{"id":271,"date":"2017-03-15T18:14:39","date_gmt":"2017-03-15T18:14:39","guid":{"rendered":"https:\/\/blog.mozilla.org\/webrtc\/?p=271"},"modified":"2019-04-19T23:43:48","modified_gmt":"2019-04-19T23:43:48","slug":"debugging-encrypted-rtp-is-more-fun-than-it-used-to-be","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/","title":{"rendered":"Debugging encrypted RTP is more fun than it used to be"},"content":{"rendered":"<p>If you ever were in the situation to try to find out why the video quality of your WebRTC call was not good, you probably have also sworn at the encrypted RTP and RTCP. Instead of trying to put log statements into your locally compiled Firefox version, you can now simply request logging of the RTP and RTCP packets.<\/p>\n<p><a href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1343640\">Bug 1343640<\/a> adds support in Firefox version 55 to log the RTP header plus the first five bytes of the payload unencrypted. RTCP will be logged in full and unencrypted.<!--more--><\/p>\n<h3>How to turn on RTP logging<\/h3>\n<p>As described on <a href=\"https:\/\/wiki.mozilla.org\/Media\/WebRTC\/Logging\">Firefox Media Logging page<\/a> you have to set environment variables to turn on the logging. Note that we now need to use MOZ_LOG instead of NSPR_LOG as used to be the case. So a real world example which logs the SDP and the RTP would look like this:<\/p>\n<pre>  MOZ_LOG=timestamp,signaling:5,jsep:5,RtpLogger:5\r\n  MOZ_LOG_FILE=\/tmp\/logs\/moz.log\r\n\r\n<\/pre>\n<h3>The result in the log<\/h3>\n<p>With those settings, if you now make your WebRTC call with Firefox the moz.log file will contain lines likes this:<\/p>\n<pre>  I 14:53:41.688890\u00a0 000000 81 c9 00 07 90 2f 9e 2e bc 5e 9a 40 00 00 00 00\r\n                            00 00 46 e1 00 00 01 11 09 f3 64 32 00 02 4a 79\r\n                            81 ca 00 0c 90 2f 9e 2e 01 26 7b 39 63 30 30 65\r\n                            62 39 32 2d 31 61 66 62 2d 39 64 34 39 2d 61 34\r\n                            37 64 2d 39 31 66 36 34 65 65 65 36 39 66 35 7d\r\n                            00 00 00 00 81 cb 00 01 90 2f 9e 2e\r\n                            RTCP_PACKET 55f7a768a2ded2f1| Transmit video[{ec753ef6-11c1-be4f-bf5b-33cd30a1146c}]\r\n  O 14:53:41.689346\u00a0 000000 81 c9 00 07 bc 5e 9a 40 90 2f 9e 2e 00 00 00 00\r\n                            00 00 4a 8b 00 00 01 06 09 f0 ec ae 00 04 c2 1d\r\n                            81 ca 00 0c bc 5e 9a 40 01 26 7b 65 36 62 33 64\r\n                            61 62 38 2d 30 39 61 36 2d 31 33 34 66 2d 62 61\r\n                            65 33 2d 34 63 36 33 65 62 65 63 34 64 36 31 7d\r\n                            00 00 00 00 81 cb 00 01 bc 5e 9a 40\r\n                            RTCP_PACKET 55f7a768a2ded2f1| Receive audio[{65610c20-05d7-8c4d-babf-1e153f90e5b0}]<\/pre>\n<p>Note: the lines are broken over several lines here for readability. In the log file each packet is just one really long line.<\/p>\n<p>The log lines are in the <a href=\"https:\/\/www.wireshark.org\/docs\/man-pages\/text2pcap.html\">text2pcap<\/a> format. RTP packets will have RTP_PACKET at the end of the line, which allows you to filter for either that or RTCP packets. You might have also noticed that the track ID from the MSID is present. So if you have access to the SDP from the signaling, for example on &#8216;<em>about:webrtc<\/em>&#8216;, you can also filter all incoming and outgoing RTP and RTCP messages for a single audio or video track.<\/p>\n<h3>Limitations<\/h3>\n<p>Right now you will see all incoming RTCP packets multiple times if the call had more then one track in it. The reason is that each track is able to decrypt the RTCP and forwards it down into its RTP stack. But the relevance filtering of the RTCP message happens a lot later in the RTP\/RTCP stack.<\/p>\n<h3>Convert logs into PCAP<\/h3>\n<p>Finally here is one handy line to convert all RTP and RTCP from the log file into a PCAP file which can be loaded and analyzed with <a href=\"https:\/\/www.wireshark.org\/\">Wireshark<\/a>:<\/p>\n<pre>  egrep '(RTP_PACKET|RTCP_PACKET)' moz.log | text2pcap -D -n -l 1 -i 17 -u 1234,1235 -t '%H:%M:%S.' - rtp.pcap<\/pre>\n<p>Wireshark allows you now easily to search for example for NACKs or PLIs in the RTCP and check if the requested video packet got send to or by Firefox.