IoT Protocols#
Reference of the messaging, transport, and link-layer protocols used in IoT and IIoT deployments. Useful when mapping smart-home, building-automation, industrial-edge, and remote-sensor networks. Covers transport (MQTT / CoAP / HTTP / etc.), application bindings (Matter, Sparkplug B), and link-layer radios (Zigbee, Z-Wave, Thread, BLE, LoRa).
For OT / SCADA protocols, see ICS / SCADA / OT. For RF spectrum context, see Radio Frequencies.
Application messaging#
Protocol |
Transport |
Default port |
Notes |
|---|---|---|---|
MQTT 3.1.1 / 5.0 |
TCP / TLS / WS |
1883 / 8883 |
Pub/sub broker; QoS 0/1/2; retained messages; will; the dominant IoT protocol. |
MQTT-SN |
UDP |
1884 |
MQTT for sensor networks; gateway to MQTT. |
Sparkplug B |
MQTT |
n/a |
IIoT topic + payload spec on top of MQTT. |
CoAP (RFC 7252) |
UDP / DTLS |
5683 / 5684 |
RESTful low-power; observe; block transfers. |
LwM2M |
CoAP |
5683 |
OMA SpecWorks device management. |
HTTP / HTTPS |
TCP / TLS |
80 / 443 |
Standard web; high overhead but ubiquitous. |
WebSocket |
TCP / TLS |
80 / 443 |
Full-duplex over HTTP. |
AMQP 1.0 / 0.9.1 |
TCP / TLS |
5671 / 5672 |
RabbitMQ + EventHubs + Azure Service Bus; enterprise. |
STOMP |
TCP / WS |
61613 |
Simpler text-based messaging. |
XMPP |
TCP / TLS |
5222 / 5223 |
Older instant-messaging derived; some IoT use. |
DDS |
TCP / UDP |
n/a |
OMG Data Distribution Service; military / robotics (RTI Connext, eProsima Fast DDS, OpenDDS). |
DDS-Security |
DDS |
n/a |
Security plugin for DDS. |
gRPC |
HTTP/2 |
n/a |
Bi-directional streaming; rising for IoT cloud. |
ROS 2 / DDS |
DDS |
n/a |
Robot Operating System messaging. |
OPC UA |
TCP / WS / HTT |
PS 4840 |
See ICS / SCADA / OT. |
JSON-RPC / XML-RPC |
HTTP |
n/a |
Legacy. |
HTTP/3 / QUIC |
UDP |
443 |
Quic-based; emerging. |
Smart-home application#
Standard |
Notes |
|---|---|
Matter (CSA) |
IP-based + Thread / WiFi; certified universal smart home; Apple + Google + Amazon + Samsung; based on CHIP project; over Thread or WiFi for transport. |
HomeKit Accessory Protocol (HAP) |
Apple proprietary; subset / superset of Matter. |
Google Weave / OpenWe ave |
Pre-Matter; rolled into Matter. |
Apple iCloud Family |
Apple-only. |
Amazon Frustration-Fr ee |
ZigBee / Sidewalk pairing. |
Bose / Sonos / Roon |
Audio streaming. |
Yonomi / Olisto |
Cloud-coordination layer. |
Mesh / link layer#
Protocol |
Spectrum |
Range |
Notes |
|---|---|---|---|
Zigbee |
2.4 GHz |
~10-100 m |
IEEE 802.15.4; mesh; low-power; ~16 channels; Zigbee Alliance (CSA); 2.4 GHz only commonly. |
Z-Wave |
868/908/916 MHz |
~30 m |
Sub-GHz; Silicon Labs; mesh; star-of-star. Z-Wave Alliance; 802.15.4-derived. |
Thread |
2.4 GHz |
~10-100 m |
IEEE 802.15.4; IPv6 mesh (6LoWPAN); low-power; Thread Group (Nest / Apple / Google). |
6LoWPAN |
802.15.4 |
n/a |
IPv6 over Low-power Wireless PANs (RFC 4944). |
BLE / BLE Mesh |
2.4 GHz |
~10-50 m |
Bluetooth Low Energy; ad-hoc + mesh. |
Wi-Fi (802.11) |
2.4/5/6 GHz |
~50 m |
Power-hungry but ubiquitous. |
WiSUN |
Sub-GHz / 2.4 |
~1-2 km |
Smart utility networks; metering. |
KNX |
TP/RF/IP |
n/a |
EU building automation. |
EnOcean |
868 MHz |
~30 m |
Energy-harvesting; sensors. |
DECT ULE |
1.9 GHz |
~50-300 m |
DECT for smart home (ULE Alliance). |
Insteon |
902 MHz / power |
n/a |
Sunset 2022, revived 2023 small-scale. |
Wide-area / LPWAN#
Protocol |
Spectrum |
Range |
Notes |
|---|---|---|---|
LoRaWAN |
868/915/433 IS |
M 2-15 km |
LoRa Alliance; chirp spread spectrum; class A/B/C; unlicensed. |
Sigfox |
868/902 ISM |
10-50 km |
Ultra-narrowband; small payloads. |
NB-IoT (Cat NB1/NB2) |
Cellular |
several km |
3GPP cellular; licensed; in-band / guard-band / standalone. |
LTE-M (Cat M1) |
Cellular |
several km |
3GPP cellular; voice + mobility. |
LTE Cat 1bis / 4 |
Cellular |
several km |
Higher bandwidth. |
5G RedCap |
Cellular |
several km |
Reduced-capability 5G NR for IoT. |
NB-Fi |
Sub-GHz |
several km |
Russian alternative. |
Mioty |
868/915 ISM |
5-15 km |
Telegram splitting tech; M-Bus alliance. |
Wireless M-Bus |
868 MHz |
~500 m |
Smart metering (EU EN 13757). |
Weightless-P / -W |
Sub-GHz |
several km |
Weightless SIG; small-scale. |
Amazon Sidewalk |
900 MHz / BLE |
500 m-5 km |
Amazon devices contribute neighbourhood network. |
Helium / IoT |
Sub-GHz LoRa |
~10 km |
Decentralised LoRaWAN. |
Industrial fieldbus#
See ICS / SCADA / OT (“OT protocols”) for Modbus, DNP3, PROFINET, IEC 61850, EtherNet/IP, EtherCAT, etc.
