Port 1883 – MQTT

TCP

Port 1883 is the MQTT broker port for lightweight publish-subscribe messaging. MQTT is the dominant IoT protocol – designed for constrained devices with minimal bandwidth and power. Port 1883 is unencrypted; use port 8883 for MQTT over TLS. Default Mosquitto installations allow anonymous connections – always configure authentication.

Port Number

1883

Protocol

TCP

Service

Message Queuing Telemetry Transport

Range

IANA Registered (1024–49151)

Description

MQTT on port 1883 provides the unencrypted broker endpoint for publish-subscribe messaging. Clients connect, subscribe to topics (sensor/temperature/#), and receive messages published by other clients. The protocol overhead is minimal – a CONNECT packet is 14 bytes, making it ideal for constrained IoT devices. MQTT brokers (Mosquitto, EMQX, HiveMQ) on port 1883 should never be exposed to the internet without authentication. Shodan indexes thousands of open MQTT brokers leaking sensor data, home automation states, and industrial control messages. Always enable username/password or client certificate authentication, use ACLs to restrict topic access, and prefer port 8883 (MQTT over TLS) for any deployment accessible beyond the local network.

Security risks

1No authentication by default: Mosquitto and many MQTT brokers ship with allow_anonymous true – any client connects, subscribes to '#' (all topics), and reads all messages including sensor data, commands, and credentials
2Wildcard subscription attack: subscribing to '#' (multi-level wildcard) on an open broker exposes every message across all topics – IoT device telemetry, control commands, GPS coordinates, camera feeds
3Command injection via MQTT publish: if IoT devices execute received MQTT payloads as commands (common in home automation), publishing to actuator topics controls physical devices (locks, valves, switches)
4No encryption (port 1883): all MQTT traffic including CONNECT packets (which carry username/password in cleartext fields) visible to network observers. Port 8883 adds TLS.
5Retained message poisoning: attacker publishes retained messages to critical topics – new subscribers immediately receive the malicious payload, persisting even after the attacker disconnects

Firewall guidance

Never expose port 1883 to the internet. Use port 8883 (MQTTS/TLS) for all production IoT deployments. Enable authentication (password_file or auth plugin in Mosquitto). For cloud IoT: use AWS IoT Core or Azure IoT Hub which enforce mutual TLS certificate authentication per-device. Restrict topic subscriptions via ACLs (per_listener_settings true, acl_file in Mosquitto).

Diagnosis commands

Subscribe to ALL topics (tests if anonymous wildcard access is possible – should fail)

shell

mosquitto_sub -h broker -t '#' -v

Test if anonymous publishing is allowed (should be rejected)

shell

mosquitto_pub -h broker -t 'test/probe' -m 'security-audit' -u '' -P ''

Probe MQTT broker for anonymous access

shell

nmap -p 1883 --script mqtt-subscribe target

Audit Mosquitto security configuration

shell

grep -E 'allow_anonymous|password_file|acl_file' /etc/mosquitto/mosquitto.conf

Usage examples

Port 1883 – MQTT

shell

mosquitto_sub -h broker -t 'sensors/#'
mosquitto_pub -h broker -t 'sensors/temp' -m '22.5'
mqtt-spy --broker broker:1883

Common services on this port

Eclipse MosquittoEMQXHiveMQVerneMQAWS IoT CoreAzure IoT HubHome Assistant (MQTT integration)

Related ports

1883

MQTT (this port, unencrypted)

8883

MQTT over TLS (secure)

8083

MQTT WebSocket (browser clients)

443

MQTT over WSS (WebSocket Secure)

History

MQTT (Message Queuing Telemetry Transport) was created by Andy Stanford-Clark (IBM) and Arlen Nipper in 1999 for SCADA systems over satellite links. Designed for low-bandwidth, unreliable networks with minimal overhead (2-byte header). Port 1883 was registered with IANA. MQTT became the dominant IoT messaging protocol – used by AWS IoT, Azure IoT, Facebook Messenger (originally), and millions of IoT devices. MQTT 5.0 (2019) added shared subscriptions, topic aliases, and reason codes.

FAQ

How do I secure an MQTT broker?

1. Set allow_anonymous false in mosquitto.conf. 2. Create password file: mosquitto_passwd -c /etc/mosquitto/passwd user1. 3. Configure ACL file restricting topics per user. 4. Enable TLS: listener 8883, certfile/keyfile/cafile. 5. Disable port 1883 (listener 1883 → remove or bind to 127.0.0.1). 6. For IoT devices: use client certificates (TLS mutual auth) instead of passwords. 7. Set max_connections and message_size_limit to prevent DoS.

MQTT vs AMQP vs HTTP for IoT?

MQTT: lowest overhead (2-byte header), persistent connections, pub/sub model, designed for constrained devices (ESP32, sensors). Best for: telemetry, real-time control, battery-powered devices. AMQP: heavier protocol, message queuing with delivery guarantees, complex routing. Best for: enterprise messaging between servers. HTTP: request/response only, highest overhead, but universally supported. Best for: infrequent updates from devices with good connectivity.