Packet Analysis Layers

Trace IoT packets through application, transport, network, and link layers

Animation Packet layers Display filters

Packet Analysis Layers

Follow an IoT message as each protocol layer wraps it with a header. Then apply display filters to find the packets that matter in a mixed capture.

MQTT publish selected packet path

66 B frame bytes in teaching model

2 matches current display filter

Packet Layer Workbench

What

A packet-layer explorer for application, transport, network, and link-layer headers.

Why

Packet captures are easier to debug when you know which layer owns each field.

Try First

Step through MQTT publish, then apply the MQTT-from-sensor filter.

Notice

A tiny sensor value can become a much larger frame after layer headers are added.

Packet Path

Scenario layer stack MQTT publish CoAP POST BLE GATT notify

Display Filter

Filter expression valid

MQTT Publish Encapsulation

Each lower layer adds delivery information around the application message.

Application layer selected

Learning Support

Start at the top

The application layer tells you what the device is trying to do. For IoT, that often means MQTT, CoAP, HTTP, or BLE GATT.

Move downward

Transport adds ports and reliability choices. Network adds addresses and routing. Link moves the packet across the local medium.

Filters are layer questions

A protocol filter asks about the application layer. A port filter asks about transport. An IP filter asks about the network layer.

Overhead is normal

Headers are not wasted; they provide delivery, addressing, and reliability. The trade-off is that small IoT payloads can have low byte efficiency.

Quick Reference

Application layer

mqtt, coap, http, ble

Owns the meaning of the message: topic, URI, method, characteristic, command, or sensor value.

Transport layer

tcp.port==1883, udp.port==5683

TCP adds reliable byte streams. UDP adds lightweight datagrams.

Network layer

ip.src==192.168.1.100

IPv4 and IPv6 fields show source and destination addresses used for routing.

Link layer

eth.addr, wlan.addr, btle

Local delivery uses MAC addresses, BLE link-layer fields, or radio-specific frame fields.

AND filter

mqtt && ip.src==192.168.1.100

Both conditions must be true. Use this to narrow from protocol to one device.

OR filter

mqtt || coap

Either condition can be true. Use this when comparing two protocols.

NOT filter

!mqtt

Exclude one protocol so other traffic becomes easier to inspect.

Byte efficiency

payload / total frame bytes

Small payloads often have low efficiency, especially when reliable or text-heavy protocols are used.

Interactive Packet AnalyzerDecode packet bytes and compare protocol overhead. Packet Capture AnalyzerPractice capture inspection with packet lists. IoT Protocol ScenariosContinue with MQTT, CoAP, BLE, and Zigbee examples.