The pulse of MQTT in the wild: A large-scale traffic analysis

• Scanned IPv4 to find 14386 MQTT brokers and captured 3.2 billion messages • Few brokers generate most traffic (“elephants”), while many handle little (“mice”). • Brokers show low load overall, with heavy-tailed traffic patterns. • Over 88% of messages use QoS 0, prioritizing low-latency over delivery guarantees. • Topics and payloads mostly follow best practices, but outliers reveal inefficiencies. The Message Queue Telemetry Transport (MQTT) protocol is widely used in Internet of Things (IoT) applications, offering a lightweight and efficient communication model for resource-constrained devices. Despite its increasing adoption in domains such as smart homes, industrial automation, and environmental monitoring, large-scale empirical studies on MQTT traffic are rare, and existing work often focuses on controlled experiments rather than natural, in-the-wild deployments. In this paper, we address this gap by analyzing MQTT traffic “in the wild”. We developed a measurement framework to scan the IPv4 address space, identifying 14,386 active brokers. We collected about 3.2 billion messages over two weeks, enabling an in-depth study of broker throughput, topic structures, payload composition, and QoS configurations. Our findings reveal that broker throughput is generally low, suggesting limited stress in real-world usage. Topic structures vary significantly, with some brokers using deep hierarchies, which may impact distributed deployments. Structured payloads (JSON, Strings) dominate MQTT traffic, presenting opportunities for broker-side optimizations. Furthermore, QoS 0 is overwhelmingly preferred, indicating a focus on low-latency communication over reliability guarantees. These insights contribute to a better understanding of MQTT traffic patterns, which can be leveraged for protocol optimizations, scalability strategies, and security considerations for future IoT deployments.