DTLS handshake - Server Hello is sent to a wrong port

[floo94]

rtpengine version the issue has been seen with

mr13.4.1.1

Used distribution and its version

debian:bookworm container

Linux kernel version used

6.8.0-41-generic x86_64 GNU/Linux

CPU architecture issue was seen on (see uname -m)

x86_64

Expected behaviour you didn't see

Unexpected behaviour you saw

rtpengine sends the dtls server hello to the browser's client hello on a port other than the src port of the client hello.

Only after 1.5 seconds and further client hellos does rtpengine send the server hello to the source port. This causes an audio delay at the beginning of the conversation.

Steps to reproduce the problem

rtpengine is startet with:
--dtls-passive
parameters for the answer: endpoint-learning-heuristic strict-source replace-origin replace-session-connection UDP/TLS/RTP/SAVPF ICE=force rtcp-mux-require SDES-off

Additional program output to the terminal or logs illustrating the issue

tshark output:
1346	53.286747002	10.10.10.2	60918	192.168.178.61	65194	STUN	Binding Request user: /iZ+:P3vVihEB
1347	53.286898157	10.10.10.2	60918	172.16.100.101	58428	STUN	Binding Request user: /iZ+:P3vVihEB
1355	53.319978205	10.10.10.2	60902	192.168.178.61	65194	STUN	Binding Request user: /iZ+:hZC2xdyj
1356	53.320117474	10.10.10.2	60902	172.16.100.101	58428	STUN	Binding Request user: /iZ+:hZC2xdyj
1365	53.418836431	10.10.10.2	60902	192.168.178.61	65194	STUN	Binding Request user: /iZ+:hZC2xdyj
1366	53.418875530	10.10.10.2	60902	172.16.100.101	58428	STUN	Binding Request user: /iZ+:hZC2xdyj
1382	53.618894464	10.10.10.2	60902	192.168.178.61	65194	STUN	Binding Request user: /iZ+:hZC2xdyj
1383	53.618946367	10.10.10.2	60902	172.16.100.101	58428	STUN	Binding Request user: /iZ+:hZC2xdyj
1393	54.018872893	10.10.10.2	60902	192.168.178.61	65194	STUN	Binding Request user: /iZ+:hZC2xdyj
1394	54.018911737	10.10.10.2	60902	172.16.100.101	58428	STUN	Binding Request user: /iZ+:hZC2xdyj
1405	54.818891427	10.10.10.2	60902	192.168.178.61	65194	STUN	Binding Request user: /iZ+:hZC2xdyj
1406	54.818937934	10.10.10.2	60902	172.16.100.101	58428	STUN	Binding Request user: /iZ+:hZC2xdyj
1414	56.418865112	10.10.10.2	60902	192.168.178.61	65194	STUN	Binding Request user: /iZ+:hZC2xdyj
1415	56.418912073	10.10.10.2	60902	172.16.100.101	58428	STUN	Binding Request user: /iZ+:hZC2xdyj
1416	56.426403650	10.10.100.5	58428	10.10.10.2	60902	STUN	Binding Request user: hZC2xdyj:/iZ+
1417	56.426730597	10.10.10.2	60902	10.10.100.5	58428	STUN	Binding Success Response XOR-MAPPED-ADDRESS: 10.10.100.5:58428
1418	56.438861979	10.10.10.2	60902	10.10.100.5	58428	STUN	Binding Request user: /iZ+:hZC2xdyj
1419	56.445818057	10.10.100.5	58428	10.10.10.2	60902	DTLS	Client Hello
1420	56.446439632	10.10.10.2	60902	10.10.100.5	65194	DTLSv1.2	Server Hello, Certificate, Server Key Exchange, Certificate Request, Server Hello Done
1430	56.468283594	10.10.100.5	58428	10.10.10.2	60902	STUN	Binding Success Response XOR-MAPPED-ADDRESS: 10.10.10.2:60902
1431	56.484683575	10.10.100.5	58428	10.10.10.2	60902	STUN	Binding Request user: hZC2xdyj:/iZ+
1432	56.484874084	10.10.10.2	60902	10.10.100.5	58428	STUN	Binding Success Response XOR-MAPPED-ADDRESS: 10.10.100.5:58428
1434	56.560764212	10.10.100.5	58428	10.10.10.2	60902	DTLS	Client Hello
1435	56.560806069	10.10.100.5	58428	10.10.10.2	60902	STUN	Binding Request user: hZC2xdyj:/iZ+
1436	56.561026556	10.10.10.2	60902	10.10.100.5	58428	STUN	Binding Success Response XOR-MAPPED-ADDRESS: 10.10.100.5:58428
1437	56.631726729	10.10.100.5	58428	10.10.10.2	60902	DTLS	Client Hello
1452	56.870306411	10.10.100.5	58428	10.10.10.2	60902	DTLS	Client Hello
1460	57.353567546	10.10.100.5	58428	10.10.10.2	60902	DTLS	Client Hello
1461	57.798094084	10.10.100.5	58428	10.10.10.2	60902	STUN	Binding Request user: hZC2xdyj:/iZ+
1462	57.798328606	10.10.10.2	60902	10.10.100.5	58428	STUN	Binding Success Response XOR-MAPPED-ADDRESS: 10.10.100.5:58428
1468	58.240390862	10.10.10.2	60902	10.10.100.5	58428	DTLSv1.2	Server Hello
1469	58.240440172	10.10.10.2	60902	10.10.100.5	58428	DTLSv1.2	Certificate
1470	58.240457510	10.10.10.2	60902	10.10.100.5	58428	DTLSv1.2	Server Key Exchange
1471	58.240495915	10.10.10.2	60902	10.10.100.5	58428	DTLSv1.2	Certificate Request
1472	58.240514910	10.10.10.2	60902	10.10.100.5	58428	DTLSv1.2	Server Hello Done
1473	58.263342772	10.10.100.5	58428	10.10.10.2	60902	DTLSv1.2	Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message
1474	58.264690815	10.10.10.2	60902	10.10.100.5	58428	DTLSv1.2	Change Cipher Spec, Encrypted Handshake Message
1563	58.853241577	10.10.100.5	58428	10.10.10.2	60902	STUN	Binding Request user: hZC2xdyj:/iZ+
1564	58.853538261	10.10.10.2	60902	10.10.100.5	58428	STUN	Binding Success Response XOR-MAPPED-ADDRESS: 10.10.100.5:58428
1623	59.437261329	10.10.100.5	58428	10.10.10.2	60902	DTLSv1.2	Encrypted Alert



