Definition
WebSocket (RFC 6455) is a TCP-based full-duplex communication protocol that establishes a persistent connection through the HTTP Upgrade handshake (Upgrade: websocket, Sec-WebSocket-Key, etc.). Afterward, both parties can send frames at any time without a request-response pattern. Compared with HTTP polling, WebSocket has low latency, small header overhead (only 2–14 bytes per frame), and no connection establishment overhead, making it suitable for IoT real-time monitoring, device control, instant messaging, real-time dashboards, and other scenarios.
Protocol and Frame Format
After the WebSocket handshake, data is transmitted in frames, which include an opcode (Opcode: text/binary/close/ping), a mask (mandatory from client to server), and payload length. Subprotocol negotiation is supported, such as mqtt, wamp. Ping/Pong frames are used for keep-alive (Heartbeat) to detect connection status. Based on TCP, TLS can be layered for WSS encryption.
Comparison with MQTT and HTTP/2
MQTT is message-oriented for publish-subscribe, with semantics like Broker, Topic, QoS; WebSocket is a transport-layer protocol without business semantics. HTTP/2 supports multiplexing and server push but is still a request-response model. WebSocket is suitable for scenarios requiring bidirectional real-time streams (such as real-time monitoring, device consoles), while MQTT is suitable for device-to-cloud messaging; the two can be combined, such as MQTT over WebSocket.
Web applications on the SimtoLink cloud platform, such as the console and real-time monitoring dashboard, use WebSocket to achieve real-time pushing of device status and alerts, avoiding latency and bandwidth waste caused by polling. Devices can establish long connections with the platform through WebSocket, and use MQTT over WebSocket to enable device access in constrained environments. SimtoLink's IoT SIM cards provide devices with a stable network, ensuring WebSocket connections remain uninterrupted.
Frames on One TCP Connection Are Not One Application Message
The technical meaning of WebSocket begins only after the handshake ends. HTTP Upgrade merely turns this TCP connection from request and response into a frame channel: the client sends Sec-WebSocket-Key, the server returns Sec-WebSocket-Accept, and the bytes after that are no longer parsed as HTTP headers. The frame header uses an opcode to mark text, binary, continuation, close, Ping, or Pong. One application message may be assembled from several frames. Only the first frame carries the real opcode; the frames after it are marked as continuation. If the receiver cuts packets on the rule that one read event equals one command, it will treat half a JSON object as a complete message, or split two frames that arrived stuck together.
Masking is not encryption. The specification requires frames from the client to the server to be masked, and frames from the server to the client must not be masked, so a faulty intermediate cache does not treat uplink data as a cacheable HTTP body. A browser applies the mask on its own. A hand-written stack on a module or gateway that omits the mask bit is closed by the peer as a protocol error. If the server wrongly masks what it sends down, the browser rejects those frames. Confidentiality comes from the outer TLS, which is wss on the interface. The frame format is the same as cleartext ws; the frames are only wrapped inside TLS records.
This channel also carries no subscription, offline queue, or quality-of-service level. A subprotocol is only an application name declared in the Sec-WebSocket-Protocol handshake header. To run MQTT on the same connection, the server may choose only a name the client offered. It cannot introduce a name the client never proposed. If none of them match, the handshake should fail, rather than dropping to a bare channel and hoping it works. WebSocket therefore solves a transport problem: the browser or gateway, and the server, may each speak first. Topics, acknowledgements, and retransmission are either defined by the application or handed to a subprotocol already agreed.
When a Two-Way Channel Is Worth a Long Connection
It is worth keeping when a page or gateway must both receive status the server pushes on its own and send operations back at any time, and when the path in between allows Upgrade and will hold this TCP connection for a long time. A monitoring wall, a remote debug console, and a maintenance session that watches and issues commands at the same time belong in this class. If a device only reports every few minutes and does not need the server to insert a command in between, a short request, or CoAP on a constrained node, is a better fit. There is no reason to pay a TCP handshake, a TLS handshake, and the upgrade round trip on every power-up.
The connection has to outlive the shortest idle reclaim on the path. Load balancers, enterprise proxies, and cellular address translation all tear a mapping down after a stretch with no bytes, while the local socket still shows connected until the next write fails. Ping frames should be shorter than the idle limit measured on this path, and the peer must answer with Pong. An application line that prints “connected” does not replace keepalive. If the interval sits right on the proxy cutoff, the link comes and goes. Reconnects on the cellular side also need to be staggered, so modules under the same base station do not all start the upgrade handshake together when the network returns.
It also cannot stand in for a messaging protocol that has queue semantics, and it is a poor place to mix many unrelated bulk transfers on one connection. WebSocket rides a single TCP connection. When one firmware block occupies the send window, alert frames already generated behind it have to wait. That is head-of-line blocking. If the traffic is several independent streams on a lossy mobile network, QUIC, which acknowledges each stream on its own, is often a better fit. Putting MQTT inside WebSocket matters only when the path must cross a proxy that allows HTTPS alone. When a module can connect directly to the broker port, the extra upgrade is only one more place for the handshake to fail.
The Socket Is Still Up, but the Push Has Stopped
A TCP acknowledgement only means the bytes have entered the kernel buffer. When a server thread is blocked by a slow consumer, the device still receives acknowledgements and keeps sampling, while the platform never sees the data. A successful return from send is not proof that a command has been carried out. The application needs its own sequence numbers or replies. A close should send a close frame and carry a reason. Normal completion, the endpoint leaving, a message that is too large, and a policy rejection mean different things. Tearing TCP down directly leaves the peer half-open, and the proxy slot held by the old connection may still be taken when the client reconnects.
Errors at frame level are harder to see. A text frame must be valid UTF-8. Stuffing sensor binary into a text frame is disconnected at the check, and the symptom looks like a random drop. Control frames cannot be split. The payload carried on Ping must appear unchanged in Pong; if a device in the middle rewrites that payload, keepalive is judged to have failed. When a single frame or a whole message exceeds the server limit, the peer refuses it with a close frame. If the client retries without a bound, it fills the handshake path. Compression per message can shrink JSON, but on a gateway whose CPU is already tight it can push keepalive past the timeout.
If authentication sits only in a cookie on the upgrade request, or in a token on the first packet, the connection inherits that identity once the handshake succeeds. Token expiry does not tear the connection down unless the application checks again or closes it on purpose. A browser on a shared desk, or a debug proxy that has been forwarded outward, can keep using a connection that is already upgraded. On reconnect, the device also must not reuse the previous Sec-WebSocket-Key. Every new handshake needs a fresh random value. Replaying an old upgrade request is rejected under the specification.