How to Analyze the Network Behaviors of IoT-enabled Devices Using Wireshark

Image for post
Image for post

1) Background

When device debugging becomes difficult during IoT development, it is imperative to use the network packet capturing tool Wireshark for analyzing device behaviors and subsequently troubleshooting problems. Let’s consider an example that shows how to use Wireshark to analyze the communication between a device and Alibaba Cloud IoT Platform.

2) Preparations

2.1 Create a Device

On Alibaba Cloud IoT Platform, create and register a device and obtain trituple information as shown below.

Image for post
Image for post

2.2 Device Simulation Program

In a computer, develop a device simulation program using Node.js and complete the following operations using the subsequent code:

  • Establish a connection
  • Subscribe to topics
  • Publish messages
  • Disconnect the connection

2.3 Capture Network Packets with Wireshark

IoT Platform uses the MQ Telemetry Transport (MQTT) protocol for communication. Therefore, configure the rule: TCP and port 1883.

Image for post
Image for post

2.4 Start the Device Simulation Program

Finally, initiate the device simulation program to get started.

Image for post
Image for post

3) Analysis of the Captured Packets

Wireshark captures the complete process of MQTT network interaction post the simulation script execution. The device IP address is marked as “device” for the sake of convenience, whereas the IP address of the connected IoT Platform remains unchanged.

3.1 TCP Three-way Handshake

Image for post
Image for post

The red box in the preceding figure shows a TCP three-way handshake, which is initiated by the “device” IP address. The used device port is port 56150.

3.2 MQTT CONNECT Behavior

The following figure shows the MQTT CONNECT behavior.

Click the Connect record to view the packet details appear in the lower part of the window. The client ID, user name, and password are used to authenticate the device during this CONNECT operation.

Image for post
Image for post

IoT Platform returns CONNACK in response to CONNECT after device authentication.

Image for post
Image for post

3.3 MQTT SUBSCRIBE Behavior

The following figure shows the process where the “device” IP address subscribes to a topic from the IoT Platform. The red box shows the topic subscribed to by the device.

Image for post
Image for post

The following figure shows the process where IoT Platform responds to the SUBSCRIBE behavior of the device.

Image for post
Image for post

3.4 MQTT PUBLISH Behavior

The following figure shows the process where the “device” IP address publishes a message with QoS equal to 1 to IoT Platform. The packet includes the topic and payload of the message.

Image for post
Image for post

IoT Platform returns a PUBACK message to the “device” IP address based on the QoS value 1.

Image for post
Image for post

Also, find this log entry on the Device Log page of the IoT Platform console as shown below.

Image for post
Image for post

3.5 MQTT DISCONNECT Behavior

The following figure shows the process where the “device” IP address initiates the DISCONNECT command to disconnect the MQTT connection channel.

Image for post
Image for post

3.6 TCP Four-way Handshake

The red box in the following figure shows a TCP four-way handshake.

Image for post
Image for post

To find complete log entries about devices online and offline navigate to the Device Log page of the IoT Platform console.

Image for post
Image for post

4) Summary

This article describes the basic skills for using Wireshark to analyze the network communication between a device and Alibaba Cloud IoT Platform. We hope that these skills are helpful for your IoT development.

5) Appendix

The following table lists the Identifiers at the TCP layer.

Image for post
Image for post

Original Source:

Written by

Follow me to keep abreast with the latest technology news, industry insights, and developer trends.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store