 Valencia, May 14-17 | <a class="moz-txt-link-abbreviated" href="http://www.opensips.org/events">www.opensips.org/events</a></pre>
<div class="moz-cite-prefix">On 06.04.2024 17:39, Prathibha B wrote:<br>
</div>
<blockquote type="cite"
cite="mid:TYZPR06MB75256C4DDE13329FFABB9725FC022@TYZPR06MB7525.apcprd06.prod.outlook.com">I
am unable to see the Voip calls in wireshark. For signaling
opensips is used. The calls are encrypted and it is webrtc
communication.</blockquote>
</body>
</html>