# Constrained Application Protocol (CoAP)

## Port: 5683

## Proto: UDP

## Amplification factor: ~20x

---

Other ".well-known/core" resource retrieval request constructions (UID bit changes):

- `40017d70bb2e77656c6c2d6b6e6f776e04636f7265`
- `400101cebb2e77656c6c2d6b6e6f776e04636f7265`
- `40017257bb2e77656c6c2d6b6e6f776e04636f7265`
- `40014b70bb2e77656c6c2d6b6e6f776e04636f7265`
- `40016570bb2e77656c6c2d6b6e6f776e04636f7265`
- `40010101bb2e77656c6c2d6b6e6f776e04636f7265`
- `40015477bb2e77656c6c2d6b6e6f776e04636f7265`

All ".well-known/core" query responses are the same and will be 989 or 991 bytes.

### Example Request / Response

- Californium CoAP RFC Version Request: `44010f3cd19796c1c13cff0000`
  - `D<ї���<�`
- Hex Response: 458 bytes (not incl headers)
  - ` `

### Documentation

- Cf Core CoAP implementation: <https://www.eclipse.org/californium/>
  - Potential vendor for Cf Core enabled-by-default devices: <https://qlinkwireless.com/>

### Mitigations

- Well known responses are 989 or 991 bytes exactly and will contain Ascii `/.well-known/core`
- RFC version request reponses are 458 bytes exactly and will contain Ascii `CoAP RFC 7252`
