# Security Analysis of the MQTT-SN Protocol for the Internet of Things
## 5 MQTT-SN Attacks and Performance Evaluation
### Congestion Attack  
This attack is very common in many protocols, but there is a new factor to take into account when it is implemented over MQTT/MQTT-SN. As the broker must distribute the published messages, an attacker could publish massive messages on a common topic. This means the impact is multiplied by the number of devices that have been subscribed to this topic. There are several approaches to performing the attack. For example, it can create big packets (with 6 LoWPAN, there is a maximum of 127 bytes for the maximum transmission unit), or it can send many packets as quickly as possible.  
Figure 18 shows the scheme for performing the attack, illustrating how the flow of _/topic1_ increases with respect to the normal scenario. In this experiment, this was performed by sending messages without delay with the maximum allowed size.  
We can see the format of the _Publish_-type packet (Figure 19) in the congestion attack. The only difference with respect to a trash injection attack is that, here, as a general rule, the packet will be sent with the largest possible size, so the _length_ field gains relevance,  
Figure 16: Connect packet format (spoofing connection).  
Figure 17: Spoofing connection attack evaluation diagrams. (**a**) MQTT-SN topics sent for each device in the baseline scenario. (**b**) MQTT-SN topics sent for each device after spoofing connections.  
although it is actually calculated on the basis of the _data_ field, which can be used to identify this attack quickly. The size may vary depending on the network protocols used.  
Evaluation of the Congestion Attack  
To demonstrate the impact of this attack, firstly, Figure 20a shows the packets that have been sent by the broker in the baseline scenario, and then, Figure 20b shows the traffic on a compromised IoT baseline system. It can be seen how the broker seems to send fewer messages.  
In order to observe the impact more clearly, Figure 20c zooms in on the behavior of the system when it is not under attack, while Figure 20d zooms in on the behavior of the system when it is under attack. These images show an increase in the number of packets received by the broker when the system is under attack.  
In this implementation, the attacker floods a topic with two devices that send messages uninterruptedly, and the broker's buffer seems to have overflowed because it stops sending other topics. In this sense, the attacker is easily able to modify the normal behavior of the system. Figure 21 shows the accumulated traffic volume difference between the baseline system and a congested system (flooding a topic with two devices). As we can observe, the attackers considerably increased the traffic of the overall system. This could be a serious issue in an IoT context, because in a small network, this increase will have a negative impact on battery consumption. A network-based IDS could identify congestion in the network and alert the administrator to a possible attack.  
Figure 19: Publish packet format (congestion attack).  
Figure 18: MQTT-SN congested accumulated traffic scheme.