# How to intercept, observe & mock WebRTC traffic

DevFeed: [How to intercept, observe & mock WebRTC traffic](<https://devfeed.tech/articles/how-to-intercept-observe-mock-webrtc-traffic-19079.md>)

Original publisher: [Read original article](<https://httptoolkit.com/blog/intercepting-webrtc-traffic/>)

Author: HTTP Toolkit; Tim Perry

Published: 2022-10-13T10:00:00Z

Content type: tutorial

Language: en

Sources: [HTTP Toolkit](<https://devfeed.tech/sources/http-toolkit.md>)

Topics: [WebRTC](<https://devfeed.tech/topics/webrtc.md>), [Tooling](<https://devfeed.tech/topics/tooling.md>), [P2P](<https://devfeed.tech/topics/p2p.md>), [Security & Privacy](<https://devfeed.tech/topics/security-privacy.md>)

Tags: [debugging](<https://devfeed.tech/tags/debugging.md>), [developer-tools](<https://devfeed.tech/tags/developer-tools.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [interception](<https://devfeed.tech/tags/interception.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [p2p](<https://devfeed.tech/tags/p2p.md>), [security-privacy](<https://devfeed.tech/tags/security-privacy.md>), [webrtc](<https://devfeed.tech/tags/webrtc.md>)

## AI overview

This tutorial explains why WebRTC traffic is difficult to inspect and mock, covering its peer-to-peer encryption, negotiated networking, and limited debugging APIs. It introduces MockRTC and describes how controlling one peer can enable interception, observation, and transformation of WebRTC traffic.

## Source excerpt

WebRTC allows two users on the web to communicate directly, sending real-time streams of video, audio & data peer-to-peer, from within a browser environment. It's exciting tech that's rapidly maturing, already forming the backbone of a huge range of video chat, screen sharing and live collaboration tools, but also as a key technology for decentralization of web apps - providing a P2P data transport layer used by everything from WebTorrent to IPFS to Yjs. Unfortunately though, it doesn't have the tooling ecosystem that developers used to networking with HTTP often expect. There's few supporting tools or libraries, inspecting raw traffic is hard or impossible, and mocking WebRTC traffic for automated testing is even harder. Even built-in low-level browser tools like chrome://webrtc-internals don't allow seeing messages sent on WebRTC data channels. It's hard to build modern secure web applications on top of protocols that you can't directly see or interact with. This doesn't just affect developers: it also seriously impacts security & privacy researchers and reverse engineers, each trying to investigate the traffic sent & received by the apps we all use. If you want to know what data a webapp you use is sending over WebRTC, right now it's very hard to find out. Intercepting WebRTC traffic to build these tools and libraries is difficult, because unlike protocols like HTTP that were designed to allow active proxying and user-configureable PKI (i.e. CA certificates) early on, WebRTC encrypts all traffic using peer-to-peer negotiated certificates for authentication without PKI, communicates in a wide variety of different negotiated ways at the network level to avoid NAT issues, and offers no convenient APIs to configure this for debugging. All of this provides some great features to the protocol as a user, but some serious challenges when building developer tools. As it turns out though, despite this, there are just enough places where we can hook into that it is possible