Check out sipdump module to grab that traffic.

Regards,

Fred Posner

On Aug 7, 2025, at 11:35 AM, peter walber via sr-users <sr-users@lists.kamailio.org> wrote:

Hello,

I can use wireshark to capture and filter packets now. But the payload ist encrypted and I don't know how to decrypt the app-data.
I can observe a lot of packets which are trevelling from the SIP Client to the webrtc-sip-gw. But can not decrypt the payload.

I have opened the network console of google chrom. I can see that the client starts the SIP request using JsSIP
**72 is my doorbird
**73 is my openhab SIP Client
---------------------------------------------------------

INVITE sip:**72@speedport.ip SIP/2.0
Via: SIP/2.0/WSS r64og133ol2n.invalid;branch=z9hG4bK2639027
Max-Forwards: 69
To: <sip:**72@speedport.ip>
From: <sip:**73@speedport.ip>;tag=0l5gn2o04p
Call-ID: k57isvj3jnib42sone96
CSeq: 6684 INVITE
Contact: <sip:gpmhi027@r64og133ol2n.invalid;transport=ws;ob>
Content-Type: application/sdp
Allow: INVITE,ACK,CANCEL,BYE,UPDATE,MESSAGE,OPTIONS,REFER,INFO,NOTIFY
Supported: ice,replaces,outbound
User-Agent: JsSIP 3.10.1
Content-Length: 1705
 v=0
o=- 8248900579316048806 2 IN IP4 127.0.0.1
s=-
t=0 0
a=group:BUNDLE 0
a=extmap-allow-mixed
a=msid-semantic: WMS c8e94492-8d01-4aa1-9023-497510a9054b
m=audio 43416 UDP/TLS/RTP/SAVPF 111 63 9 0 8 13 110 126
c=IN IP4 192.168.2.151
a=rtcp:9 IN IP4 0.0.0.0
a=candidate:1715666646 1 udp 2122260223 192.168.2.151 43416 typ host generation 0 network-id 1
a=candidate:2923572520 1 udp 2122194687 172.17.0.1 34664 typ host generation 0 network-id 2
a=candidate:2565352002 1 tcp 1518280447 192.168.2.151 9 typ host tcptype active generation 0 network-id 1
a=candidate:1357445564 1 tcp 1518214911 172.17.0.1 9 typ host tcptype active generation 0 network-id 2
a=ice-ufrag:vZWG
a=ice-pwd:NWYzQwxQ4nP4FdcL6XpCl66/
a=ice-options:trickle
a=fingerprint:sha-256 80:22:F4:1E:B4:94:EF:F8:44:FA:E9:CA:72:DA:75:F3:99:1F:10:8D:B4:11:B3:65:3D:F9:44:67:28:31:CB:E5
a=setup:actpass
a=mid:0
a=extmap:1 urn:ietf:params:rtp-hdrext:ssrc-audio-level
a=extmap:2 http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
a=extmap:3 http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:mid
a=sendrecv
a=msid:c8e94492-8d01-4aa1-9023-497510a9054b 8cd550e3-9b06-4e06-af55-f31b5392bafd
a=rtcp-mux
a=rtcp-rsize
a=rtpmap:111 opus/48000/2
a=rtcp-fb:111 transport-cc
a=fmtp:111 minptime=10;useinbandfec=1
a=rtpmap:63 red/48000/2
a=fmtp:63 111/111
a=rtpmap:9 G722/8000
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:13 CN/8000
a=rtpmap:110 telephone-event/48000
a=rtpmap:126 telephone-event/8000
a=ssrc:1295466586 cname:7i+lr9FQ7qgsLxhh
a=ssrc:1295466586 msid:c8e94492-8d01-4aa1-9023-497510a9054b 8cd550e3-9b06-4e06-af55-f31b5392bafd
---------------------------------------------
But I also see the obviously  kamilio responding with timeout
------------------------------------------------------------------------------------------
SIP/2.0 408 Request Timeout
Via: SIP/2.0/WSS r64og133ol2n.invalid;branch=z9hG4bK2315704;rport=58076;received=192.168.2.151
To: <sip:**73@speedport.ip>;tag=5532e97d005227a861814c798ae9fc63-c1c00000
From: <sip:**73@speedport.ip>;tag=kfjl6vah0u
Call-ID: p928jbnb7d2spbvdgoepjt
CSeq: 1 REGISTER
Server: kamailio (5.6.3 (x86_64/linux))
Content-Length: 0
 --------------------------------------------------------------------
does it help to analyse ?
Regards
Peter

