← Back to Knowledge Base

WebRTC Metrics

A comprehensive overview of WebRTC statistics, derived calculations, extracted features, and observable signals, to better understand call quality, connectivity, and user experience in rtcStats

Back
connectiondtlssrtpsecurity

DTLS and SRTP (feature)

Connection-level features capturing the negotiated DTLS role and version and the SRTP cipher derived from the handshake.

Description

Connection-level features, extracted per RTCPeerConnection into features_connection.

These features describe what the DTLS handshake that secures every WebRTC connection actually negotiated:

  • dtlsRole - DTLS role from the first transport stats entry with a tlsVersion.
  • dtlsVersion - the negotiated DTLS version.
  • srtpCipher - the SRTP cipher derived from DTLS.

How long that handshake took, and whether it completed, are covered by connection setup time (connectionTime and connected).

Extracted by the open-source rtcstats-features package into your own database.

Why it matters

dtlsVersion and srtpCipher are what a security audit asks for, answered from real traffic instead of from configuration: which of your connections still negotiate an old DTLS version, and which cipher your media is actually protected with. A long tail on either usually maps to old client versions or to a gateway in the path, and it is the evidence you need before turning something off.

dtlsRole tells you which side acted as the DTLS client, which is a property of the negotiation rather than of the call: it decides who sends the first handshake message, so it is worth checking when handshakes are slow or fail unevenly between cohorts.

Typical values

  • dtlsVersion should be DTLS 1.2 or newer; older values are worth investigating.
  • srtpCipher is typically AES_CM_128_HMAC_SHA1_80, or an AEAD cipher such as AEAD_AES_128_GCM on newer stacks.
  • dtlsRole is client or server, and is opposite between the two peers of a call.

SQL example

DTLS version and SRTP cipher distribution across all connections:

SELECT
  connection.dtls_version,
  connection.srtp_cipher,
  COUNT(*) AS connections
FROM features_connection AS connection
WHERE connection.dtls_version IS NOT NULL
GROUP BY connection.dtls_version, connection.srtp_cipher
ORDER BY connections DESC;

Related features

See also