<\/p>\n<div id=\"attachment_275\" style=\"width: 710px\" class=\"wp-caption aligncenter\"><img aria-describedby=\"caption-attachment-275\" decoding=\"async\" loading=\"lazy\" class=\"wp-image-275 size-large\" src=\"http:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02-700x425.png\" alt=\"\" width=\"700\" height=\"425\" srcset=\"https:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02-700x425.png 700w, https:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02-250x152.png 250w, https:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02-768x467.png 768w, https:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02-120x73.png 120w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><p id=\"caption-attachment-275\" class=\"wp-caption-text\">Sample RTP in Wireshark<\/p><\/div>\n<p>Note: sometimes Wireshark will show just UDP packets and not RTP. In that case just do a right mouse click on one of the UDP packets and chose &#8220;Decode As&#8221; and then select RTP from the drop down menu. Then Wireshark will decode the RTP and RTCP packets properly.<\/p>\n<p>And here are two filter criteria for future reference:<\/p>\n<ul>\n<li>NACK: &#8216;rtcp.rtpfb.fmt == 1&#8217;<\/li>\n<li>PLI: &#8216;rtcp.psfb.fmt == 1&#8217;<\/li>\n<\/ul>\n<h3>Update<\/h3>\n<p>If your log lines start with an extra GECKO like this &#8220;GECKO(23379) | I 16:36:58.954388&#8221; you might need to tweak you grep command to something like this:<\/p>\n<pre> egrep '(RTP_PACKET|RTCP_PACKET)' moz.log | cut -d '|' -f 2 | text2pcap -D -n -l 1 -i 17 -u 1234,1235 -t '%H:%M:%S.' - rtp.pcap<\/pre>\n<h3>Update 2<\/h3>\n<p>Most recently more updates made the above line not work fully any more. So here is a version which works again with Firefox &gt;= 65:<\/p>\n<pre> egrep '(RTP_PACKET|RTCP_PACKET)' moz.log.child-4 | cut -d '|' -f 2 | cut -d ' ' -f 5- | text2pcap -D -n -l 1 -i 17 -u 1234,1235 -t '%H:%M:%S.' - rtp.pcap<\/pre>\n","protected":false},"excerpt":{"rendered":"If you ever were in the situation to try to find out why the video quality of your WebRTC call was not good, you probably have also sworn at the encrypted RTP and RTCP. Instead of trying to put log statements into your locally compiled Firefox version, you can now simply request logging of the [&hellip;]","protected":false},"author":1151,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[301104,300086],"coauthors":[264764],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Debugging encrypted RTP is more fun than it used to be - Advancing WebRTC<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Debugging encrypted RTP is more fun than it used to be - Advancing WebRTC\" \/>\n<meta property=\"og:description\" content=\"If you ever were in the situation to try to find out why the video quality of your WebRTC call was not good, you probably have also sworn at the encrypted RTP and RTCP. Instead of trying to put log statements into your locally compiled Firefox version, you can now simply request logging of the [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/\" \/>\n<meta property=\"og:site_name\" content=\"Advancing WebRTC\" \/>\n<meta property=\"article:published_time\" content=\"2017-03-15T18:14:39+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-04-19T23:43:48+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02-700x425.png\" \/>\n<meta name=\"author\" content=\"Nils Ohlmeier\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@nilsohlmeier\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nils Ohlmeier\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/\",\"url\":\"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/\",\"name\":\"Debugging encrypted RTP is more fun than it used to be - Advancing WebRTC\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/webrtc\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02-700x425.png\",\"datePublished\":\"2017-03-15T18:14:39+00:00\",\"dateModified\":\"2019-04-19T23:43:48+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/webrtc\/#\/schema\/person\/76bbd261b8442faecc23b88127c82a9a\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/#primaryimage\",\"url\":\"https:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02.png\",\"contentUrl\":\"https:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02.png\",\"width\":2870,\"height\":1744},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/webrtc\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Debugging encrypted RTP is more fun than it used to be\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/webrtc\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/webrtc\/\",\"name\":\"Advancing WebRTC\",\"description\":\"Committed to moving Firefox and WebRTC forward\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/webrtc\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/webrtc\/#\/schema\/person\/76bbd261b8442faecc23b88127c82a9a\",\"name\":\"Nils