CC3220SF-LAUNCHXL: Capturing and analyzing MQTT packets in MQTT Client Demo for CC3220SF Launchpad

Nour mohamed

Part Number: CC3220SF-LAUNCHXL
Other Parts Discussed in Thread: CC3220SF, UNIFLASH

Hello,

I have followed the MQTT client demo in

and I am able to toggle the LEDs and send text to the CC3220SF Launchpad. Now I want to capture the MQTT packets sent and received to and from the launchpad. For that purpose I am using wirehshark. However, when I ran wireshark I wasn't able to see any MQTT packets. Is it because the packets are encrypted or something else?

Thank you,

over 7 years ago

0 Shlomi Itzhak over 7 years ago

TI__Guru 64305 points

Hello,

Are you running the secured MQTT?

You can inspect the define SECURE_CLIENT.

If it is secured, you would not be able to see anything.

If it is the non-secured, you should be able to see MQTT payload on top of TCP (port is 1883).

Regards,

Shlomi

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

Thank you! I will check that and let you know.

I’ve noticed that there is client ID and password to be specified in both the code and the application (MyMQTT). However, when I publish to any subscribed topic, I’m not asked for any username or password.
Is there a use for them that I’m missing?

Regards,

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

No I am not running the secured MQTT, #define SECURE_CLIENT is commented in the code. However, I am using the CC3220SF Launchpad, which is a secure device. before flashing the demo I added the certificates in uniflash. Does that effect anything?

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

Hello,

The user and password are used during handshake between the client and server (connection procedure). It does not relate to a specific topic.

When using the built-in username/password authentication, the MQTT broker will evaluate the credential based on the implemented authentication mechanism.

When setting username and password on the client, it will be sent to the broker in clear text. This would allow eavesdropping by an attacker and is an easy way of obtaining the credentials. The only way to guarantee a completely secure transmission of username and password is to use transport encryption.

Shlomi

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

So in this case you should see the MQTT payload on top of TCP layer on a sniffer.

Maybe you do not have an MQTT parser on your sniffer software.

Shlomi

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

I am using Wireshark, which supports MQTT: www.wireshark.org/.../mqtt.html

Do you suggest any other program?

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

Can you share the sniffer capture?

I am using omnipeek but it is not free license.

Shlomi

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

Here:

Captured Packets.rar

Please let me know if you find any MQTT packets.Thank you,

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

It is all full of multicast packets, mdns and ssdp.

Do you have some filters configured?

have you ever managed to capture some TCP unicast data and not mqtt?

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

these are the filters:

I have but not ones related to this project.

Thank you,

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

The filters are the default ones so I guess it is OK.

However, I am using a real sniffer, i.e. sniffing the air and not just a specific interface.

I believe that the WireShark is just sniffing the interface it is connected to so you would not be able to see a unicast connection that is not involving the interface.

This is why you see multicasts which are also designated to the interface.

Just for the test, you can open a MQTT client on the PC in which the sniffer interface is connected to and capture the connection.

Shlomi

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

I'm connecting the CC3220SF launchpad and the mobile phone (MyMQTT app) and my laptop (WireShark) to the same WiFi network.

What do you mean by open a MQTT client on the PC? I'm currently using an app on my phone to control the launchpad.

Thank you,

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

What kind of sniffer are you using?

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

I am using Omnipeek as the software and Cisco dongle as the WiFi.

What I meant is that as far as I know, the WireShark is capturing whatever is seen on the connected interface on the PC, i.e. not every packet but only packets designated to that specific PC, or of course multicasts and broadcasts. Maybe this can explain what you see but i am not 100% sure.

Shlomi

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

The Cisco dongle provides WiFi or is it a sniffer?

I tried to run another app called Packet capture at the same time with MyMQTT app in the same phone to capture some packets but that also didn't work.

Do you suggest any way to control the Launchpad from the PC rather than the mobile app?