rtpengine log:
rtpengine-1  | 2025-08-27T13:57:03.401807044Z [1756303023.401722] DEBUG: [7olj69pdpq5jln10ere0]: [crypto] Creating passive DTLS connection context
rtpengine-1  | 2025-08-27T13:57:03.402200171Z [1756303023.402130] DEBUG: [7olj69pdpq5jln10ere0]: [crypto] Creating passive DTLS connection context
rtpengine-1  | 2025-08-27T13:57:03.402511838Z [1756303023.402424] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Learning new ICE candidate 3797796660:1
rtpengine-1  | 2025-08-27T13:57:03.402546757Z [1756303023.402433] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Created candidate pair Qp8em1ZUuP5n0iaG:3797796660:1 between 10.10.10.2 and 192.168.178.61:65194, type host
rtpengine-1  | 2025-08-27T13:57:03.402550211Z [1756303023.402435] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Learning new ICE candidate 2341342233:1
rtpengine-1  | 2025-08-27T13:57:03.402553156Z [1756303023.402440] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Created candidate pair Qp8em1ZUuP5n0iaG:2341342233:1 between 10.10.10.2 and 172.16.100.101:58428, type host
rtpengine-1  | 2025-08-27T13:57:03.402574232Z [1756303023.402442] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Learning new ICE candidate 883520042:1
rtpengine-1  | 2025-08-27T13:57:03.402577818Z [1756303023.402444] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Learning new ICE candidate 2652773296:1
rtpengine-1  | 2025-08-27T13:57:03.402580675Z [1756303023.402456] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:3797796660:1 from 10.10.10.2 to 192.168.178.61:65194
rtpengine-1  | 2025-08-27T13:57:03.402762323Z [1756303023.402577] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:2341342233:1 from 10.10.10.2 to 172.16.100.101:58428
rtpengine-1  | 2025-08-27T13:57:03.407034880Z [1756303023.406984] DEBUG: [7olj69pdpq5jln10ere0]: [crypto] Resetting DTLS connection context
rtpengine-1  | 2025-08-27T13:57:03.407067704Z [1756303023.407027] DEBUG: [7olj69pdpq5jln10ere0]: [crypto] Resetting DTLS connection context
rtpengine-1  | 2025-08-27T13:57:03.435064671Z [1756303023.435022] DEBUG: [7olj69pdpq5jln10ere0]: [crypto] Creating passive DTLS connection context
rtpengine-1  | 2025-08-27T13:57:03.435446781Z [1756303023.435396] DEBUG: [7olj69pdpq5jln10ere0]: [crypto] Creating passive DTLS connection context
rtpengine-1  | 2025-08-27T13:57:03.435700835Z [1756303023.435659] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Learning new ICE candidate 3797796660:1
rtpengine-1  | 2025-08-27T13:57:03.435702826Z [1756303023.435667] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Created candidate pair Qp8em1ZUuP5n0iaG:3797796660:1 between 10.10.10.2 and 192.168.178.61:65194, type host
rtpengine-1  | 2025-08-27T13:57:03.435719070Z [1756303023.435670] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Learning new ICE candidate 2341342233:1
rtpengine-1  | 2025-08-27T13:57:03.435721252Z [1756303023.435675] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Created candidate pair Qp8em1ZUuP5n0iaG:2341342233:1 between 10.10.10.2 and 172.16.100.101:58428, type host
rtpengine-1  | 2025-08-27T13:57:03.435723366Z [1756303023.435677] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Learning new ICE candidate 883520042:1
rtpengine-1  | 2025-08-27T13:57:03.435725235Z [1756303023.435678] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Learning new ICE candidate 2652773296:1
rtpengine-1  | 2025-08-27T13:57:03.435731299Z [1756303023.435687] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:3797796660:1 from 10.10.10.2 to 192.168.178.61:65194
rtpengine-1  | 2025-08-27T13:57:03.435926579Z [1756303023.435813] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:2341342233:1 from 10.10.10.2 to 172.16.100.101:58428
rtpengine-1  | 2025-08-27T13:57:03.534681450Z [1756303023.534510] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:3797796660:1 from 10.10.10.2 to 192.168.178.61:65194
rtpengine-1  | 2025-08-27T13:57:03.534713187Z [1756303023.534612] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:2341342233:1 from 10.10.10.2 to 172.16.100.101:58428
rtpengine-1  | 2025-08-27T13:57:03.734739759Z [1756303023.734539] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:3797796660:1 from 10.10.10.2 to 192.168.178.61:65194
rtpengine-1  | 2025-08-27T13:57:03.734805659Z [1756303023.734676] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:2341342233:1 from 10.10.10.2 to 172.16.100.101:58428