Am 07.08.25 um 14:07 schrieb Henning Westerholt via sr-users:

Hello,
 have a look e.g. with tcpdump and wireshark what exactly happens. Maybe the connection is closed from one party. Sometimes TCP keep-alive or SIP REGISTER time intervals needs to be adapted to keep a connection open, e.g. in NAT scenarios.
 Cheers,
 Henning
 From: Peter Walber via sr-users <sr-users@lists.kamailio.org>
Sent: Donnerstag, 7. August 2025 09:56
To: sr-users@lists.kamailio.org
Cc: Peter Walber <peter.walber@t-online.de>
Subject: [SR-Users] problems using kamailio
 Hello,
 I try to use kamailio as webrtc-sip-gateway between my openhab smart home system and my doorbird doorbell with phone and camera.
I try to use the product of "https://github.com/florian-h05/webrtc-sip-gw". Which integrates kamailio together with rtpengine to the gateway.
I want to use openhab as SIP Client and have a Telekom Speedport Smart 4 Router on the other side. The webrtc-sip-gw from florian-h05 shall be the software between Openhab and the speedport smart 4. On the speedport smart router the SIP Server is enabled and configured. I can sucessfully call with zoiper extern phone numbers. The doorbird als is configured correctly. I can call the doorbird with my zioper softphone using the SIP interface of the doorbird. The runtime system is a  docker container on debian 12.  
I want to call the doorbird by SIP from my openhab SIP client.
I can initiate the call, but it doesn't establish
Here is the log from the docker container.
---------------------------------------------------------------------------------------------------
2025-08-07T07:46:57.384687165Z  9(52) INFO: <script>: HTTP Request Received
2025-08-07T07:46:57.391479050Z  9(52) INFO: <script>: START: REGISTER from sip:**73@speedport.ip(IP:192.168.2.185:39510)
2025-08-07T07:46:57.391516534Z  9(52) INFO: <script>: Current Contact header: <sip:v0fds0hl@fe8ojuo7pnkl.invalid;transport=ws>;+sip.ice;reg-id=1;+sip.instance="<urn:uuid:243e461d-f0cb-4c09-9a63-f57c9bba8d6b>";expires=600
2025-08-07T07:46:57.391526535Z  9(52) INFO: <script>: Setting new Contact header: <sip:**73@192.168.2.209:5060>
2025-08-07T07:47:00.195739350Z  9(52) INFO: <script>: START: INVITE from sip:**73@speedport.ip(IP:192.168.2.185:39510)
2025-08-07T07:47:00.195800424Z  9(52) INFO: <script>: Current Contact header: <sip:v0fds0hl@fe8ojuo7pnkl.invalid;transport=ws;ob>
2025-08-07T07:47:00.195811886Z  9(52) INFO: <script>: Setting new Contact header:<sip:v0fds0hl@fe8ojuo7pnkl.invalid;transport=ws;ob;alias=192.168.2.185~39510~6;alias=192.168.2.185~39510~6>
2025-08-07T07:47:00.196163528Z  9(52) INFO: <script>: MANAGE_BRANCH: New branch [0] to sip:**72@speedport.ip
2025-08-07T07:47:00.196181228Z  9(52) INFO: <script>: NATMANAGE branch_id:0 ruri: sip:**72@speedport.ip, method:INVITE, status:<null>, extra_id: z9hG4bK44082210, rtpengine_manage: replace-origin replace-session-connection via-branch=extra rtcp-mux-demux SDES-off ICE=remove RTP/AVP