Regards,

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

I want to use HiveMQ Websocket Client instead of the MyMQTT app.
www.hivemq.com/.../

Do you think this might help in capturing the packets?

Thank you,

0 Nour mohamed over 7 years ago in reply to Nour mohamed

Expert 2875 points

I solved the issue.

Thank you for your help!

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

Hello sir,

What do you mean by: When using the built-in username/password authentication, the MQTT broker will evaluate the credential based on the implemented authentication mechanism.

Is there any way for me to see the Username/password specified in the code? for ex. using wireshark

Thank you,

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

Hello,

So is this thread resolved? I could see you solved your issue.

And there is a parallel thread you openned with the same subject, http://e2e.ti.com/support/wireless_connectivity/simplelink_wifi_cc31xx_cc32xx/f/968/t/682718

Is it still required?

anyway, you would not be able to see the credentials on a sniffer. Otherwise, it would have been very easy to crack the mqtt handshake.

Shlomi

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

Hello sir,

Yes this thread is resolved, but the other one isn't yet.
Where can I see those credentials, or using which tool?

Thank you,

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

These credentials are coordinated between the client and server and it depends whether the connection is secured or not.

MQTT allows to send a username and password for authenticating the client and also authorization. However, the password is sent in plaintext, if it isn’t encrypted or hashed by implementation or TLS is used underneath.

So if you are using port number 8883, it means MQTT over SSL. Hence, you would not be able to see it with any tool.

Shlomi

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

I am not using the secure port 8883. I am using port 1883. I can see the Cliend ID as well as the client user name and password set in the MQTT client desktop app. However, I can't see the username and password set in the code of the launchpad? Is it possible to sniff them?

Thank you

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

Hello,

So as I mentioned, if the TCP layer is not secured, you should be able to see it on a sniffer.

I tested it myself and you can see in both cases, with username/password and without.

without:

with:

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

Hello sir,

This connect packet is sent from the launchpad right?

I cannot see this packet on wireshark.. is it because of the different interface thing as well?

Thanks you,

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

yes, it is coming from the launchpad.

As i mentioned before, it is probably related to how you setup wireshark and whether you can truely capture the air or just your interface.

Shlomi

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

So the secure client only hides the username and password, not the rest of the data?

Thank you,

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

No, if the client is secured, e.g. works with port 8883, the entire session is encrypted since it is running on top of a TCP link which is encrypted.

In this case, you would not be able to see anything on a sniffer.

The sniffer capture I provided is for an unsecured link.

Shlomi

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

Hello sir,

By you won’t be able to see anything, do you mean that the data captures will be encrypted or that it won’t be visible at all?

Thank you,

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

the data is encrypted.

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

Hello sir,

What kind of encryption is it using?

Regards,

0 Shlomi Itzhak over 7 years ago in reply to Nour mohamed

TI__Guru 64305 points

Since it is based on TCP layer encryption, the two peer devices (client and server) agree on method (SSL, TLS, etc) and encryption suite during the handshake.

It really depends on the server side but usually the server would choose the best from the list that the client can still support.

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

Thank you sir.

What about the key? Is it in the code?

0 Nour mohamed over 7 years ago in reply to Shlomi Itzhak

Expert 2875 points

Hello sir,

I have noticed that the IP address that the Client sends data to is not the same as the broker IP address set in the code.

The one in the code is 192.168.178.67 while the one in the captures is 192.168.30.241

why is that?

Regards,

0 Jan D over 7 years ago in reply to Nour mohamed

Guru 79905 points

Hi,

198.41.30.241 = m2m.eclipse.org

Jan

0 Nour mohamed over 7 years ago in reply to Jan D

Expert 2875 points

Thank you for your reply!

Wi-Fi

Wi-Fi forum

CC3220SF-LAUNCHXL: Capturing and analyzing MQTT packets in MQTT Client Demo for CC3220SF Launchpad