rtpengine-1  | 2025-08-27T13:57:04.134697360Z [1756303024.134540] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:3797796660:1 from 10.10.10.2 to 192.168.178.61:65194
rtpengine-1  | 2025-08-27T13:57:04.134737706Z [1756303024.134649] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:2341342233:1 from 10.10.10.2 to 172.16.100.101:58428
rtpengine-1  | 2025-08-27T13:57:04.934703528Z [1756303024.934533] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:3797796660:1 from 10.10.10.2 to 192.168.178.61:65194
rtpengine-1  | 2025-08-27T13:57:04.934790930Z [1756303024.934664] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:2341342233:1 from 10.10.10.2 to 172.16.100.101:58428
rtpengine-1  | 2025-08-27T13:57:06.534708090Z [1756303026.534517] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:3797796660:1 from 10.10.10.2 to 192.168.178.61:65194
rtpengine-1  | 2025-08-27T13:57:06.534742836Z [1756303026.534643] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:2341342233:1 from 10.10.10.2 to 172.16.100.101:58428
rtpengine-1  | 2025-08-27T13:57:06.542579765Z [1756303026.542405] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [ice] Created candidate pair Qp8em1ZUuP5n0iaG:32fa052838eba42b0:1 between 10.10.10.2 and 10.10.100.5:58428, type prflx
rtpengine-1  | 2025-08-27T13:57:06.542611089Z [1756303026.542429] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [ice] Triggering check for Qp8em1ZUuP5n0iaG:32fa052838eba42b0:1
rtpengine-1  | 2025-08-27T13:57:06.542613608Z [1756303026.542441] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [ice] ICE pair Qp8em1ZUuP5n0iaG:32fa052838eba42b0:1 has been nominated by peer
rtpengine-1  | 2025-08-27T13:57:06.542616017Z [1756303026.542444] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [ice] ICE not completed yet and no usable candidates
rtpengine-1  | 2025-08-27T13:57:06.554707501Z [1756303026.554527] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1]: [ice] Sending ICE/STUN request for candidate pair Qp8em1ZUuP5n0iaG:32fa052838eba42b0:1 from 10.10.10.2 to 10.10.100.5:58428
rtpengine-1  | 2025-08-27T13:57:06.561795147Z [1756303026.561672] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] Processing incoming DTLS packet
rtpengine-1  | 2025-08-27T13:57:06.562220274Z [1756303026.562134] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] Sending DTLS packet
rtpengine-1  | 2025-08-27T13:57:06.584286898Z [1756303026.584145] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [ice] Received ICE/STUN response code 0 for candidate pair Qp8em1ZUuP5n0iaG:32fa052838eba42b0:1 from 10.10.100.5:58428 to 10.10.10.2
rtpengine-1  | 2025-08-27T13:57:06.584316675Z [1756303026.584164] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [ice] Setting ICE candidate pair Qp8em1ZUuP5n0iaG:32fa052838eba42b0:1 as succeeded
rtpengine-1  | 2025-08-27T13:57:06.584319445Z [1756303026.584173] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [ice] Best succeeded ICE pair with all components is Qp8em1ZUuP5n0iaG:32fa052838eba42b0:1
rtpengine-1  | 2025-08-27T13:57:06.584321434Z [1756303026.584178] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [ice] ICE completed, using pair Qp8em1ZUuP5n0iaG:32fa052838eba42b0:1
rtpengine-1  | 2025-08-27T13:57:06.584323370Z [1756303026.584183] INFO: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [ice] ICE negotiated: new peer for component 1 is 10.10.100.5:58428
rtpengine-1  | 2025-08-27T13:57:06.584328634Z [1756303026.584186] INFO: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [ice] ICE negotiated: local interface 10.10.10.2
rtpengine-1  | 2025-08-27T13:57:06.676798945Z [1756303026.676637] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] Processing incoming DTLS packet
rtpengine-1  | 2025-08-27T13:57:06.747861409Z [1756303026.747598] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] Processing incoming DTLS packet
rtpengine-1  | 2025-08-27T13:57:06.986371284Z [1756303026.986197] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] Processing incoming DTLS packet
rtpengine-1  | 2025-08-27T13:57:07.469658848Z [1756303027.469451] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] Processing incoming DTLS packet
rtpengine-1  | 2025-08-27T13:57:08.356225726Z [1756303028.356059] DEBUG: [7olj69pdpq5jln10ere0]: [srtp] Sending DTLS packet
rtpengine-1  | 2025-08-27T13:57:08.356261241Z [1756303028.356175] DEBUG: [7olj69pdpq5jln10ere0]: [srtp] Sending DTLS packet
