Zeek doesn't see the MQTT traffic.

Zeek
1

I am trying to work with the mqtt_publish and the mqtt_connect events**.** I have a mosquitto broker which is running locally on which I send messages from a sensor. I want to investigate those messages. However, I am not able to observe any values that should like c: connection. Even when I run it on the mqtt.pcap from here and again the previously mentioned events, it doesn’t produce any output. What may cause this problem?

BR
Tomasz

2

MQTT analysis isn't enabled by default, you can `@load
policy/protocols/mqtt` to enable it.

    $ zeek -r mqtt_packets_tcpdump.pcap protocols/mqtt
    $ ls mqtt_*.log
    mqtt_connect.log mqtt_publish.log mqtt_subscribe.log

- Jon