← Back to Knowledge Base

WebRTC Metrics

A comprehensive overview of WebRTC statistics, derived calculations, extracted features, and observable signals, to better understand call quality, connectivity, and user experience in rtcStats

Back
On this page6 sections
connectiondtlssrtpsecurity

DTLS and SRTP (feature)

Last updated Applies tortcstats-serverrtcstats.com

Connection-level features capturing the negotiated DTLS role and version and the SRTP cipher derived from the handshake.

Description

Connection-level features, extracted per RTCPeerConnection into features_connection.

These features describe what the DTLS handshake that secures every WebRTC connection actually negotiated:

  • dtlsRole - DTLS role from the first transport stats entry with a tlsVersion.
  • dtlsVersion - the negotiated DTLS version.
  • srtpCipher - the SRTP cipher derived from DTLS.

How long that handshake took, and whether it completed, are covered by connection setup time (connectionTime and connected).

Extracted by the open-source rtcstats-features package into your own database.

Why it matters

dtlsVersion and srtpCipher are what a security audit asks for, answered from real traffic instead of from configuration: which of your connections still negotiate an old DTLS version, and which cipher your media is actually protected with. A long tail on either usually maps to old client versions or to a gateway in the path, and it is the evidence you need before turning something off.

dtlsRole tells you which side acted as the DTLS client, which is a property of the negotiation rather than of the call: it decides who sends the first handshake message, so it is worth checking when handshakes are slow or fail unevenly between cohorts.

Typical values

  • dtlsVersion should be DTLS 1.2 or newer; older values are worth investigating.
  • srtpCipher is typically AES_CM_128_HMAC_SHA1_80, or an AEAD cipher such as AEAD_AES_128_GCM on newer stacks.
  • dtlsRole is client or server, and is opposite between the two peers of a call.

SQL example

DTLS version and SRTP cipher distribution across all connections:

SELECT
  connection.dtls_version,
  connection.srtp_cipher,
  COUNT(*) AS connections
FROM features_connection AS connection
WHERE connection.dtls_version IS NOT NULL
GROUP BY connection.dtls_version, connection.srtp_cipher
ORDER BY connections DESC;

See also