What IAUdi Actually Does for IoT Observability
IoT network observability is one of those things everyone claims to understand until they try to debug a fleet of 400 devices across three different carriers and realize they have zero visibility into what the network layer is actually doing. Most people conflate monitoring with observability. Monitoring tells you a device went offline. Observability lets you ask why it went offline at 3:14 AM on a Tuesday when the MQTT broker had a reconnection storm and the cellular module fell back to 2G for 11 minutes. I tried IAUdi after my team spent three weeks chasing a phantom packet loss issue on an LoRaWAN deployment. The short version: IAUdi sits between your devices and your cloud backend and captures the full telemetry lifecycle — inbound MQTT/CoAP/HTTP traffic, cellular/LTE-M/NB-IoT modem logs, and the actual application-layer response times — all correlated to individual device sessions. It doesn't inject probes or require SDK changes on most commercial gateways, which is why it got our attention. Here's how the actual setup works.
First, you need a span point. That's either a mirrored port on your gateway, a SPAN configuration on the switch feeding the gateway uplink, or in some cases a tap module if you're still running copper. IAUdi needs to see the raw packets, not an API summary. I've seen teams try to run it behind a proxy expecting it to work from structured logs. It doesn't. The correlation engine needs timestamped packet-level data to map retransmits to application-level failures. Once the traffic is flowing into the collector, you configure your device groups. IAUdi uses fingerprinting — MAC address, IMEI, or the device certificate CN — to identity each node. You define thresholds per group. The default profiles cover standard MQTT over TLS and CoAP over DTLS. If you're running something unusual like a proprietary UDP stack with a custom framing layer, you'll need to write a decoder plugin. The documentation covers the Rust-based decoder framework, and it's honestly straightforward if you've written any parser code before. Took me about four hours to get our custom protocol recognized. The real value shows up in the session reconstruction feature. When a device reports an error, you can pull up its entire session timeline — TCP handshakes, TLS negotiation times, publish/subscribe round trips, and any retransmission events. This collapses what would normally be a three-tool investigation into one view. We went from an average incident time of 47 minutes down to about 12 for similar issues after deploying it on our NB-IoT sensor fleet.
There are some things the product doesn't handle well, and I want to be direct about them because I've hit every one. Latency injection on the tap side is real. If you're mirroring a 10 Gbps uplink from a dense cellular small cell site, the collector box needs to keep up or you'll drop packets at exactly the moment you need them most. We had this happen during a firmware rollout where 800 devices reconnected simultaneously. The collector was buffering at about 4 Gbps and we lost the critical window. The workaround was adding a secondary collector node and splitting the SPAN ports across two sites. It added about $2,400 to the initial deploy but saved us from going blind during update windows. Another limitation: IAUdi's built-in anomaly detection relies on baseline models that need roughly two weeks of clean data before they're useful. Don't expect meaningful alerts on day one. The team I work with was frustrated by this at first, but once the model converged, the false positive rate dropped to under 3 percent, which is better than what we were getting from our previous solution that used static threshold rules.
Get the Full Details
The licensing model is per-device-per-month, which sounds straightforward until you have a project with intermittent devices that come online sporadically. We found that devices spending more than 90 days in sleep mode between active sessions were still being counted toward our license quota. We raised this with their support team and they confirmed the billing includes all registered device identities regardless of active traffic. For our fleet that meant we were effectively paying for roughly 30 percent more devices than were actively connected at any given time. If you have a large idle fleet, budget accordingly or ask about a tiered pricing structure — they will talk to you about it. For deployment, the standard path is an appliance or a VM with at least 16 cores and 64 GB RAM for fleets under 5,000 devices. Beyond that, you scale out collectors and add a centralized dashboard instance. The software runs on Ubuntu Server 22.04 or later, and Docker is the recommended deployment method. Their installer script handles the database setup, which is PostgreSQL with TimescaleDB for the time-series data. That combination handles the write load fine, but you'll need to tune the retention policies yourself. The default is 90 days of high-resolution data and 1 year of aggregated metrics. If you need longer retention for compliance reasons, you can export to S3 or equivalent, but that process isn't automated out of the box. If you're currently using something like AWS IoT Device Defender combined with CloudWatch Logs Insights, or maybe Datadog's IoT package, switching to IAUdi is not a trivial migration. The data model is different enough that you'll need to rewrite your queries and dashboards. I'd recommend running a parallel evaluation for at least one production site before committing. The best test is to take a real incident — something you've dealt with before — and see how long it takes to resolve with each tool. That comparison is more informative than any benchmark they publish.
I also want to mention one edge case that almost cost us a deployment. IAUdi's certificate inspection feature parses TLS session tickets and certificates to extract device identity information. If your infrastructure uses rotating ephemeral certificates with very short validity periods — like some MDM-managed fleets do — the correlation engine can lose track of a device mid-session when the cert rotates. The workaround is enabling session continuation mode, which pins the correlation to the initial handshake credentials rather than trying to match on every certificate exchange. It's documented in the troubleshooting guide, but it's easy to miss if you're going through the quickstart. The official site is iaudi.io and they have a trial environment you can request access to. There isn't a self-serve download for the full collector — it's sold through a sales process. For smaller pilots, they do offer a limited-seat evaluation license that's worth requesting if you're evaluating against alternatives like Claroty, Nozomi, or the built-in observability stacks from the major cellular providers. Bottom line: it solves a real problem in IoT observability that most tools gloss over. The traffic reconstruction and session correlation are genuinely useful. The gaps around idle device billing, baseline warming, and high-throughput tap scenarios are real too. If your fleet is mostly active devices with moderate traffic volumes and you're tired of digging through three different logging platforms to figure out why a sensor stopped reporting, it's worth a serious look. If you're running millions of sleep-mode devices with burst traffic patterns, the cost and performance tradeoffs need more scrutiny before you commit.