2025-08-07T07:47:00.196608235Z INFO: [penvq8f06ehafutk9ivf]: [control] Received command 'offer' from 127.0.0.1:50790
2025-08-07T07:47:00.196625247Z NOTICE: [penvq8f06ehafutk9ivf]: [core] Creating new call
2025-08-07T07:47:00.198519843Z INFO: [penvq8f06ehafutk9ivf]: [control] Replying to 'offer' from 127.0.0.1:50790 (elapsed time 0.001979 sec)
2025-08-07T07:47:01.927528447Z  9(52) INFO: <script>: START: CANCEL from sip:**73@speedport.ip(IP:192.168.2.185:39510)
2025-08-07T07:47:01.927577111Z  9(52) INFO: <script>: Current Contact header: <null>
2025-08-07T07:47:01.927586439Z  9(52) INFO: <script>: Setting new Contact header: <null>
2025-08-07T07:47:09.169489716Z  7(50) INFO: <script>: WebSocket connection from 192.168.2.185:39510 has closed
2025-08-07T07:47:27.355185671Z  2(45) WARNING: tm [../../core/forward.h:203]: msg_send_buffer(): TCP/TLS connection for WebSocket could not be found
2025-08-07T07:47:27.914769340Z  9(52) INFO: <script>: HTTP Request Received
2025-08-07T07:47:27.951608347Z  9(52) INFO: <script>: START: REGISTER from sip:**73@speedport.ip(IP:192.168.2.185:44816)
2025-08-07T07:47:27.951663073Z  9(52) INFO: <script>: Current Contact header: <sip:lebth4eq@fe8ojuo7pnkl.invalid;transport=ws>;+sip.ice;reg-id=1;+sip.instance="<urn:uuid:39eac0ca-0aea-4526-a5c7-0516bc8a2d71>";expires=600
2025-08-07T07:47:27.951915520Z  9(52) INFO: <script>: Setting new Contact header: <sip:**73@192.168.2.209:5060>
2025-08-07T07:47:30.168546446Z  2(45) INFO: <script>: BRANCH FAILED: z9hG4bK4408221 + 0INFO: [penvq8f06ehafutk9ivf]: [control] Received command 'delete' from 127.0.0.1:36296
2025-08-07T07:47:30.168587880Z INFO: [penvq8f06ehafutk9ivf]: [core] Deleting call branch '' (via-branch 'z9hG4bK44082210')
2025-08-07T07:47:30.168597011Z INFO: [penvq8f06ehafutk9ivf]: [core] Call branch '' (via-branch 'z9hG4bK44082210') deleted, no more branches remaining
2025-08-07T07:47:30.168605215Z INFO: [penvq8f06ehafutk9ivf]: [core] Deleting entire call
2025-08-07T07:47:30.168612883Z INFO: [penvq8f06ehafutk9ivf]: [core] Final packet stats:
2025-08-07T07:47:30.168620604Z INFO: [penvq8f06ehafutk9ivf]: [core] --- Tag 'utenlull77', created 0:30 ago for branch ''
2025-08-07T07:47:30.168628359Z INFO: [penvq8f06ehafutk9ivf]: [core] ---     subscribed to ''
2025-08-07T07:47:30.168636445Z INFO: [penvq8f06ehafutk9ivf]: [core] ---     subscription for ''
2025-08-07T07:47:30.168645446Z INFO: [penvq8f06ehafutk9ivf]: [core] ------ Media #1 (audio over UDP/TLS/RTP/SAVPF) using unknown codec
2025-08-07T07:47:30.168653691Z INFO: [penvq8f06ehafutk9ivf]: [core] --------- Port   192.168.2.209:23484 <>   192.168.2.185:60650, SSRC 0, 0 p, 0 b, 0 e, 30 ts
