IoT: MQTT and constrained devices
Smart sensors are tiny computers with little memory and a small battery, so they need tiny protocols. Follow a temperature reading through an MQTT broker to a phone and a dashboard, see how QoS, retained messages and keep-alive make it dependable, how a gateway brings Zigbee devices in, how CoAP does it without a broker, and how to keep it all secure.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01The sensor publishes to home/kitchen/temp. Which subscription does NOT receive it?
+ matches exactly one level and # matches every level below, so the first three match. home/+/leak needs the last level to be "leak".
02In MQTT, how does the temperature sensor know where to send its reading?
Publishers and subscribers never know about each other. They only know the broker and the topic names, so new apps can be added without touching the sensor.
03Which QoS level answers each PUBLISH with a PUBACK and may deliver a duplicate?
QoS 1 is at least once: the receiver answers with a PUBACK; if no PUBACK arrives, the sender sends the message again when it reconnects, so a lost PUBACK can cause a duplicate. QoS 2 uses four packets to deliver exactly once; QoS 0 sends once with no reply.
04A sensor connects with a keep-alive of 60 s, then its battery dies. What happens?
The broker allows 1.5 × the keep-alive (90 s). After that it drops the connection and sends the will message, such as "offline", to subscribers.
05Why does a Zigbee leak sensor need a gateway to reach an MQTT broker?
MQTT runs over TCP/IP. A Zigbee device only speaks its own radio network, so a gateway receives the radio frame and publishes it to the broker. Thread devices have IPv6 and only need a border router.
Glossary
- IoT device
- An Internet of Things device: a constrained computer with very little memory, power and processing, often on a battery. RFC 7228 groups them into classes; a Class 1 device has about 10 KiB of RAM.
- MQTT and broker
- MQTT (OASIS MQTT 5.0) is a lightweight publish/subscribe protocol over TCP, on port 1883, or 8883 with TLS. Every client talks only to the broker, the server in the middle that forwards a copy of each message to every matching subscription.
- Gateway
- A box that speaks two kinds of network and translates between them, here a Zigbee radio on one side and MQTT over IP on the other.
- Topic
- The name a message is published under, with levels split by slashes (home/kitchen/temp). Subscriptions can use + for one level and # for every level below.
- QoS
- Quality of service: 0 = at most once, 1 = at least once (PUBACK), 2 = exactly once (four packets).
- Retained message
- The last message on a topic that the broker keeps and sends straight away to anyone who subscribes later.
- Keep-alive and last will
- The client promises to send something (a ping if needed) within the keep-alive time; if it goes silent for 1.5 times that, the broker publishes its last will message.
- CoAP
- Constrained Application Protocol (RFC 7252): web-style GET/PUT/POST/DELETE requests over UDP port 5683, with a 4-byte header and no broker.
Notes and sources
- MQTT Version 5.0 (OASIS Standard, 2019). The 26-byte PUBLISH assumes no properties; QoS 1 adds a 2-byte packet identifier (28 bytes). PUBACK is 4 bytes when it reports success. An MQTT 3.1.1 PUBLISH is one byte smaller (it has no property length); PUBACK is 4 bytes in both versions.
- IANA ports: 1883/tcp mqtt, 8883/tcp secure-mqtt, 5683/udp coap, 5684/udp coaps. Addresses use the private home range 192.168.1.0/24 (RFC 1918).
- If the broker receives no packet for 1.5 × the keep-alive (90 s here), it must close the connection (MQTT 5.0 §3.1.2.10). MQTT 5.0 also lets a client delay its will with a Will Delay Interval.
- Device classes from RFC 7228: Class 0 well under 10 KiB of RAM, Class 1 about 10 KiB, Class 2 about 50 KiB. The sizes are rough guides, not hard limits.
- CoAP (RFC 7252): 4-byte fixed header, up to 8-byte token, compact options. The 11-byte GET uses a 2-byte token and one Uri-Path option.
- ETSI EN 303 645 (Cyber Security for Consumer IoT) provision 5.1 forbids universal default passwords. TLS 1.3 is RFC 8446.
Quiz Unlocks after the last step.