rtpengine-1  | 2025-08-27T13:57:08.356264252Z [1756303028.356201] DEBUG: [7olj69pdpq5jln10ere0]: [srtp] Sending DTLS packet
rtpengine-1  | 2025-08-27T13:57:08.356326850Z [1756303028.356232] DEBUG: [7olj69pdpq5jln10ere0]: [srtp] Sending DTLS packet
rtpengine-1  | 2025-08-27T13:57:08.356343006Z [1756303028.356258] DEBUG: [7olj69pdpq5jln10ere0]: [srtp] Sending DTLS packet
rtpengine-1  | 2025-08-27T13:57:08.379433031Z [1756303028.379236] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] Processing incoming DTLS packet
rtpengine-1  | 2025-08-27T13:57:08.380137683Z [1756303028.380027] INFO: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [crypto] DTLS: Peer certificate accepted
rtpengine-1  | 2025-08-27T13:57:08.380492495Z [1756303028.380403] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] Sending DTLS packet
rtpengine-1  | 2025-08-27T13:57:08.380498301Z [1756303028.380460] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [crypto] DTLS handshake successful
rtpengine-1  | 2025-08-27T13:57:08.380575677Z [1756303028.380486] INFO: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [crypto] DTLS-SRTP successfully negotiated using AEAD_AES_256_GCM
rtpengine-1  | 2025-08-27T13:57:08.380590784Z [1756303028.380495] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] SRTP keys, incoming:
rtpengine-1  | 2025-08-27T13:57:08.380593315Z [1756303028.380499] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] --- AEAD_AES_256_GCM key 1MbX+E0E79KS1qGeFDpMTFj2jujGjH5HYIAxuQhBz4k= salt VhnJVE3fTjmOfT6M
rtpengine-1  | 2025-08-27T13:57:08.380595665Z [1756303028.380501] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] SRTP keys, outgoing:
rtpengine-1  | 2025-08-27T13:57:08.380598242Z [1756303028.380504] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] --- AEAD_AES_256_GCM key E3wXtlEttFoLToh4beuYQXUt5WtRST5b0XDPs68PsBM= salt YqU7rD1+fzcQ8ai1
rtpengine-1  | 2025-08-27T13:57:08.380600309Z [1756303028.380517] INFO: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [crypto] DTLS-SRTP successfully negotiated using AEAD_AES_256_GCM
rtpengine-1  | 2025-08-27T13:57:08.380614057Z [1756303028.380519] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] SRTP keys, incoming:
rtpengine-1  | 2025-08-27T13:57:08.380616123Z [1756303028.380521] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] --- AEAD_AES_256_GCM key 1MbX+E0E79KS1qGeFDpMTFj2jujGjH5HYIAxuQhBz4k= salt VhnJVE3fTjmOfT6M
rtpengine-1  | 2025-08-27T13:57:08.380618140Z [1756303028.380522] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] SRTP keys, outgoing:
rtpengine-1  | 2025-08-27T13:57:08.380620116Z [1756303028.380524] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] --- AEAD_AES_256_GCM key E3wXtlEttFoLToh4beuYQXUt5WtRST5b0XDPs68PsBM= salt YqU7rD1+fzcQ8ai1
rtpengine-1  | 2025-08-27T13:57:08.417609315Z [1756303028.417503] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] Generated session key: master key 137c17b6..., master salt 62a53bac..., label 00, length 32, result 43f91797...
rtpengine-1  | 2025-08-27T13:57:08.417612314Z [1756303028.417510] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] Generated session key: master key 137c17b6..., master salt 62a53bac..., label 02, length 12, result 8c9a80f8...
rtpengine-1  | 2025-08-27T13:57:08.418078314Z [1756303028.417994] DEBUG: [7olj69pdpq5jln10ere0/5dbd948a-728a-4629-b51b-9c0f415844b0/1 port 64616]: [srtp] Generated session key: master key d4c6d7f8..., master salt 5619c954..., label 00, length 32, result 18fb4584...
rtpengine-1  | 2025-08-27T13:57:08.418081445Z [1756303028.417998] DEBUG: [7olj69pdpq5jln10ere0/5dbd948a-728a-4629-b51b-9c0f415844b0/1 port 64616]: [srtp] Generated session key: master key d4c6d7f8..., master salt 5619c954..., label 02, length 12, result 261ae334...
rtpengine-1  | 2025-08-27T13:57:09.553442677Z [1756303029.553237] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [srtp] Processing incoming DTLS packet
rtpengine-1  | 2025-08-27T13:57:09.553449803Z [1756303029.553258] INFO: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [crypto] DTLS peer has closed the connection
rtpengine-1  | 2025-08-27T13:57:09.553452819Z [1756303029.553261] DEBUG: [7olj69pdpq5jln10ere0/7airhg9mke/1 port 60902]: [crypto] Resetting DTLS connection context
rtpengine-1  | 2025-08-27T13:57:09.554279138Z [1756303029.554223] DEBUG: [7olj69pdpq5jln10ere0]: [crypto] Resetting DTLS connection context

