Skip to main content
IMMUNITYSEC

Port 8883: Message Queuing Telemetry Transport over TLS

IANA registers 8883 as secure-mqtt. The OASIS MQTT 5.0 standard notes that TCP 8883 and 1883 are registered for MQTT with and without TLS, and strongly recommends that servers offering TLS use 8883. MQTT is a lightweight publish/subscribe messaging protocol that the standard describes as suited to machine-to-machine and Internet of Things communication.

8883
TCP

Port Details

Port
8883
Transport
TCP
Service
MQTT over TLS
IANA service name
secure-mqtt
Range
User port (1024-49151)
Related ports
1883

Security Exposure

TLS on 8883 protects the connection but does not by itself decide who may connect, publish, or subscribe. The MQTT 5.0 standard lists threats including compromised devices, interception or alteration of traffic, spoofed control packets, and denial of service, and says implementations in hostile environments often need authentication and authorization. In Eclipse Mosquitto, allow_anonymous controls whether clients without a username may connect.

Hardening

  • +Require client authentication on the broker, using client certificates or username and password over TLS.
  • +Apply per-topic authorization so each device can only publish and subscribe to its own topics.
  • +Disable anonymous access; in Eclipse Mosquitto, keep allow_anonymous false on any listener reachable from the network.
  • +Retire plaintext 1883 listeners once clients have moved to 8883.

Monitoring

Log broker connections with client IDs and source addresses, and alert on authentication failures, unknown client IDs, and subscriptions to broad wildcard topics.

Tools for Auditing and Monitoring MQTT over TLS

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

Wireshark

Open Source
Network Monitoring Tools

Network packet analyzer and protocol inspection tool for capturing live traffic and debugging network communications in detail.

LicenseGPL-2.0-or-later
PlatformWindows, macOS, Linux, BSD

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Related Tool Categories

Network Monitoring Tools→

Packet capture tools, protocol analyzers, and network security monitors for traffic visibility.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

OT/ICS Security Tools→

Industrial network monitoring, ICS protocol analysis, and OT asset inventory platforms.

Frequently Asked Questions

What is the difference between port 1883 and 8883?→

Both are registered for MQTT. 1883 is for unencrypted MQTT and 8883 is for MQTT over TLS, according to the OASIS MQTT 5.0 standard.

Is port 8883 TCP or UDP?→

MQTT runs over TCP. IANA lists both transports for secure-mqtt, but the MQTT standard says connectionless transports such as UDP are not suitable on their own.

Does using port 8883 make an MQTT broker secure?→

It encrypts the connection. Authentication and topic authorization still have to be configured on the broker.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 8883 is not guaranteed to be MQTT over TLS. Exploited-in-the-wild data from the CISA KEV catalog (CC0).