...
F1 04 02 4A 10 FF 01 00 06 00 07 07 08 FD FF 04 01 01 03 00 00 81 03 [RHASerialRawFrame]
[16:52:17]: F1 04 03 4A 02 00 07 5A 00 [RHAZDOSendStatus]
[16:52:17]: F1 04 05 CF 0B 51 99 06 80 07 05 00 51 99 01 01 4B 03 [RHAZDOResponseReceived]
[16:52:17]: F1 04 05 D0 0B 00 00 06 80 07 05 00 00 00 01 01 78 01 [RHAZDOResponseReceived]
[16:52:17]: F1 04 05 D1 0B 1E 25 06 80 07 05 00 1E 25 01 01 FF 01 [RHAZDOResponseReceived]
Another, more complicated, method involves using the LQI Table Request to get a list of nodes that the Coordinator knows about, and then recursively doing the same for every node in that table, until you've "spidered" out and discovered all the unique nodes over the network.
An LQI Table Request is a ZDO command, Mgmt_Lqi_req (0x0031). When the Coordinator comes across a router capable device that it doesn't know about(doesn't know what children or neighbours the device has), it can issue the request to this device and get the children and neighbour list of this device. It continues this cycle until it knows about all devices on the network.