Anything else?

The problem does not always occur. In 80% of cases, the server hello is sent to the correct port of the client address.

To me, it looks like this:
rtpengine sends the first server hello to the same port to which it also sends STUN packets.

I am sorry if we have misread or overlooked anything.

[rfuchs]

Not sure this counts as a bug because this is intended behaviour. When ICE is in use, ICE determines the peer address and port, and so DTLS responses would be sent to a different destination if that's what ICE has converged on. In your example, ICE determines a working candidate pair only shortly after the DTLS packet has been received.

[floo94]

Hey Richard, thanks for the quick reply - that's what I was afraid of... so you have to accept this delay when using Webrtc and DTLS?
Sorry if this is not a bug :)

[rfuchs]

Hey Richard, thanks for the quick reply - that's what I was afraid of... so you have to accept this delay when using Webrtc and DTLS?

Well I don't know. It's an implementation detail and there could be room for improvement of course. Ideally the DTLS handshake would begin only after ICE has proceeded further, but I assume you don't have control over that.

AFAICT this was different before 5331506 so perhaps this needs to be amended.

[floo94]

Hi Richard, That's right, unfortunately we have no control over that in this case.
We would be very happy if something could be optimized here.

Thank you in any case for your reply and all your work so far!

[rfuchs]

Trunk contains patches that should (hopefully) address this. Let me know if you're able to test.

[floo94]

Hi Richard,

Thank you very much!
The initial tests look good.