HTTP is too heavy for constrained IoT devices: 200-800 byte headers, TCP handshake overhead, and persistent connection state require resources that battery-powered sensors with 2-32KB RAM simply do not have. CoAP solves this by providing familiar REST semantics (GET/PUT/POST/DELETE) in a compact 4-byte binary header over UDP, with optional reliability and no connection state to maintain.
39.1 Learning Objectives
By the end of this chapter, you will be able to:
Justify CoAP’s Existence: Analyze the limitations of HTTP for constrained IoT devices and explain why those limitations necessitate a dedicated protocol
Explain CoAP’s Design Philosophy: Describe how CoAP delivers lightweight RESTful services over UDP and distinguish its message model from HTTP’s connection-oriented approach
Compare CoAP, HTTP, and MQTT: Evaluate the trade-offs between web protocols for IoT and select the appropriate protocol for a given deployment scenario
Calculate Protocol Overhead: Apply byte-level analysis to quantify header overhead and assess the energy impact of protocol choice on battery-powered devices
Distinguish CON from NON Messages: Demonstrate when to use Confirmable versus Non-confirmable messages by assessing reliability requirements against energy budgets
The Challenge: HTTP is Too Heavy for Constrained Devices
The Problem: HTTP was designed for web browsers and servers with abundant resources, not battery-powered sensors with kilobytes of RAM:
HTTP headers: 200-800 bytes per request (vs. a 10-byte sensor payload)
Persistent connections: Each TCP connection requires ~1KB RAM for state management
Text parsing: CPU cycles wasted on ASCII header parsing
Why This is Hard for IoT:
Constrained devices have 2-32KB RAM (not megabytes)
Batteries must last months or years (not hours)
Lossy networks drop packets (TCP retransmissions waste precious energy)
Yet web semantics (REST, URIs, content negotiation) remain valuable for interoperability
What We Need:
HTTP-like semantics: GET, PUT, POST, DELETE for familiar REST patterns
UDP-based transport: No connection state to maintain
Binary encoding: Efficient parsing on 8-bit microcontrollers
Built-in reliability: Optional confirmations without TCP’s overhead
The Solution: CoAP provides “web services for constrained environments” - all the RESTful goodness of HTTP compressed into a compact binary format running over UDP. This chapter shows you how.
39.2 Prerequisites
Before diving into this chapter, you should be familiar with:
MQTT Protocol: Understanding the alternative publish-subscribe messaging approach helps appreciate CoAP’s request-response model and when to choose each protocol
Networking Basics: Foundation for understanding RESTful principles, HTTP methods (GET/POST/PUT/DELETE), URIs, and how CoAP adapts these concepts for constrained devices
UDP/IP Networking: CoAP operates over UDP rather than TCP, requiring knowledge of connectionless communication, packet loss, and reliability trade-offs
Cross-Hub Connections: Enhance Your Learning
This chapter connects to multiple learning resources:
Video Resources - Visit the Videos Hub for: - Visual explanations of CoAP message flows and reliability mechanisms - Protocol comparison demonstrations (CoAP vs HTTP vs MQTT) - Real-world deployment case studies with network traffic analysis
Practice Quizzes - Test your understanding at Quizzes Hub: - CoAP message format and header field encoding - Message type selection (CON vs NON) for different scenarios - Response code interpretation and error handling - Block-wise transfer and Observe extension mechanics
Simulations - Explore interactive tools at Simulations Hub: - CoAP Message Builder: Construct and decode CoAP packets byte-by-byte - Reliability Simulator: Compare CON vs NON under different packet loss rates - Protocol Comparator: Side-by-side overhead analysis (CoAP vs HTTP vs MQTT) - Observe Pattern Demo: Visualize server-push notifications in action
Knowledge Gaps - Common misconceptions addressed at Knowledge Gaps Hub: - “CoAP is just compressed HTTP” - See section on UDP vs TCP fundamental differences - “NON messages are unreliable and shouldn’t be used” - Learn when fire-and-forget is optimal - “CoAP can’t handle large files” - Explore block-wise transfer mechanisms
Key Takeaway
CoAP is “HTTP for constrained devices” - it provides familiar RESTful semantics (GET, PUT, POST, DELETE on URIs) but compresses everything into a compact binary format running over UDP. Where HTTP requires hundreds of bytes of headers and a TCP connection, CoAP uses just 4 bytes of fixed header and no connection state. The protocol offers two message types: Confirmable (CON) for reliable delivery with acknowledgments, and Non-confirmable (NON) for fire-and-forget efficiency. If you remember nothing else: CoAP lets your 8-bit microcontroller with 2KB RAM expose web-style APIs, enabling direct integration with cloud services and standard REST tooling without HTTP’s overhead.
