CoAP · Study deck

CoAP Advanced Features

Picture a street sensor that needs a software fix over a weak radio link.

Broker Bex is your guide for this deck.

Broker Bex, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Implement Block-wise Transfer: Apply RFC 7959 to handle large payloads (firmware updates) over CoAP's UDP transport
Configure Resource Discovery: Construct .well-known/core endpoints with CoRE Link Format attributes
Evaluate CoAP Transport Options: Select between UDP, TCP, and WebSockets based on network constraints and device requirements
Analyze DTLS Security Overhead: Calculate handshake RTT costs and justify security mode selection for constrained deployments

Major section

Start With the Almost-Too-Large Update

The update is too large for one message, and the device may sleep before every part arrives.

A safe release needs a clear final result, not a pile of successful sends.
A protocol means shared rules for an exchange.
Constrained Application Protocol (CoAP) means a compact request method for small devices.

Major section

Start With the Almost-Too-Large Update (continued)

User Datagram Protocol (UDP) means sending separate messages without a lasting connection.

Transmission Control Protocol (TCP) means a stream that checks order and delivery.
Transport layer security means protection for a network exchange.
Firmware means software stored on a device.
It must keep the old safe version or accept one complete new version.

Major section

Start With the Almost-Too-Large Update (continued)

An over-the-air update means replacing that software through the network; it is called OTA.

The service must show which outcome occurred.
This runway does not choose block sizes or prove the radio budget.
The deeper features show observation, block transfer, discovery, protection, and the tests that turn them into a release path.

Major section

CoAP's Hidden Superpowers

"I thought CoAP was just simple request-response," said Temperature Terry. "But it can do way more!".

Instead of the dashboard asking you for temperature every 10 seconds -- which wastes energy -- you register once and then automatically send updates whenever the temperature changes.
"And what about when I need to send a big firmware update?" asked the LED. "That's Block Transfer!" said Max. "CoAP breaks the big file into small blocks, like cutting a pizza into slices.
So when I join a network, I don't need to be pre-configured.

Major section

Minimum Viable Understanding: Block-wise Transfer

Read the Block2 response trace from requested piece through final length and hash verification.

Block number, more flag, and size describe the response piece.They identify the block, whether another follows, and the selected block size.
The token correlates the response with its request.A matching token prevents a response being attributed to another outstanding exchange.
The ETag identifies the selected representation version.Keep it stable across retries so pieces from different firmware images are not mixed.
Check assembled length and hash before accepting the image.A complete transfer needs application evidence beyond successful packet delivery.

CoAP Block2 evidence contract preserving NUM, M, SZX, token, ETag, and format continuity through retries and reordering to final length and hash verification.

Major section

Putting Numbers to It

The success rate for block-wise transfer can be calculated using probability theory.

For 512-byte blocks (512 blocks total), the per-block success probability is the same ( $0.9^1 = 90\%$ per individual block), requiring the same expected retransmissions per block ( $1/0.9 \approx 1.11$ attempts).
This RTT-only product excludes LoRaWAN fragmentation, airtime, duty limits, receive windows, and retransmissions, so it is not a LoRaWAN transfer-time estimate.
With capped retries, compute completion probability from all radio fragments and the retry policy; smaller blocks can reduce bytes retransmitted after a loss.

Major section

DTLS Security

Transport and security choices are connected.

TCP can solve firewall or NAT pressure; DTLS keeps UDP deployments encrypted.
Encrypted application data starts after this exchange, which explains the setup cost explored by the calculator next.

DTLS handshake sequence showing the client initiating a secure session, the server issuing a cookie challenge for DoS protection, and both sides completing key exchange before encrypted application data begins.

Major section

A rollout estimate with explicit assumptions

Illustrative capacity assumption: verify actual radio airtime, regional limits, retries, and gateway behavior before planning deployment.

The estimate uses an eight-streams-per-gateway assumption.That premise needs measured deployment evidence before it can support rollout capacity.
Each street light receives a 128 KiB image, or 131,072 bytes.The binary unit matches the stated byte count and removes the decimal-kilobyte ambiguity.
The estimate is longer than the proposed two-hour window.Its result still depends on the radio and gateway assumptions shown for this example.
A pilot should record airtime, retries, installed version, and behavior.Use those observations before deciding whether to enlarge the rollout cohort.

Major section

Worked Example: OTA Firmware Update for 500 Street Lights (continued)

Step 1: Calculate block count and transfer time per device: Each block requires a CON request (device requests block) and a 2.05 Content response (server sends block).

Recommendation: Option C (incremental rollout): While slower overall, updating 128 devices on night 1 provides a live validation of the firmware.
If the update causes issues (dimming failures, communication bugs), only 25% of lights are affected.
CoAP's Block-wise resume capability means any interrupted transfers pick up where they left off the next night.

