Testing & Validation · Study deck
Analyzing IoT Protocols
Protocol analysis reads captured traffic as a structured conversation rather than a pile of packets.
Test Tessa is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- decode a protocol conversation instead of just counting packets
- build a protocol review record organized by protocol family
- account for decoders, encryption, and conversation state when reading a capture
- Explain: Packet counts cannot tell you which request, reply, retry, or refusal changed the physical result.
Major section
Start Simple: Read the Conversation
Packet counts cannot tell you which request, reply, retry, or refusal changed the physical result.
- A protocol means shared rules for an exchange.
- A broker means a service that passes messages between senders and receivers.
- Telemetry means readings and status sent by a remote device.
- Message Queuing Telemetry Transport (MQTT) means a lightweight message method for devices.
Major section
Start Simple: Read the Conversation (continued)
Constrained Application Protocol (CoAP) means a compact request method for small devices.
- Bluetooth Low Energy (BLE) means a short-range low-power radio system.
- Zigbee means a low-power radio system that can carry messages through a mesh.
- Request one unlock, repeat it, delay the reply, remove a relay, and use the wrong identity.
Major section
Start Simple: Read the Conversation (continued)
The protocol decode is powerful because it is specific, not because it explains everything.
- A capture is useful only when it explains what happened.
- This runway does not make an encrypted message readable or prove intent.
- The deeper sections show filters, decoders, timing, conversation state, and the limits of traffic evidence.
Major section
Decoding the Conversation, Not Just Counting Packets
The single most important idea is that a decoded message is still bounded evidence.
- Think of reading a transcript of a meeting you were authorized to record.
- You can check who spoke, in what order, and whether a reply came — that is protocol decoding.
Major section
Decoding the Conversation, Not Just Counting Packets (continued)
But you cannot hear what was said in a sealed side conversation (an encrypted payload), and you cannot know what someone who was off-mic (outside your capture point) said at all.
- The transcript is real evidence, precisely bounded by the room and the microphone.
- A gap note records encrypted content, an unseen segment, or a missing acknowledgement that the trace cannot resolve.
- This path connects decoded fields to communication evidence without confusing a packet observed at one point with application acceptance elsewhere.
- Beginner Examples Read these examples as a progression from the simplest observation to the boundary that still needs evidence.
Major section
Decoding the Conversation, Not Just Counting Packets (continued)
Bound to the capture The finding holds only for the capture point, time window, and the parts that were readable.
- Observed is not accepted A message seen leaving a device is not proof a receiver got it; the response or ack carries that evidence.
- Finish by considering how a capture shows a device's request but no response, so the finding is recorded as "request sent, no visible response" rather than a guess at the cause.
- If you can decode a message to its contract and bound the claim to the capture, you have the core idea.
Major section
Protocol Families and the Review Record
Different IoT protocols carry different conversation state, so the decode you check depends on the family.
- The table names what each family puts on the wire and what to compare against the contract; remember that the radio protocols below require a link-layer or radio capture, not an IP-interface capture.
Major section
Protocol Families and the Review Record (continued)
Broker-side capture cannot show subscriber delivery.
- UDP loss and retries blur "no response" causes.
- The sequence keeps a valid packet interpretation from becoming an unsupported claim about delivery or application acceptance.
- Worked Example: An MQTT Publish and a CoAP Response Gap Suppose a device should publish a status message when a local input changes, captured between the device and a broker you administer.
Major section
Decoders, Encryption, and Conversation State
The deeper layer is about what a decode can and cannot recover.
- Three mechanisms matter: how a dissector turns bytes into fields, what encryption does to the evidence, and how conversation state and missing context shape the conclusion.
- An undocumented format is read as if its meaning were known.
- Missing handshake makes a normal exchange look broken.
Major section
Decoders, Encryption, and Conversation State (continued)
A hidden payload is treated as if it were inspected.
- A custom or proprietary format has no public structure, so a generic decoder shows it as opaque bytes; interpreting it requires a documented description of the format.
- A sent message is taken as a received one.
- One vantage point's blind spot becomes a false conclusion.
Major section
Decoders, Encryption, and Conversation State (continued)
Treating a guessed interpretation of an undocumented payload as fact is a common error — if the format is unknown, the honest record says so.
- Encryption Hides the Payload, Not Always the Envelope Most production IoT links are encrypted — TLS for MQTT, DTLS for CoAP, link-layer encryption for BLE and Zigbee — and that is a security feature, not a defect.
- When a payload is encrypted and you cannot decrypt it, record the finding as metadata-only and bound the conclusion accordingly.
- Common Pitfalls Review these failure modes in the order they can weaken or invalidate the result.
Major section
Summary
A decoded message is bounded evidence: it holds only for the capture point, the time window, and the parts that were readable.
- A reviewable finding records scope, decode, evidence, gap, decision, and a reopen rule, and distinguishes "not sent," "sent with no visible response," and "response not accepted.".
- Dissectors map bytes to fields using the protocol spec, so undocumented or custom formats are opaque until a format description exists; do not report a guess as contents.
- Encryption hides payloads while leaving metadata visible; decrypt only with keys you legitimately hold for your own devices, and otherwise record findings as metadata-only.
Deck summary
Key takeaways
Packet counts cannot tell you which request, reply, retry, or refusal changed the physical result.
- Constrained Application Protocol (CoAP) means a compact request method for small devices.
- The protocol decode is powerful because it is specific, not because it explains everything.
- The single most important idea is that a decoded message is still bounded evidence.
- But you cannot hear what was said in a sealed side conversation (an encrypted payload), and you cannot know what someone who was off-mic (outside your capture point) said at all.
Retrieval practice
Recall check 1 of 3
Test Tessa says: answer from memory, then check your reasoning.
Q1A broker-side capture shows a device publishing the expected MQTT message. Why is 'the message was delivered to subscribers' not yet supported?
Show answer
Answer: A A decoded message is bounded by the capture point.
Retrieval practice
Recall check 2 of 3
Test Tessa says: answer from memory, then check your reasoning.
Q2A capture shows an MQTT publish from a device, but the record does not state the capture point or whether subscriber delivery was in scope. What is the strongest review response?
Show answer
Answer: D The publish supports the boundary it was seen at; subscriber delivery is a separate event needing its own capture or acknowledgement.
Retrieval practice
Recall check 3 of 3
Test Tessa says: answer from memory, then check your reasoning.
Q3While validating your own device, you capture its MQTT traffic but the payloads are TLS-encrypted and you do not have keys for that capture. A reviewer asks you to state what the publish payload contained. What is the correct response?
Show answer
Answer: A Encryption hides the contents; the honest record states metadata-only and limits the claim.
Print reference
Answers
Answer key.
- A · A decoded message is bounded by the capture point.
- D · The publish supports the boundary it was seen at; subscriber delivery is a separate event needing its own capture or acknowledgement.
- A · Encryption hides the contents; the honest record states metadata-only and limits the claim.