2025-08-07T07:47:30.168661939Z INFO: [penvq8f06ehafutk9ivf]: [core] --- Tag '', created 0:30 ago for branch 'z9hG4bK44082210'
2025-08-07T07:47:30.168669844Z INFO: [penvq8f06ehafutk9ivf]: [core] ---     subscribed to 'utenlull77'
2025-08-07T07:47:30.168677713Z INFO: [penvq8f06ehafutk9ivf]: [core] ---     subscription for 'utenlull77'
2025-08-07T07:47:30.168685661Z INFO: [penvq8f06ehafutk9ivf]: [core] ------ Media #1 (audio over RTP/AVP) using unknown codec
2025-08-07T07:47:30.168693705Z INFO: [penvq8f06ehafutk9ivf]: [core] --------- Port   192.168.2.209:23472 <>                :0    , SSRC 0, 0 p, 0 b, 0 e, 30 ts
2025-08-07T07:47:30.168718608Z INFO: [penvq8f06ehafutk9ivf]: [core] --------- Port   192.168.2.209:23473 <>                :0     (RTCP), SSRC 0, 0 p, 0 b, 0 e, 30 ts
2025-08-07T07:47:30.168728065Z INFO: [penvq8f06ehafutk9ivf]: [control] Replying to 'delete' from 127.0.0.1:36296 (elapsed time 0.000505 sec)
2025-08-07T07:47:30.169042099Z  2(45) INFO: <script>: Failure: <null> 2(45) WARNING: tm [../../core/forward.h:203]: msg_send_buffer(): TCP/TLS connection for WebSocket could not be found
2025-08-07T07:47:30.265075785Z  9(52) INFO: <script>: START: INVITE from sip:**73@speedport.ip(IP:192.168.2.185:44816)
2025-08-07T07:47:30.265125134Z  9(52) INFO: <script>: Current Contact header: <sip:lebth4eq@fe8ojuo7pnkl.invalid;transport=ws;ob>
2025-08-07T07:47:30.265135557Z  9(52) INFO: <script>: Setting new Contact header:<sip:lebth4eq@fe8ojuo7pnkl.invalid;transport=ws;ob;alias=192.168.2.185~44816~6;alias=192.168.2.185~44816~6>
2025-08-07T07:47:30.265484502Z  9(52) INFO: <script>: MANAGE_BRANCH: New branch [0] to sip:**72@speedport.ip
2025-08-07T07:47:30.265664116Z  9(52) INFO: <script>: NATMANAGE branch_id:0 ruri: sip:**72@speedport.ip, method:INVITE, status:<null>, extra_id: z9hG4bK16860370, rtpengine_manage: replace-origin replace-session-connection via-branch=extra rtcp-mux-demux SDES-off ICE=remove RTP/AVP
2025-08-07T07:47:30.265819591Z INFO: [412n0o8dedgair81t70p]: [control] Received command 'offer' from 127.0.0.1:50790
2025-08-07T07:47:30.265979425Z NOTICE: [412n0o8dedgair81t70p]: [core] Creating new call
2025-08-07T07:47:30.267497852Z INFO: [412n0o8dedgair81t70p]: [control] Replying to 'offer' from 127.0.0.1:50790 (elapsed time 0.001599 sec)
2025-08-07T07:47:30.469565385Z  9(52) INFO: <script>: START: CANCEL from sip:**73@speedport.ip(IP:192.168.2.185:44816)
2025-08-07T07:47:30.469629711Z  9(52) INFO: <script>: Current Contact header: <null>
2025-08-07T07:47:30.469645116Z  9(52) INFO: <script>: Setting new Contact header: <null>
2025-08-07T07:47:41.207672567Z  7(50) INFO: <script>: WebSocket connection from 192.168.2.185:44816 has closed
2025-08-07T07:47:57.917754216Z  2(45) WARNING: tm [../../core/forward.h:203]: msg_send_buffer(): TCP/TLS connection for WebSocket could not be found
