{
  "id": 16797230,
  "title": "CoAP: 2,188,380 answers for a protocol designed to be spoken to by anything",
  "url": "https://urgent.news/2026/10/27/coap-2-188-380-answers-for-a-protocol-designed-to-be-spoken-to-by",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-27T21:00:17.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jeffreyciend/coap-2188380-answers-for-a-protocol-designed-to-be-spoken-to-by-anything-28a1"
  },
  "original_language": "en",
  "account": "CoAP, also known as the Constrained Application Protocol, is a standardised protocol for devices such as sensors, meters, and building controllers. It is designed for devices that cannot handle TLS handshakes or verbose headers. CoAP uses UDP port 5683 and does not require a connection handshake or a banner, distinguishing it from port-only queries. The protocol uses multicast capability, allowing a single request to a group to be answered by every device in it. However, CoAP has no built-in authentication, relying on optional security measures like OSCORE and DTLS. The discovery resource, defined as /.well-known/core, is used for device enumeration and can reveal the full interface list of a device without requiring any credentials. This makes it a potential security risk as it allows an arbitrary source to access the full interface list of a device. The 2,188,380 figure represents the number of devices that answered a CoAP protocol probe, indicating that a large number of constrained devices are reachable at the network layer by something other than their intended client. To mitigate this risk, query your own address space for devices using CoAP and check their /.well-known/core resources to understand what the device exposes. If the device only speaks plain CoAP on a routable network, it lacks confidentiality for its commands. Finally, identify the vendor and firmware from the CoAP response options and look for vendor guidance on OSCORE support and disabling multicast responses.",
  "summary": "CoAP: 2,188,380 answers for a protocol designed to be spoken to by anything A ZoomEye query for service=\"coap\" returned 2,188,380 matches on 28 October 2026. CoAP is the Constrained Application Protocol, standardised as RFC 7252 in 2014, and it was built for devices that cannot afford TLS handshakes or verbose headers: sensors, meters, building controllers, industrial gateways. Every one of those…",
  "key_points": [
    "CoAP is a protocol for constrained devices like sensors and meters",
    "Uses UDP port 5683 without handshake or banner",
    "Discovery resource /.well-known/core reveals full device interface list"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}