MQTT

Publish-Subscribe for Constrained Devices

MQTT (Message Queuing Telemetry Transport) is a lightweight publish-subscribe protocol designed for IoT devices operating over unreliable, low-bandwidth networks. Devices publish messages to a broker on named topics; other devices subscribe to topics and receive messages asynchronously. This decoupling means a temperature sensor doesn't need to know who is consuming its readings — it just publishes to sensors/building-a/floor-3/temperature.

QoS Levels and Retained Messages

MQTT defines three Quality of Service levels over TCPTransmission Control Protocol. A reliable, connection-oriented transport protocol that guarantees ordered, error-checked delivery of data through three-way handshakes, acknowledgments, and retransmission. The foundation of HTTP, SSH, and most internet services.:

A retained message is stored by the broker and immediately delivered to new subscribers — useful for device state that must be available on connection.

Security Considerations

MQTT over plain TCP (port 1883) transmits credentials in cleartext. Production deployments must use MQTT over SSL/TLSSecure Sockets Layer / Transport Layer Security. Cryptographic protocols that provide encrypted, authenticated communication over a network. SSL is deprecated; modern implementations use TLS 1.2 or TLS 1.3. (port 8883). Authentication is typically username/password; more secure deployments use client certificate mutual TLS. CoAPConstrained Application Protocol. A lightweight RESTful protocol designed for resource-constrained IoT devices, running over UDP with optional DTLS encryption. Similar to HTTP in design but optimized for low-power, lossy networks. serves a similar niche for REST-style IoT communication, while AMQPAdvanced Message Queuing Protocol. An open standard for message-oriented middleware that provides reliable, asynchronous message delivery with features like queuing, routing, and publish-subscribe. Used by RabbitMQ and Azure Service Bus. provides stronger enterprise messaging guarantees. Because many IoT brokers are internet-accessible, IP Blacklist Check should be used to audit broker IP reputation before exposing a broker endpoint publicly.