Ohlmeier\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/webrtc\/#\/schema\/person\/image\/bdf2a94f7762f770fb4d270f302e48ac\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/24cf57862ae4c7665f706d12c19b98e7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/24cf57862ae4c7665f706d12c19b98e7?s=96&d=mm&r=g\",\"caption\":\"Nils Ohlmeier\"},\"description\":\"Hacking on real time communications since 2002\",\"sameAs\":[\"https:\/\/x.com\/nilsohlmeier\"],\"url\":\"https:\/\/blog.mozilla.org\/webrtc\/author\/nohlmeiermozilla-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Debugging encrypted RTP is more fun than it used to be - Advancing WebRTC","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/","og_locale":"en_US","og_type":"article","og_title":"Debugging encrypted RTP is more fun than it used to be - Advancing WebRTC","og_description":"If you ever were in the situation to try to find out why the video quality of your WebRTC call was not good, you probably have also sworn at the encrypted RTP and RTCP. Instead of trying to put log statements into your locally compiled Firefox version, you can now simply request logging of the [&hellip;]","og_url":"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/","og_site_name":"Advancing WebRTC","article_published_time":"2017-03-15T18:14:39+00:00","article_modified_time":"2019-04-19T23:43:48+00:00","og_image":[{"url":"http:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02-700x425.png"}],"author":"Nils Ohlmeier","twitter_card":"summary_large_image","twitter_creator":"@nilsohlmeier","twitter_misc":{"Written by":"Nils Ohlmeier","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/","url":"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/","name":"Debugging encrypted RTP is more fun than it used to be - Advancing WebRTC","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/webrtc\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/#primaryimage"},"image":{"@id":"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/#primaryimage"},"thumbnailUrl":"http:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02-700x425.png","datePublished":"2017-03-15T18:14:39+00:00","dateModified":"2019-04-19T23:43:48+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/webrtc\/#\/schema\/person\/76bbd261b8442faecc23b88127c82a9a"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/#primaryimage","url":"https:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02.png","contentUrl":"https:\/\/blog.mozilla.org\/webrtc\/files\/2017\/03\/Screen-Shot-2017-03-15-at-11.11.02.png","width":2870,"height":1744},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/webrtc\/debugging-encrypted-rtp-is-more-fun-than-it-used-to-be\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/webrtc\/"},{"@type":"ListItem","position":2,"name":"Debugging encrypted RTP is more fun than it used to be"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/webrtc\/#website","url":"https:\/\/blog.mozilla.org\/webrtc\/","name":"Advancing WebRTC","description":"Committed to moving Firefox and WebRTC forward","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/webrtc\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/webrtc\/#\/schema\/person\/76bbd261b8442faecc23b88127c82a9a","name":"Nils Ohlmeier","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/webrtc\/#\/schema\/person\/image\/bdf2a94f7762f770fb4d270f302e48ac","url":"https:\/\/secure.gravatar.com\/avatar\/24cf57862ae4c7665f706d12c19b98e7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/24cf57862ae4c7665f706d12c19b98e7?s=96&d=mm&r=g","caption":"Nils Ohlmeier"},"description":"Hacking on real time communications since 2002","sameAs":["https:\/\/x.com\/nilsohlmeier"],"url":"https:\/\/blog.mozilla.org\/webrtc\/author\/nohlmeiermozilla-com\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/webrtc\/wp-json\/wp\/v2\/posts\/271"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/webrtc\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/webrtc\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/webrtc\/wp-json\/wp\/v2\/users\/1151"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/webrtc\/wp-json\/wp\/v2\/comments?post=271"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/webrtc\/wp-json\/wp\/v2\/posts\/271\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/webrtc\/wp-json\/wp\/v2\/media?parent=271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/webrtc\/wp-json\/wp\/v2\/categories?post=271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/webrtc\/wp-json\/wp\/v2\/tags?post=271"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/webrtc\/wp-json\/wp\/v2\/coauthors?post=271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}