Deck summary

Key takeaways

The update is too large for one message, and the device may sleep before every part arrives.

User Datagram Protocol (UDP) means sending separate messages without a lasting connection.
An over-the-air update means replacing that software through the network; it is called OTA.
"I thought CoAP was just simple request-response," said Temperature Terry. "But it can do way more!".
Core Concept: CoAP messages are limited by UDP MTU (1280-1500 bytes), but firmware updates or images require 100KB+ payloads.

Retrieval practice

Recall check 1 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q1A firmware update uses CoAP block-wise transfer across a lossy network. Which review evidence matters most?

ABlock size, ACK and retry behavior, timeouts, and security overhead.

BRFC-defined block transfer alone, without lossy-link field tests.

CAn application-layer assumption that NAT expiry is irrelevant.

DTransport labels alone, without device and network constraint evidence.

Show answer

Answer: A CoAP advanced-feature review ties block transfer, discovery, transport, security, and failure modes to the actual deployment.

Retrieval practice

Recall check 2 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q2For a 10 KB firmware image, 15% packet loss, and a 1024-byte CoAP MTU, which option is a cautious first test, subject to regional radio measurements?

A1024-byte blocks with non-confirmable messages for speed.

B1024-byte blocks with confirmable messages for reliability.

C256-byte blocks with confirmable messages as a provisional test.

D64-byte blocks with non-confirmable messages for minimal overhead.

Show answer

Answer: C C tests smaller confirmable blocks; choose the final size only after measuring radio payload, fragmentation, duty limits, airtime, and retry cost.

Retrieval practice

Recall check 3 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q3A new CoAP device joins your smart home network. How does your dashboard app discover what resources (sensors, actuators) the device exposes?

AQuery a DNS server for the device's resource list

BGET /.well-known/core and parse Link Format

CTry common URIs like /temperature until one responds

DWait for the device to broadcast its capabilities

Show answer

Answer: B RFC 6690 standardizes /.well-known/core as the discovery endpoint. The response uses CoRE Link Format, listing all resources with their URIs, resource types (rt=), interfaces (if=), content formats (ct=), and observability flags.

Retrieval practice

Recall check 4 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q4A factory blocks UDP port 5683. Which option keeps a CoAP exchange on a network-approved path?

AUse MQTT instead; it works over TCP port 1883.

BUse CoAP over TCP (RFC 8323) on a port and path approved by the network team.

CUse HTTP instead because it is always allowed.

DUse CoAP over TCP on port 443 without checking firewall policy.

Show answer

Answer: B B changes transport and message framing. It does not grant firewall access; verify the approved port and path, then test a request through it.

Retrieval practice

Recall check 5 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q5What maintains CoAP notifications when a resource changes?

AApplication (CoAP Resources)

BBlock-wise Transfer (RFC 7959)

CObserve Extension (RFC 7641)

DUDP/DTLS Transport

Show answer

Answer: C Observe is a CoAP extension that maintains a notification relationship for changing resource state.

Retrieval practice

Recall check 6 of 6

Broker Bex says: answer from memory, then check your reasoning.

Q6Complete the CoAP block-wise transfer for sending a large firmware update to a constrained device:

Arequest = Message(code=PUT, uri='coap://sensor.local/firmware')

Brequest = Message(code=POST, uri='coap://sensor.local/firmware')

Crequest = Message(method='PUT', url='coap://sensor.local/firmware')

Drequest = Request(code=PUT, uri='coap://sensor.local/firmware')

Show answer

Answer: A Block1 option is used for request payloads (client-to-server transfers like PUT/POST).

Print reference

Check the six deployment decisions

Answer key.

A · CoAP advanced-feature review ties block transfer, discovery, transport, security, and failure modes to the actual deployment.
C · Among these options, 256-byte CON blocks detect failed delivery and limit each block retry to 256 payload bytes instead of 1024.
B · RFC 6690 standardizes /.well-known/core as the discovery endpoint. The response uses CoRE Link Format, listing all resources with their URIs, resource types (rt=), interfaces (if=), content formats (ct=), and observability flags.
B · RFC 8323 defines CoAP over TCP.

1. A: transfer, retry, and security evidence. 2. C: provisional block test, then measure the radio. 3. B: GET /.well-known/core. 4. B: TCP only on an approved path. 5. A: separate resource, extension, and transport jobs. 6. A: PUT upload uses Block1.

Print reference

Answers 2 of 2

Answer key.

C · Observe is a CoAP extension that maintains a notification relationship for changing resource state.
A · Block1 option is used for request payloads (client-to-server transfers like PUT/POST).