Meshport
Four districts, one MQTT broker. Capture it in clear text, then corroborate the one alert with a physical tail.
Meshport is the estate lab of Logfall, built around a smart city that reports itself entirely through telemetry and nothing on it can be touched by hand.
Four district field gateways — water, traffic, air and power — publish sensor and actuator state as MQTT clients into a single MeshGate broker on port 1883. A ShockSCADA city platform subscribes to it, a Zeek sensor watches it from a mirror port, and a Tidal Collector pair carries syslog across the DMZ into a Splunk SIEM. Every message in the city crosses that one broker, and by default it checks nothing about who is talking. Behind the DMZ router sits an enterprise edge of IT hosts — a file share, network gear, a mail relay and a DNS server — with Pentest Fury on both sides of the boundary.
Users map the estate and record which segments have a sensor and which are blind, capture MQTT on the wire and read topic, payload, QoS and the retain flag in clear text, work the alert queue to find the one alert with a physical tail, and trace a single log from the sensor into the Splunk index to confirm its fields parsed. From there they enumerate the enterprise edge, publish an unauthorised value onto the broker and watch detections fire, then reconstruct the whole incident from edge reconnaissance to the pump that actually moved.
Meshport reports itself the way a city always has — through wires nobody sees, into a room nobody visits until something goes wrong.
Four districts publish into MeshGate: water pressure, traffic queue length, air quality, power load. The broker does not care which district a message came from, or whether the client publishing it should be trusted. It only cares that the topic and the payload arrived.
Signal Warden Priya has watched analysts stare at a wall of green telemetry and call it safe, because nothing in the log said otherwise. She has watched considerably fewer of them ask what the log would look like if somebody else published to that topic instead.
That question is what Meshport exists to teach: not that the broker lied, but that it never promised the truth in the first place.
"The broker does not ask who you are. It only asks whether you published to the right topic. Everything after that is corroboration, not trust."