39.3 Getting Started (For Beginners)
New to CoAP? Start Here!
Time: ~12 min | Difficulty: Intermediate | Unit: P09.C29.U01
Key Concepts
CoAP: Constrained Application Protocol — REST-style request/response protocol using UDP instead of TCP
Confirmable Message (CON): Requires ACK from recipient — provides reliable delivery over UDP at the cost of one roundtrip
Observe Option: CoAP extension enabling publish/subscribe: client registers to receive notifications on resource changes
Block-wise Transfer: Fragmentation mechanism for transferring payloads larger than a single CoAP datagram
Token: Client-generated value matching responses to requests — enables concurrent request/response pairing
DTLS: Datagram TLS — CoAP’s security layer providing encryption and authentication over UDP
If you’re unfamiliar with RESTful protocols or wondering why IoT devices need something different from regular HTTP, this section explains the basics.
Sensor Squad: Why HTTP is Too Heavy
“Why can’t I just use regular HTTP like websites do?” asked Sammy the Sensor.
Bella the Battery groaned. “Do you know how much energy HTTP costs? First you need a TCP handshake – three messages just to say hello. Then HTTP headers can be hundreds of bytes long, even if your temperature reading is just ‘23.5’. It’s like sending a one-word postcard in a giant shipping container!”
Max the Microcontroller held up a tiny CoAP packet. “Look at this – just 4 bytes of header! CoAP uses UDP instead of TCP, so no handshake. And it still gives you the same verbs – GET to read, PUT to update, POST to create, DELETE to remove. It’s like HTTP went on a diet and lost 90% of its weight.”
“The best part,” Lila the LED added, “is that CoAP speaks the same language as the web. A CoAP-to-HTTP proxy can translate between the two, so Sammy’s tiny sensor can still talk to big web servers. It’s the best of both worlds – web compatibility without the web’s overhead!”
39.3.1 What Problem Does CoAP Solve?
Scenario: You want a temperature sensor to expose its readings via a web API, like a regular website.
Alternative View: Protocol Stack Comparison
This diagram compares the protocol stacks: HTTP uses TCP with TLS, while CoAP uses UDP with DTLS and can run over 6LoWPAN for constrained networks.
39.3.2 CoAP: “HTTP for Tiny Devices”
Analogy: Full Restaurant vs. Food Truck
Full Restaurant (HTTP)
Food Truck (CoAP)
Waiters, menus, multiple courses
Simple menu, quick service
Reservations, table management
First come, first served
Fine dining experience
Get food, eat, go
High overhead, great experience
Low overhead, efficient
CoAP is like HTTP, but:
Smaller - 4-byte header vs. 100s of bytes for HTTP
Faster - UDP (no TCP handshake)
Simpler - Less code, less memory
RESTful - Same GET/POST/PUT/DELETE pattern
Putting Numbers to It
Protocol overhead comparison for a simple GET request with 10-byte payload:
For a battery-powered sensor reporting hourly, HTTP’s 400ms vs CoAP’s 100ms adds \(300ms \times 24 \times 365 = 2,628s = 0.73\) hours/year of radio-on time. At 500mA TX current and 3.7V battery, this is \((0.73 \times 500mA) / 1000 = 0.365\) Ah — equivalent to 3% of a typical 12 Ah battery budget.
