IoT Security Testing: Intercepting DTLS and UDP Traffic with InterceptSuite

IoT devices communicate differently from web applications. Many use UDP for low-latency telemetry, DTLS (Datagram TLS) for encrypted UDP sessions, or lightweight protocols like CoAP over UDP. Standard HTTP proxies cannot intercept any of this.

InterceptSuite is one of the only tools that supports full MITM for DTLS and raw UDP - making it essential for IoT penetration testing.

Why IoT Traffic Is Hard to Intercept

HTTP proxies like Burp Suite work by sitting between the browser and server for HTTP/HTTPS. IoT devices typically:

Use UDP instead of TCP for sensor data, telemetry, and control messages
Encrypt UDP sessions with DTLS (RFC 6347) - TLS adapted for unreliable datagrams
Use lightweight protocols like CoAP (Constrained Application Protocol) over UDP
Have no proxy settings - you cannot point them at a proxy server

Traditional interception approaches (Wireshark capture, tcpdump) can see the traffic but cannot decrypt DTLS or modify packets in real-time. InterceptSuite performs active MITM - it terminates the DTLS session, exposes the plaintext, and lets you modify or replay packets before forwarding.

What InterceptSuite Intercepts for IoT

Protocol	InterceptSuite support
Raw UDP	Full intercept and modify
DTLS (any port)	Full MITM - see plaintext
CoAP over UDP	Raw payload visible; use extension to parse
DTLS + CoAP	Full decryption + raw CoAP payload
TCP-based protocols	Full intercept
TLS (non-HTTP)	Full MITM

Setup: DTLS Interception with ProxyBridge

Prerequisites

InterceptSuite with UDP/DTLS interception enabled
ProxyBridge for transparent UDP routing from the test machine

Step 1 - Enable UDP in InterceptSuite

Open InterceptSuite and go to Proxy → Proxy Settings. Confirm UDP interception is enabled alongside TCP. The SOCKS5 proxy listener (default 127.0.0.1:4444) handles both TCP and UDP connections.

Step 2 - Configure ProxyBridge for UDP

Open ProxyBridge and add proxy rules for the IoT device's target ports:

Rule 1: InterceptSuite goes direct (prevents loop)

Field	Value
Applications	`InterceptSuite.exe`
Target Ports	`*`
Protocol	UDP
Action	DIRECT

Rule 2: IoT device traffic goes through proxy

Field	Value
Applications	`*`
Target Ports	`5683; 5684` (CoAP/CoAPS)
Protocol	UDP
Action	PROXY

Adjust ports to match your target device. Common IoT UDP ports: 5683 (CoAP), 5684 (CoAP + DTLS), 1883 (MQTT), 8883 (MQTT TLS).

Step 3 - Install the CA Certificate

For DTLS interception, install the InterceptSuite CA certificate on the IoT device or test machine to prevent TLS/DTLS certificate rejection.

For embedded devices where you cannot install a CA, InterceptSuite can still intercept raw UDP (before DTLS) or you can configure the device to skip certificate verification in a test environment.

Step 4 - Capture Traffic

Run your IoT application or device communication. All UDP traffic matching your ProxyBridge rules will appear in InterceptSuite's Proxy History tab, decrypted and in plaintext.

Intercepting Without Proxy Settings (Embedded Devices)

Many IoT devices are embedded and have no proxy configuration. Two approaches:

Option 1: Route at the network level

Use ProxyBridge on your test machine to intercept outbound traffic. If the IoT device communicates through your test machine (e.g., via Wi-Fi hotspot), ProxyBridge on the gateway machine can intercept all device traffic transparently.

Option 2: ARP spoofing + ProxyBridge

On the same network as the IoT device, perform ARP poisoning to route device traffic through your test machine, then use ProxyBridge to forward it through InterceptSuite.

Parsing CoAP Messages with Extensions

CoAP packets have a compact binary header. An InterceptSuite extension can parse and display the key fields:

from InterceptSuite.Extensions.APIs.Logging import ExtensionLogger
import struct

class CoAPTab:
    CODES = {1: 'GET', 2: 'POST', 3: 'PUT', 4: 'DELETE'}

    def should_show_tab(self, data):
        raw = data.get("data", "")
        return len(raw) >= 4

    def fetchdata(self, data):
        raw = data.get("data", "")
        try:
            b = raw.encode('latin-1') if isinstance(raw, str) else raw
            ver_t_tkl = b[0]
            code = b[1]
            msg_id = struct.unpack('>H', b[2:4])[0]
            code_class = (code >> 5) & 0x7
            code_detail = code & 0x1F
            method = self.CODES.get(code, f"{code_class}.{code_detail:02d}")
            result = f"CoAP | Method: {method} | MsgID: {msg_id}\nPayload: {raw[4:]}"
            ExtensionLogger.Log(f"CoAP packet: {method} MsgID={msg_id}")
            return result
        except Exception as e:
            return f"Parse error: {e}\nRaw: {raw}"

    def updatedata(self, data):
        return None

class InterceptSuiteExtension:
    def register_interceptor_api(self, interceptor):
        interceptor.set_extension_name("CoAP Viewer")
        interceptor.set_extension_version("1.0.0")
        interceptor.AddDataViewerTab("CoAP", CoAPTab())
        ExtensionLogger.Log("CoAP Viewer loaded.")

See the Extension API reference for the full interface.

Common IoT Findings with InterceptSuite

When intercepting IoT traffic, common vulnerabilities include:

Hardcoded credentials in DTLS or CoAP payloads
Unencrypted UDP telemetry sending device state, location, or sensor data in plaintext
Insecure DTLS configuration - weak cipher suites, no certificate validation
Replay vulnerabilities - commands accepted without sequence numbers or nonces
Cleartext MQTT - broker credentials in plaintext before TLS upgrade