[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

What rtp_decoder program is this? It’s not from Wireshark, so we’re most likely not familiar with it.

On 7 May 2025, at 08:23, Chandramouli P <moulicto@xxxxxxxxx> wrote:

Hello,

Any help would be appreciated. Thank you.

Best Regards,

Chandramouli.

On Tue, May 6, 2025 at 5:35 PM Chandramouli P <moulicto@xxxxxxxxx> wrote:

Hello,

I am trying to decrypt SRTP traffic of a WebRTC call. I captured keys using SSLKEYLOG and opened .pcap file in Wireshark and copied the fingerprint keys from SDP as below:

a=setup:active
a=fingerprint:sha-256 38:B7:95:45:AE:A4:FA:3F:9E:05:42:29:46:03:6E:53:BD:66:8F:D3:12:FF:12:F8:60:5C:11:98:31:19:08:A6
Hex stream= 7368612d3235362033383a42373a39353a34353a41453a41343a46413a33463a39453a30353a34323a32393a34363a30333a36453a35333a42443a36363a38463a44333a31323a46463a31323a46383a36303a35433a31313a39383a33313a31393a30383a4136
Base64= c2hhLTI1NiA3Rjo4MzpCMjpDNTpDNDoyMjo5RDpFMTo3RToxNDoxQjo5QzowRjpDMjo0MDo3MDo3ODo3MzoxOTo0NzoxNjo4MzowRDo1RTpDRjo2QTpFMDpGNDo5MzozRjpBQzpFRA==

a=setup:actpass
a=fingerprint:sha-256 7F:83:B2:C5:C4:22:9D:E1:7E:14:1B:9C:0F:C2:40:70:78:73:19:47:16:83:0D:5E:CF:6A:E0:F4:93:3F:AC:ED
Hex stream= 7368612d3235362037463a38333a42323a43353a43343a32323a39443a45313a37453a31343a31423a39433a30463a43323a34303a37303a37383a37333a31393a34373a31363a38333a30443a35453a43463a36413a45303a46343a39333a33463a41433a4544
Base64= c2hhLTI1NiAzODpCNzo5NTo0NTpBRTpBNDpGQTozRjo5RTowNTo0MjoyOTo0NjowMzo2RTo1MzpCRDo2Njo4RjpEMzoxMjpGRjoxMjpGODo2MDo1QzoxMTo5ODozMToxOTowODpBNg==

Now, after executing the below commands with both Hex stream (-k) and Base64 (-b), I am getting the below error:

error: too many digits in key/salt (should be 92 hexadecimal digits, found 140)

I am executing the command like below:

./rtp_decoder -a -t 10 -e 256 -k 7368612d3235362037463a38333a42323a43353a43343a32323a39443a45313a37453a31343a31423a39433a30463a43323a34303a37303a37383a37333a31393a34373a31363a38333a30443a35453a43463a36413a45303a46343a39333a33463a41433a4544 < pcap-original.pcap > output.txt

./rtp_decoder -a -t 10 -e 256 -b c2hhLTI1NiAzODpCNzo5NTo0NTpBRTpBNDpGQTozRjo5RTowNTo0MjoyOTo0NjowMzo2RTo1MzpCRDo2Njo4RjpEMzoxMjpGRjoxMjpGODo2MDo1QzoxMTo5ODozMToxOTowODpBNg== < pcap-original.pcap > output.txt

Can anyone help to resolve this issue? Thanks in advance.

Best Regards,
Chandramouli.

_______________________________________________
Wireshark-users mailing list -- wireshark-users@xxxxxxxxxxxxx
To unsubscribe send an email to wireshark-users-leave@xxxxxxxxxxxxx