CoAP’s efficiency extends battery life from months to years.
1. Using Confirmable Messages for Every CoAP Request
CON messages require an ACK roundtrip — on lossy networks with 20% packet loss, a 4-attempt retry with exponential backoff can delay responses by 45 seconds. Use NON for periodic telemetry where data freshness matters more than guaranteed delivery; reserve CON for actuation commands.
2. Ignoring CoAP Proxy Caching Semantics
CoAP proxies cache GET responses based on Max-Age option — a sensor returning temperature with Max-Age=60 will serve cached values for 60 seconds even if the physical reading changes. Set Max-Age to match your data freshness requirement, not the default 60 seconds.
3. Forgetting DTLS Session Management
DTLS handshake (6-8 roundtrips) dominates latency for short-lived CoAP connections — repeatedly creating new DTLS sessions for each request adds 500-2000ms overhead. Use DTLS session resumption (RFC 5077) to reduce reconnection to 1 roundtrip after the initial handshake.
39.4 What is CoAP?
Definition
CoAP (Constrained Application Protocol) is a specialized web transfer protocol designed for resource-constrained nodes and networks. It provides a lightweight RESTful interface similar to HTTP, but optimized for IoT devices with limited processing power, memory, and energy.
Designed by: IETF Constrained RESTful Environment (CoRE) Working Group
Key Characteristics:
Transport: UDP (not TCP like HTTP)
Architecture: RESTful (like HTTP)
Security: DTLS (Datagram TLS)
Overhead: Minimal (4-byte header vs HTTP’s larger headers)
Network: IPv4 and IPv6 (esp. for IEEE 802.15.4)
Use Cases: Smart energy, building automation, sensor networks
39.5 Understanding CoAP vs. MQTT vs. HTTP
These three protocols serve different purposes:
When to use which:
Use Case
Best Protocol
Why
Sensor reports temperature
MQTT
One-to-many pub/sub
App requests sensor reading
CoAP
Direct request-response
Firmware download
HTTP
Large file transfer
Smart light on/off
CoAP
Direct command
Dashboard updates
MQTT
Real-time streaming
39.6 Why CoAP Instead of HTTP?
39.6.1 The Problem with HTTP for IoT
HTTP is excellent for the web, but problematic for constrained devices:
Issue
HTTP
CoAP
Protocol
TCP (connection-oriented)
UDP (lightweight)
Header Size
100s of bytes
4 bytes minimum
Power Consumption
High (TCP handshake)
Very low
Overhead
Significant
Minimal
Complexity
Complex parsing
Simple
Best For
Web browsers
Sensors, actuators
Common Misconception: “CoAP is Just Compressed HTTP”
The Myth: Many developers assume CoAP is simply HTTP with smaller headers, and that you can use the same architecture patterns.
The Reality: CoAP fundamentally differs from HTTP due to UDP vs TCP transport, requiring different design patterns.
Real-World Impact - Smart Building Deployment:
A European smart building company migrated 2,500 sensors from HTTP to CoAP in 2023. Their experience quantifies the differences:
Network Overhead Reduction:
HTTP baseline: Each sensor report = 347 bytes average (TCP handshake: 3 packets x 60 bytes + HTTP GET/response: 227 bytes)
CoAP deployment: Each sensor report = 42 bytes average (UDP: 0 handshake + CoAP GET/response: 42 bytes)
8.3x reduction in network traffic (347 to 42 bytes per reading)
Annual savings: 2,500 sensors x 8,760 readings/year = 6.7 TB to 0.8 TB (85% bandwidth saved)
Battery Life Extension:
HTTP: 18 months average battery life (CR123A lithium, 1500 mAh)
CoAP with NON: 54 months average battery life (same battery)
3x battery life due to eliminated TCP handshake overhead (3 extra packets per reading = 26,280 packets/year x 20 mA x 25 ms = 131 mAh wasted)
But Reliability Challenges Emerged:
Wi-Fi packet loss averaged 12% in production environment
CON retransmissions consumed 15% more power than expected
Solution: Hybrid approach - NON for frequent updates (every 60s), CON for alerts (threshold exceeded)
Result: 2.8x battery life improvement with 99.7% reliability
Key Lesson: CoAP’s stateless UDP model requires application-level reliability design (CON/NON selection), unlike HTTP’s automatic TCP retransmission. You gain efficiency but must handle reliability explicitly.
