To dissect MQTT traffic in Wireshark, apply the display filter mqtt, inspect the packet-details tree, and narrow the results with fields such as mqtt.msgtype, mqtt.topic, mqtt.qos, and mqtt.retain. For MQTT carried over TLS, those fields become visible only if Wireshark can decrypt the traffic using suitable session secrets.
Start by isolating MQTT packets
- Open a capture that includes the client-and-broker exchange you need to investigate.
- Enter
mqttin Wireshark’s display-filter bar. This shows packets Wireshark has dissected as MQTT. - Select a packet and expand its MQTT entry in the packet-details pane to inspect the control-packet type and fields.
If the filter returns no packets, the capture may not include the relevant traffic, or Wireshark may not have recognized it as MQTT. A capture that starts partway through a conversation can also leave its story incomplete. Do not treat a missing result as proof that MQTT was absent.
Use MQTT fields to find the packets you need
Wireshark documents MQTT fields that can be inspected in packet details and used in display filters. For example, mqtt.msgtype identifies the control-packet type, while mqtt.topic identifies a topic where that field is present. The following filters are useful starting points:
mqtt— packets dissected as MQTT.mqtt.msgtype == 3— PUBLISH packets, using the documented message-type value shown here. Check enum behavior against your installed Wireshark release.mqtt.topic— packets that contain a topic field.
A field-specific filter naturally excludes packets without that field. For the exact field names and their supported versions, consult Wireshark’s MQ Telemetry Transport Protocol display-filter reference, which lists coverage through Wireshark 4.6.9. Availability can differ in older releases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- Used Book in Good Condition
Read the packet details that explain the exchange
Packet details can help answer different questions at different points in the conversation. Field names below are documented by Wireshark; confirm they exist in the release you are using.
| Field | What it can show |
|---|---|
mqtt.msgtype |
The MQTT control-packet type. |
mqtt.topic |
The topic shown in a packet that contains this field. |
mqtt.qos |
The QoS value carried by a PUBLISH packet. |
mqtt.retain |
Whether the retain flag is set. |
mqtt.clientid |
The client identifier shown in CONNECT. |
mqtt.msgid |
A message identifier that can associate relevant QoS exchanges. |
mqtt.connack.reason_code and mqtt.puback.reason_code |
Reason codes exposed by the corresponding acknowledgment packets. |
mqtt.ver, mqtt.properties, and mqtt.property.* |
Protocol-version and property details present in dissected packets. |
Other documented fields include username, keep-alive, and reason-code fields for additional acknowledgments and disconnects. A field’s presence depends on the packet and protocol version; the field reference includes introduction and supported-version details.
Rank #2
Trace the conversation without overreading it
Read packets in sequence rather than treating an individual publish as the whole story. A typical investigation follows connection setup and CONNACK outcome, subscription requests and acknowledgments, publishes and their QoS-related acknowledgments, then disconnects. Use message identifiers to relate relevant QoS exchanges and reason codes to interpret acknowledgment outcomes.
A packet list alone does not establish application-level delivery or the broker’s internal subscription state. Those conclusions require understanding the applicable QoS flow and having a capture complete enough to show the relevant exchange.
Rank #3
Know when to use a display filter instead of a capture filter
A display filter works on packets already captured and dissected; a capture filter controls what is collected in the first place. Their syntax is different. Use display filters such as mqtt or mqtt.msgtype == 3 for iterative analysis after capture. Capture filters cannot inspect MQTT application fields in the way display filters do. Wireshark documents the distinction and filter behavior in its wireshark-filter(4) manual.
Why MQTT topics may be hidden by TLS
When MQTT is carried inside TLS, the application data is encrypted. Without suitable secrets and successful decryption, expect to see TLS records rather than MQTT topics, message types, or payload content. This is a prerequisite for visibility, not necessarily a Wireshark fault.
Wireshark’s TLS guidance describes several ways to provide secrets:
- Per-session key log: Use a key log file exported by an application when that capability is available. This is generally the recommended approach in Wireshark’s guidance.
- Pre-shared key (PSK): Configure the PSK when the session uses that key.
- RSA private key: This works only under limited legacy protocol and key-exchange conditions; it does not decrypt TLS 1.3.
Decryption also depends on having a usable capture of the relevant session. Only analyze traffic you are authorized to inspect, and handle key material and key log files carefully because they can expose session contents.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
Choose the right inspection path
| Traffic and prerequisites | What to expect |
|---|---|
| Plaintext MQTT, with relevant packets captured | Wireshark can dissect MQTT fields for inspection and display filtering. |
| MQTT inside TLS, without usable session secrets | Application fields such as topics and payloads remain encrypted. |
| MQTT inside TLS, with suitable secrets and a usable capture | Wireshark may decrypt the session and expose MQTT for dissection. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
