one way audio issue on some of the calls not all

[Rahman Afzal]

Hi,

  One-way audio in WebRTC → OpenSIPS → Asterisk → OpenSIPS → SIP Trunk (SRTP ↔ RTP bridging issue)

I am facing one-way audio on one specific call in the following call flow:

WebRTC client → OpenSIPS → Asterisk → OpenSIPS → SIP Trunk

Environment

• OpenSIPS (acting as SBC)

• rtpengine (kernel mode enabled)

• Asterisk (handling call logic)

• WebRTC client using DTLS-SRTP

• SIP trunk using plain RTP (PCMU/8000)

  From rtpengine logs:

SRTP output wanted, but no crypto suite was negotiated
No support for kernel packet forwarding available (encryption cipher or HMAC not supported by kernel module)
Failed to push relay stream to kernel: Invalid argument

   rtpengine flags currently used:
rtpengine offer:

$var(rtpengine_flags) = "RTP/AVP replace-session-connection rtcp-mux-demux replace-origin ICE=remove DTLS=passive in-iface=external out-iface=internal";

Request originated from Core for WSS endpoint:
$var(rtpengine_flags) = "trust-address replace-origin replace-session-connection rtcp-mux-require DTLS=passive SDES-off UDP/TLS/RTP/SAVPF ICE=force in-iface=internal out-iface=external";

and here is out rtp engine WSS_REPLY .

onreply_route[WSS_REPLY]
{
        route(NAT_HANDLE);
        xlog("L_INFO","[$fU@$si]{$rm}$ci[WSS_REPLY] Received status code $rs: '$rr' for method '$rm' (From: '$fu' → To: '$tu')\n");
        if(has_body("application/sdp"))
        {
                if(isflagset("ACCESS_WSS"))
                {
                        $var(rtpengine_flags) = "trust-address replace-origin replace-session-connection rtcp-mux-require DTLS=passive SDES-off UDP/TLS/RTP/SAVPF ICE=force in-iface=internal out-iface=external";
                        #$var(rtpengine_flags) = "trust-address replace-origin replace-session-connection ICE=force in-iface=internal out-iface=external";
                }
                else
                {
                        $var(rtpengine_flags) = "RTP/AVP replace-session-connection rtcp-mux-demux replace-origin ICE=remove in-iface=external out-iface=internal";
                }
                rtpengine_answer("$var(rtpengine_flags)");
        }
}

kindly help me to understand the root cause of this issue, opensips , rtp and pcap trace attached for your reference.

[Richard Fuchs]

On 16/02/2026 08.01, Rahman Afzal wrote:
>   From rtpengine logs:
> SRTP output wanted, but no crypto suite was negotiated
> No support for kernel packet forwarding available (encryption cipher
> or HMAC not supported by kernel module)
> Failed to push relay stream to kernel: Invalid argument

...

> Request originated from Core for WSS endpoint:
> $var(rtpengine_flags) = "trust-address replace-origin
> replace-session-connection rtcp-mux-require DTLS=passive SDES-off
> UDP/TLS/RTP/SAVPF ICE=force in-iface=internal out-iface=external";

...

> kindly help me to understand the root cause of this issue, opensips ,
> rtp and pcap trace attached for your reference.

With one side using DTLS-SRTP, "no crypto suite negotiated" generally
means that the DTLS handshake didn't happen or didn't complete.

The log you provided isn't helpful as the log level was turned down.
Best to enable full debug logging for troubleshooting. You may also want
to inspect the network with Wireshark.

Cheers