Source: IoT Analytics Report, Smart Building Protocols 2023 - Real deployment data from 87 European commercial buildings
UDP Means No Reliability Guarantees
CoAP uses UDP, which has critical implications for IoT deployments:
UDP characteristics:
No connection - packets can arrive out-of-order or be lost
No automatic retransmission - application must handle with CON messages
No congestion control - can overwhelm networks if not careful
Firewall/NAT challenges - many networks block UDP traffic
When this causes problems:
Lossy Wi-Fi/cellular networks: 10-30% packet loss means frequent retransmissions
Firewall traversal: Corporate networks often block UDP, preventing CoAP communication
CoAP is inspired by REST but designed for constrained networks. Don’t assume HTTP patterns work.
39.7 Worked Example: Protocol Overhead Comparison
This worked example demonstrates the dramatic difference in network overhead between CoAP, HTTP, and MQTT for a real IoT deployment scenario. Understanding these calculations helps you make informed protocol choices for constrained devices.
Worked Example: IoT Sensor Protocol Overhead Analysis
Context: A smart agriculture deployment with soil moisture sensors sending temperature and humidity readings to a gateway.
Given:
Sensor readings: 1,000 readings per day (approximately 1 reading every 86 seconds)
Payload size: 24 bytes per reading ({"temp":22.5,"hum":65.2})
Network: 6LoWPAN mesh network with limited bandwidth
Protocol Specifications:
Protocol
Transport
Header Overhead
Connection Setup
CoAP
UDP
4 bytes (fixed header)
None (stateless)
HTTP/1.1
TCP
~200-400 bytes
3-way handshake + TLS
MQTT
TCP
2 bytes (fixed) + variable
TCP handshake + CONNECT/CONNACK
39.7.1 Step 1: CoAP Overhead Calculation
CoAP per-message overhead:
Fixed header: 4 bytes
Token: 2 bytes (typical for matching requests)
Uri-Path option: ~15 bytes (/sensor/data with option delta encoding)
Payload marker: 1 byte (0xFF)
Total CoAP overhead: 22 bytes per message
UDP/IP overhead (transport layer):
UDP header: 8 bytes
IPv6 header: 40 bytes (or IPv4: 20 bytes)
Total transport: 48 bytes (IPv6) or 28 bytes (IPv4)
Conclusion: For resource-constrained IoT devices sending small, frequent sensor readings, CoAP provides the best balance of efficiency and simplicity.
39.8 Design Rationale: Why CoAP Chose UDP Over TCP
Understanding the design rationale behind CoAP’s transport choice illuminates the fundamental trade-offs in IoT protocol design.
The IETF CoRE Working Group considered three transport options:
Option
Pros
Cons
Verdict
TCP
Reliable delivery, congestion control
3-way handshake, connection state (1KB+ RAM), head-of-line blocking
Rejected: too heavy
SCTP
Multi-stream, no head-of-line blocking
Even larger state than TCP, poor NAT traversal, limited OS support
Rejected: worse than TCP for IoT
UDP
Stateless, zero connection overhead, fast sleep/wake
No reliability, no ordering, no congestion control
Chosen: application manages reliability
The key insight: For a sensor that wakes every 60 seconds to send a 10-byte reading, TCP’s 3-way handshake (3 packets, ~180 bytes of overhead) costs more than the actual data. UDP lets the sensor transmit immediately.
