The pulse of MQTT in the wild: A large-scale traffic analysis

he Message Queue Telemetry Transport (MQTT) protocol is widely used in Internet of Things (IoT) applications, offering a lightweight and efficient communication model for resource-constrained devices. Despite its increasing adoption in domains such as smart homes, industrial automation, and environmental monitoring, large-scale empirical studies on MQTT traffic are rare, and existing work often focuses on controlled experiments rather than natural, in-the-wild deployments. In this paper, we address this gap by analyzing MQTT traffic “in the wild”. We developed a measurement framework to scan the IPv4 address space, identifying 14,386 active brokers. We collected about 3.2 billion messages over two weeks, enabling an in-depth study of broker throughput, topic structures, payload composition, and QoS configurations. Our findings reveal that broker throughput is generally low, suggesting limited stress in real-world usage. Topic structures vary significantly, with some brokers using deep hierarchies, which may impact distributed deployments. Structured payloads (JSON, Strings) dominate MQTT traffic, presenting opportunities for broker-side optimizations. Furthermore, QoS 0 is overwhelmingly preferred, indicating a focus on low-latency communication over reliability guarantees. These insights contribute to a better understanding of MQTT traffic patterns, which can be leveraged for protocol optimizations, scalability strategies, and security considerations for future IoT deployments.