Decrypted traces uploaded to Memfault

Decryption is a property of the DTLS session, not of the trace backend. Once the device is built with the developer security tag, provisioned, and producing decodable traces locally, the same traces remain decodable when the device is configured to upload modem traces to Memfault on a coredump.

Combine the developer security tag with the Memfault modem trace overlays, as described in Memfault remote debugging.

For the Thingy:91 X, run the following command:

west build -p -b thingy91x/nrf9151/ns --sysbuild -- \
    -DEXTRA_CONF_FILE="overlay-upload-modem-traces-to-memfault.conf" \
    -DEXTRA_DTC_OVERLAY_FILE="overlay-upload-modem-traces-to-memfault.overlay" \
    -DCONFIG_NRF_CLOUD_COAP_SEC_TAG=2147483667 \
    -DCONFIG_NRF_CLOUD_COAP_JWT_SEC_TAG=16842753 \
    && west flash --recover

For the nRF9151 DK, run the following command:

west build -p -b nrf9151dk/nrf9151/ns --sysbuild -- \
    -DEXTRA_CONF_FILE="overlay-upload-modem-traces-to-memfault.conf" \
    -DEXTRA_DTC_OVERLAY_FILE="overlay-upload-modem-traces-to-memfault.overlay" \
    -DCONFIG_NRF_CLOUD_COAP_SEC_TAG=2147483667 \
    -DCONFIG_NRF_CLOUD_COAP_JWT_SEC_TAG=16842753 \
    && west flash --recover

Download the trace from the device timeline in Memfault, convert it with nRF Util or the Cellular Monitor app, and open it in Wireshark. The Decrypted TLS layer is present exactly as it is for a live capture:

nrfutil trace lte --input-file memfault-modem-trace.bin --output-pcapng memfault-trace.pcapng

This lets you inspect the nRF Cloud CoAP exchange leading up to a crash on a device that is not attached to a debugger.