2025-08-07T07:48:00.230412646Z  2(45) INFO: <script>: BRANCH FAILED: z9hG4bK1686037 + 0INFO: [412n0o8dedgair81t70p]: [control] Received command 'delete' from 127.0.0.1:36296
2025-08-07T07:48:00.230457143Z INFO: [412n0o8dedgair81t70p]: [core] Deleting call branch '' (via-branch 'z9hG4bK16860370')
2025-08-07T07:48:00.230466718Z INFO: [412n0o8dedgair81t70p]: [core] Call branch '' (via-branch 'z9hG4bK16860370') deleted, no more branches remaining
2025-08-07T07:48:00.230475640Z INFO: [412n0o8dedgair81t70p]: [core] Deleting entire call
2025-08-07T07:48:00.230483968Z INFO: [412n0o8dedgair81t70p]: [core] Final packet stats:
2025-08-07T07:48:00.230491909Z INFO: [412n0o8dedgair81t70p]: [core] --- Tag 'hc7h5imu96', created 0:30 ago for branch ''
2025-08-07T07:48:00.230518917Z INFO: [412n0o8dedgair81t70p]: [core] ---     subscribed to ''
2025-08-07T07:48:00.230528302Z INFO: [412n0o8dedgair81t70p]: [core] ---     subscription for ''
2025-08-07T07:48:00.230537387Z INFO: [412n0o8dedgair81t70p]: [core] ------ Media #1 (audio over UDP/TLS/RTP/SAVPF) using unknown codec
2025-08-07T07:48:00.230545867Z INFO: [412n0o8dedgair81t70p]: [core] --------- Port   192.168.2.209:23400 <>   192.168.2.185:46431, SSRC 0, 0 p, 0 b, 0 e, 30 ts
2025-08-07T07:48:00.230554949Z INFO: [412n0o8dedgair81t70p]: [core] --- Tag '', created 0:30 ago for branch 'z9hG4bK16860370'
2025-08-07T07:48:00.230563124Z INFO: [412n0o8dedgair81t70p]: [core] ---     subscribed to 'hc7h5imu96'
2025-08-07T07:48:00.230570851Z INFO: [412n0o8dedgair81t70p]: [core] ---     subscription for 'hc7h5imu96'
2025-08-07T07:48:00.230578827Z INFO: [412n0o8dedgair81t70p]: [core] ------ Media #1 (audio over RTP/AVP) using unknown codec
2025-08-07T07:48:00.230587091Z INFO: [412n0o8dedgair81t70p]: [core] --------- Port   192.168.2.209:23494 <>                :0    , SSRC 0, 0 p, 0 b, 0 e, 30 ts
2025-08-07T07:48:00.230595631Z INFO: [412n0o8dedgair81t70p]: [core] --------- Port   192.168.2.209:23495 <>                :0     (RTCP), SSRC 0, 0 p, 0 b, 0 e, 30 ts
2025-08-07T07:48:00.230603868Z INFO: [412n0o8dedgair81t70p]: [control] Replying to 'delete' from 127.0.0.1:36296 (elapsed time 0.000253 sec)
2025-08-07T07:48:00.230753116Z  2(45) INFO: <script>: Failure: <null> 2(45) WARNING: tm [../../core/forward.h:203]: msg_send_buffer(): TCP/TLS connection for WebSocket could not be found
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
especially the bold lines  confuse me. Why is the TCP/TLS closed and can not be found ? Could that be the problem ?
 Thanks for some help and best regards
Peter

__________________________________________________________
Kamailio - Users Mailing List - Non Commercial Discussions -- sr-users@lists.kamailio.org
To unsubscribe send an email to sr-users-leave@lists.kamailio.org
Important: keep the mailing list in the recipients, do not reply only to the sender!