CoAP · Study deck

CoAP Advanced Features

Picture a street sensor that needs a software fix over a weak radio link.

Broker Bex is your guide for this deck.

Broker Bex, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Implement Block-wise Transfer: Apply RFC 7959 to handle large payloads (firmware updates) over CoAP's UDP transport
Configure Resource Discovery: Construct .well-known/core endpoints with CoRE Link Format attributes
Evaluate CoAP Transport Options: Select between UDP, TCP, and WebSockets based on network constraints and device requirements
Analyze DTLS Security Overhead: Calculate handshake RTT costs and justify security mode selection for constrained deployments

Major section

Start With the Almost-Too-Large Update

The update is too large for one message, and the device may sleep before every part arrives.

A safe release needs a clear final result, not a pile of successful sends.
A protocol means shared rules for an exchange.
Constrained Application Protocol (CoAP) means a compact request method for small devices.

Major section

Start With the Almost-Too-Large Update (continued)

User Datagram Protocol (UDP) means sending separate messages without a lasting connection.

Transmission Control Protocol (TCP) means a stream that checks order and delivery.
Transport layer security means protection for a network exchange.
Firmware means software stored on a device.
It must keep the old safe version or accept one complete new version.

Major section

Start With the Almost-Too-Large Update (continued)

An over-the-air update means replacing that software through the network; it is called OTA.

The service must show which outcome occurred.
This runway does not choose block sizes or prove the radio budget.
The deeper features show observation, block transfer, discovery, protection, and the tests that turn them into a release path.

Major section

CoAP's Hidden Superpowers

"I thought CoAP was just simple request-response," said Temperature Terry. "But it can do way more!".

Instead of the dashboard asking you for temperature every 10 seconds -- which wastes energy -- you register once and then automatically send updates whenever the temperature changes.
"And what about when I need to send a big firmware update?" asked the LED. "That's Block Transfer!" said Max. "CoAP breaks the big file into small blocks, like cutting a pizza into slices.
So when I join a network, I don't need to be pre-configured.

Major section

Minimum Viable Understanding: Block-wise Transfer

Core Concept: CoAP messages are limited by UDP MTU (1280-1500 bytes), but firmware updates or images require 100KB+ payloads.

Each block includes block number, more-flag, and size.
A large server response, such as a firmware image, cannot safely be treated as one oversized datagram.

CoAP Block2 evidence contract preserving NUM, M, SZX, token, ETag, and format continuity through retries and reordering to final length and hash verification.

Major section

DTLS Security

Transport and security choices are connected.

TCP can solve firewall or NAT pressure; DTLS keeps UDP deployments encrypted.
Encrypted application data starts after this exchange, which explains the setup cost explored by the calculator next.

DTLS handshake sequence showing the client initiating a secure session, the server issuing a cookie challenge for DoS protection, and both sides completing key exchange before encrypted application data begins.

Major section

Worked Example: OTA Firmware Update for 500 Street Lights

Step 2: Assess parallelism constraints: LoRaWAN gateways can handle approximately 8 simultaneous downlinks on different channels (EU868 has 8 channels).

Scenario:: A city council needs to push a 128 kB firmware update to 500 CoAP-enabled LED street lights over a LoRaWAN network.
Each light has a Semtech SX1276 radio module with a 242-byte maximum application payload per LoRaWAN uplink/downlink.
This far exceeds the 2-hour window.

Major section

Worked Example: OTA Firmware Update for 500 Street Lights (continued)

Step 1: Calculate block count and transfer time per device: Each block requires a CON request (device requests block) and a 2.05 Content response (server sends block).

Recommendation: Option C (incremental rollout).: While slower overall, updating 128 devices on night 1 provides a live validation of the firmware.
If the update causes issues (dimming failures, communication bugs), only 25% of lights are affected.
CoAP's Block-wise resume capability means any interrupted transfers pick up where they left off the next night.

Deck summary

Key takeaways

The update is too large for one message, and the device may sleep before every part arrives.

User Datagram Protocol (UDP) means sending separate messages without a lasting connection.
An over-the-air update means replacing that software through the network; it is called OTA.
"I thought CoAP was just simple request-response," said Temperature Terry. "But it can do way more!".
Core Concept: CoAP messages are limited by UDP MTU (1280-1500 bytes), but firmware updates or images require 100KB+ payloads.

Retrieval practice

Recall check 1 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q1A firmware update uses CoAP block-wise transfer across a lossy network. Which review evidence matters most?

ABlock size, acknowledgement and retry behavior, timeout handling, security overhead.

BOnly that block-wise transfer is an RFC-defined feature

CIgnoring NAT expiry because block-wise transfer is application-layer

DChoosing UDP, TCP, or WebSockets without comparing device and network constraints

Show answer

Answer: A CoAP advanced-feature review ties block transfer, discovery, transport, security, and failure modes to the actual deployment.

Retrieval practice

Recall check 2 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q2You need to send a 10KB firmware update to an IoT device over a lossy LoRaWAN link (15% packet loss). The CoAP MTU is 1024 bytes. What block-wise configuration is BEST?

A1024-byte blocks with NON messages for speed

B1024-byte blocks with CON messages for reliability

C256-byte blocks with CON messages for reliability

D64-byte blocks with NON messages for minimal overhead

Show answer

Answer: C Correct!

Retrieval practice

Recall check 3 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q3A CoAP server advertises a resource as: ;rt="air-quality";if="sensor";ct=50;obs. What does the ct=50 attribute indicate about this resource?

AThe resource has a maximum size of 50 bytes

BThe resource supports JSON payloads (Content-Format 50 = application/json)

CThe resource is located on channel 50 of a multi-channel sensor array

DThe resource requires 50 milliseconds to respond

Show answer

Answer: B Correct!

Retrieval practice

Recall check 4 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q4You're deploying CoAP sensors in a factory. The IT department says UDP port 5683 is blocked by their firewall. Which solution BEST addresses this while keeping CoAP benefits?

AUse MQTT instead - it works over TCP port 1883

BUse CoAP over TCP (RFC 8323) on port 5683 or 443

CAsk IT to open UDP port 5683

DUse HTTP instead - it's always allowed

Show answer

Answer: B Correct!

Retrieval practice

Recall check 5 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q5Place each CoAP feature at its protocol boundary so you can choose observation, block transfer, and transport protection without treating them as interchangeable layers.

AApplication (CoAP Resources)

BObserve Extension (RFC 7641)

CBlock-wise Transfer (RFC 7959)

DUDP/DTLS Transport

Show answer

Answer: A Place each CoAP feature at its protocol boundary so you can choose observation, block transfer, and transport protection without treating them as interchangeable layers.

Retrieval practice

Recall check 6 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q6Complete the CoAP block-wise transfer for sending a large firmware update to a constrained device:

Arequest = Message(code=PUT, uri='coap://sensor.local/firmware')

Brequest = Message(code=POST, uri='coap://sensor.local/firmware')

Crequest = Message(method='PUT', url='coap://sensor.local/firmware')

Drequest = Request(code=PUT, uri='coap://sensor.local/firmware')

Show answer

Answer: A Block1 option is used for request payloads (client-to-server transfers like PUT/POST).

Print reference

Answers

Answer key.

A · CoAP advanced-feature review ties block transfer, discovery, transport, security, and failure modes to the actual deployment.
C · Correct!
B · Correct!
B · Correct!
A · Place each CoAP feature at its protocol boundary so you can choose observation, block transfer, and transport protection without treating them as interchangeable layers.
A · Block1 option is used for request payloads (client-to-server transfers like PUT/POST).