How do I discover all the Nodes on the network?

Owned by Doug Alguire (Deactivated)
Last updated: Mar 06, 2018 by Luke Tutty (Unlicensed)

There are a few ways of doing this. The simplest and most effective way is to send out a Match Descriptor Request, which will return a list of nodes that implement a specific cluster.
The Zigbee specifications require some clusters, such as the Basic cluster, to be implemented in all devices. Therefore, the Match Descriptor Request can be used to request all nodes that implement the Basic cluster.

Send the Match_Desc_req command by issuing a custom ZDO Message. See below for an example of how to do that in RapidConnect Desktop:

First, create a ZDO Message Broadcast Frame (Primary Header 04, Secondary Header 02) to broadcast the request to every device on the network. Every device that implements the cluster you're asking for will send its own response. You can refer here to see what the first 8 bytes in the payload refer to (highlighted in blue below).
The rest of the payload (highlighted in green) is for the Match_desc_req command (ID 0x0006), whose details are available in the ZigBee Spec document (download from the ZigBee website here at the bottom of the page). You can also refer to the spec to see what the Response payloads are comprised of (Match_desc_rsp, ID 0x8006).
The request is in bold, and in all the responses, the Node ID's in the payload are red:

F1 04 02 4A 10 FF 01 00 06 00 07 07 08 FD FF 04 01 01 03 00 00 81 03  [RHASerialRawFrame]

[16:52:17]: F1 04 03 4A 02 00 07 5A 00  [RHAZDOSendStatus]

[16:52:17]: F1 04 05 CF 0B 51 99 06 80 07 05 00 51 99 01 01 4B 03  [RHAZDOResponseReceived]

[16:52:17]: F1 04 05 D0 0B 00 00 06 80 07 05 00 00 00 01 01 78 01  [RHAZDOResponseReceived]

[16:52:17]: F1 04 05 D1 0B 1E 25 06 80 07 05 00 1E 25 01 01 FF 01  [RHAZDOResponseReceived]

Another, more complicated, method involves using the LQI Table Request to get a list of nodes that the Coordinator knows about, and then recursively doing the same for every node in that table, until you've "spidered" out and discovered all the unique nodes over the network.

An LQI Table Request is a ZDO command, Mgmt_Lqi_req (0x0031). When the Coordinator comes across a router capable device that it doesn't know about(doesn't know what children or neighbours the device has), it can issue the request to this device and get the children and neighbour list of this device. It continues this cycle until it knows about all devices on the network.

Legal Notices

Copyright © 2020 MMB Networks, Inc. All rights reserved.
Confidential materials prepared and delivered by MMB Networks for receipt and review only by any partner subject to a valid and enforceable MMB Networks confidentiality agreement. Any receipt, review, or misuse of any of the content exchanged hereunder by any party not a party to this confidential exchange shall be subject to any and all rights available under the law. All rights, title and interest to the materials shall remain with MMB Networks.
Any suggestions provided to MMB Networks with respect to MMB Networks' products or services shall be collectively deemed “Feedback.” You, on behalf of yourself, or if you are providing Feedback on behalf of your employer or another entity, represent and warrant that you have full legal authority to bind such entity to these terms, agree to grant and hereby grant to MMB Networks a nonexclusive, perpetual, irrevocable, royalty free, worldwide license to use and otherwise exploit such Feedback within any MMB Networks products and services.