# Zeek doesn't see the MQTT traffic. **URL:** \ **Category:** Zeek\ **Created:** [April 17, 2020, 12:58pm UTC](https://community.zeek.org/t/zeek-doesnt-see-the-mqtt-traffic/6094 "2020-04-17T12:58:15Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Tomek\_Koziak](https://avatars.discourse-cdn.com/v4/letter/t/b5ac83/32.png) [@Tomek\_Koziak](https://community.zeek.org/u/Tomek_Koziak)\ **Post date:** [April 17, 2020, 12:58pm UTC](https://community.zeek.org/t/zeek-doesnt-see-the-mqtt-traffic/6094/1 "2020-04-17T12:58:15Z")
I am trying to work with the **mqtt\_publish** and the **mqtt\_connect** events\*\*.\*\* I have a mosquitto broker which is running locally on which I send messages from a sensor. I want to investigate those messages. However, I am not able to observe any values that should like c: connection. Even when I run it on the mqtt.pcap from [here](https://github.com/pradeesi/MQTT-Wireshark-Capture/blob/master/mqtt_packets_tcpdump.pcap) and again the previously mentioned events, it doesn’t produce any output. What may cause this problem? BR Tomasz ---
**Author:** ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)\ **Post date:** [April 17, 2020, 6:42pm UTC](https://community.zeek.org/t/zeek-doesnt-see-the-mqtt-traffic/6094/2 "2020-04-17T18:42:44Z")
MQTT analysis isn't enabled by default, you can `@load policy/protocols/mqtt` to enable it.     $ zeek -r mqtt\_packets\_tcpdump.pcap protocols/mqtt     $ ls mqtt\_\*.log     mqtt\_connect.log mqtt\_publish.log mqtt\_subscribe.log - Jon ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:47pm UTC](https://community.zeek.org/t/zeek-doesnt-see-the-mqtt-traffic/6094/3 "2022-05-06T15:47:13Z")