CoAP’s solution to UDP’s limitations:
Reliability: CON messages with exponential backoff retransmission (application-layer, not transport-layer)
Ordering: Token matching links requests to responses (no need for stream ordering)
Battery impact: meters lasted 11.2 years (CoAP) vs 4.1 years (HTTP) projected
39.9 Self-Check: Understanding the Basics
Before continuing, make sure you can answer:
Why not just use HTTP for IoT? - HTTP is too heavy (large headers, TCP overhead, high power consumption)
What’s the main advantage of CoAP? - Lightweight (4-byte header), uses UDP, perfect for constrained devices
CoAP vs. MQTT: when to use each? - CoAP for request-response (like HTTP); MQTT for publish-subscribe (event streams)
What are the two main message types? - CON (confirmable, reliable) and NON (non-confirmable, fast but unreliable)
Knowledge Check: Match Concepts and Sequence the Protocol
Matching: CoAP Concepts to Definitions
Ordering: A CoAP CON Request–Response Exchange
Place the following steps in the correct sequence for a Confirmable CoAP GET request:
🏷️ Label the Diagram
💻 Code Challenge
39.10 Summary
CoAP provides a lightweight RESTful protocol optimized for constrained IoT devices:
UDP-based: Lower overhead than TCP-based HTTP
RESTful: Familiar GET/POST/PUT/DELETE methods
Compact: 4-byte header vs HTTP’s hundreds of bytes
Flexible reliability: Choose between CON (reliable) and NON (fast)
CoAP lets your 8-bit microcontroller with 2KB RAM expose web-style APIs, enabling direct integration with cloud services without HTTP’s overhead.
39.11 How It Works: Why CoAP Chose UDP Over TCP
Understanding CoAP’s UDP choice reveals the fundamental design philosophy:
The TCP Problem for IoT:
When a sensor wakes from sleep to send a 10-byte reading using HTTP over TCP:
TCP 3-way handshake (required before any data):
Client → Server: SYN (60 bytes)
Server → Client: SYN-ACK (60 bytes)
Client → Server: ACK (60 bytes)
Cost: 180 bytes, 3 round-trips (~150-300ms)
HTTP request (minimum):
GET /temp HTTP/1.1\r\n (18 bytes)
Host: sensor\r\n (14 bytes)
\r\n (2 bytes)
Cost: 34 bytes + TCP header (20 bytes) = 54 bytes
Total overhead: 180 + 54 = 234 bytes to send 10 bytes of data (23:1 overhead ratio)
The CoAP Solution with UDP:
Same sensor using CoAP:
No handshake - UDP is connectionless
CoAP request:
4-byte header
2-byte token
4-byte Uri-Path option
10-byte payload
Total: 20 bytes + UDP header (8 bytes) = 28 bytes
Overhead ratio: 28 bytes total (including payload) vs HTTP’s 234 bytes overhead alone
Energy Impact:
On a LoRaWAN sensor (SF10, 50mA TX current): - HTTP: 234 bytes × 0.8ms/byte = 187ms TX time → 0.187s × 50mA / 3600 = 0.0026 mAh per TX - CoAP: 28 bytes × 0.8ms/byte = 22ms TX time → 0.022s × 50mA / 3600 = 0.00031 mAh per TX
Result: CoAP uses 8.5x less TX energy per transmission. On a 2,500 mAh battery with a 0.01 mA sleep current sending 10 readings/day: - HTTP daily TX energy: 0.0026 mAh × 10 = 0.026 mAh/day from TX alone - CoAP daily TX energy: 0.00031 mAh × 10 = 0.0031 mAh/day from TX alone - With quiescent sleep current dominating, CoAP’s reduced TX time extends effective battery life by approximately 8x when TX overhead is the key variable
The Trade-off:
UDP has no built-in reliability, but CoAP solves this at the application layer with CON messages (optional reliable delivery) - giving you the choice between guaranteed delivery (CON) and maximum efficiency (NON) on a per-message basis.
39.12 Concept Relationships
This introduction connects CoAP to the broader IoT ecosystem: