Skip to main content
IMMUNITYSEC

Port 1883: Message Queuing Telemetry Transport (unencrypted)

TCP 1883 is the registered port for unencrypted MQTT, a lightweight publish/subscribe messaging protocol. The MQTT 5.0 specification notes that TCP 8883 is registered for MQTT over TLS. The Eclipse Mosquitto broker's default listener port is 1883.

1883
TCP

Port Details

Port
1883
Transport
TCP
Service
MQTT
IANA service name
mqtt
Range
User port (1024-49151)
Related ports
8883

Security Exposure

Shadowserver scans for MQTT brokers on 1883 and 8883 and flags instances that allow anonymous access, which can be abused to leak data. Traffic on 1883 is unencrypted, so even password-protected brokers can disclose credentials and message content on the wire. Mosquitto releases before 2.0 allowed clients to connect without authentication by default.

Hardening

  • +Disable anonymous access on the broker and require per-client credentials or client certificates.
  • +Use MQTT over TLS on 8883 and disable the plaintext 1883 listener where clients support TLS.
  • +Restrict which topics each client may publish or subscribe to with broker access control lists (for example Mosquitto's acl_file or ACL plugins).
  • +Keep brokers off the public internet or behind a firewall that admits only known device networks.

Monitoring

Log client connections and authentication failures on the broker, and alert on subscriptions to wildcard topics from unexpected clients. Watch for new hosts listening on 1883.

Tools for Auditing and Monitoring MQTT

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

Wireshark

Open Source
Network Monitoring Tools

Network packet analyzer and protocol inspection tool for capturing live traffic and debugging network communications in detail.

LicenseGPL-2.0-or-later
PlatformWindows, macOS, Linux, BSD

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Related Tool Categories

Network Monitoring Tools→

Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.

OT/ICS Security Tools→

Industrial network monitoring, ICS protocol analysis, and OT asset inventory platforms.

Frequently Asked Questions

What is the difference between port 1883 and 8883?→

Port 1883 is registered for MQTT without TLS and port 8883 for MQTT over TLS, according to the MQTT 5.0 specification. Plaintext 1883 exposes credentials and payloads on the network.

Is MQTT port 1883 TCP or UDP?→

MQTT runs over TCP. IANA lists both transports for the registration, but the MQTT specification defines TCP, TLS and WebSocket as transports.

Does Mosquitto allow anonymous connections?→

Mosquitto 2.0 and later requires authentication options to be chosen explicitly before clients can connect. Earlier versions allowed unauthenticated clients by default.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 1883 is not guaranteed to be MQTT. Exploited-in-the-wild data from the CISA KEV catalog (CC0).