Identity / provisioning#
Standard |
Notes |
|---|---|
DPS / IoT Hub provisioning |
Azure IoT auto-provisioning. |
Microsoft Defender for IoT |
Acquired CyberX; for OT. |
AWS IoT Core / Greengrass |
X.509 cert-based; just-in-time prov. |
Google Cloud IoT Core |
Sunset Aug 2023. |
GSMA SGP.22 (eUICC) |
eSIM remote provisioning. |
GSMA IoT SAFE |
SIM-based device identity. |
LwM2M Bootstrap |
OMA device bootstrap. |
EAP-TLS |
802.1X cert-based. |
DTLS-PSK / DTLS-Cert |
CoAP / TLS variants. |
Common platforms#
Platform |
Vendor |
Notes |
|---|---|---|
AWS IoT Core |
AWS |
Managed MQTT broker; Greengrass for edge; SiteWise for OT. |
Azure IoT Hub |
Microsoft |
O Managed; Edge for compute-at-edge; SiteWise-equivalent IoT perations. |
Google Cloud IoT |
Sunset 2023. |
|
ThingsBoard |
ThingsBoard |
OSS + commercial IoT platform. |
Mainflux |
Mainflux |
OSS Go-based. |
EMQX |
EMQ Tech |
OSS MQTT broker; commercial cluster. |
Mosquitto |
Eclipse |
OSS MQTT broker (single-node). |
HiveMQ |
HiveMQ |
Commercial MQTT broker. |
NATS |
CNCF |
Lightweight pub-sub; JetStream. |
RabbitMQ |
VMware |
AMQP broker; MQTT plugin. |
Apache Pulsar |
Apache |
Pub-sub messaging. |
Kafka |
Apache |
Stream platform; not strictly IoT but used. |
Particle |
Particle |
Cellular IoT cloud. |
Balena |
Balena |
Container-based fleet management. |
Mender |
Mender |
OTA update platform. |
Mbed Cloud / Pelion |
Arm |
Acquired by Izuma. |
KubeEdge |
CNCF |
K8s on edge. |
Security / threat#
Concern |
Notes |
|---|---|
Default credentials |
Routinely-exploited; Mirai-class botnets. |
Unpatched firmware |
Update cadence is the main IoT security failing. |
Hard-coded secrets |
Common in firmware; binwalk / strings find them. |
Insecure update path |
No signed firmware = trivial flash. |
Weak / no transport encryption |
Cleartext MQTT / CoAP on the wire. |
Cloud → device pivot |
Compromised cloud control plane → fleet compromise. |
Mobile app attack |
Mobile companion app -> cloud backend pivots. |
Bluetooth pairing |
Just-Works pairing; downgrade attacks; KNOB. |
Zigbee touchlink |
Old Philips Hue; unauth pairing. |
Z-Wave keyfix |
Older S0 framework had key-leak issues; S2 mandatory. |
LoRaWAN replay |
Older 1.0 versions; 1.1 mitigates. |
Side-channel power analysis |
Used in chip-level key recovery. |
Hardware debug ports |
UART / JTAG / SWD often left enabled. |
Tools#
Tool |
Notes |
|---|---|
MQTT Explorer |
GUI MQTT client / inspector. |
mosquitto_pub/sub |
CLI MQTT client. |
mqttx |
GUI + CLI MQTT. |
coap-cli / aiocoap |
CoAP clients. |
Wireshark + dissector |
s For MQTT, CoAP, Zigbee, BLE, etc. |
nRF Connect / Sniffer |
Nordic BLE / Thread / Zigbee tools. |
KillerBee + Atmel ZB |
Zigbee / 802.15.4 sniffing / injection. |
ApiMote |
802.15.4 dev board. |
WHACKBEE / Z3Sec |
Zigbee testing. |
Z-Wave PC Controller |
Silicon Labs Z-Wave dev tool. |
HackRF + GNU Radio |
Universal SDR for any IoT band (see SDR Hardware). |
binwalk + Ghidra |
Firmware analysis (see Reverse Engineering). |
chip-tool |
Matter dev tool. |
matter.js |
Matter JS implementation. |
nrfutil |
Nordic firmware tools. |