Discovering Devices

Owned by Luke Tutty (Unlicensed)
Last updated: Oct 23, 2019 by Tracy W (Deactivated)
4 min read

When developing a device that will operate as a Zigbee Coordinator(ZC), discovering other devices on the network will be a integral operation of the ZC Host application.

Device discovery tells the ZC the following:

  1. Network Topology:
    1. What devices are on the network
    2. Which devices are ZRs
    3. Which are ZEDs and what are their direct parents
  2. Device Information: 
    1. Device Type
    2. Supported Clusters
    3. Active Endpoints
    4. Attribute Values

The following sections will provide users with an overview of the different commands used for discovery and what each one tell the device sending the command.


ZDO Discovery Commands

Discovery commands are provided by the ZDO Specification (ZigBee Document 053474r20). Users can send ZDO commands to the Module (to be sent out over the air to a target device) by wrapping the commands in a RapidConnect Send ZDO Unicast Serial Command.

A common discovery algorithm will consist of sending & receiving the following discovery commands, allowing the Host to gather information on the devices joined to the network. 


The examples for each command given below uses the following configuration:

  • 1 x RapidConnect ZC
  • 1 x RapidConnect Dimmable Light ZR
  • RapidConnect Desktop acting as Host to RapidConnect ZC

LQI Table Request / Response (Mgmt_Lqi_req, Mgmt_Lqi_rsp)

The Mgmt_Lqi_req is generated from a Local Device wishing to obtain a neighbor list for the Remote Device along with associated LQI values to each neighbor. The destination addressing on this command shall be unicast only and the destination address must be that of a ZigBee Coordinator or ZigBee Router.

Example LQI Table Request & Response

/**
	LQI Table Request Wrapped In A Serial ZDO Unicast Command (0x04, 0x01)
**/
//Command Sent
    F1 04 01 1F 08 14 1A 31 00 04 00 01 00 90 00

//Command Breakdown
	0xF1 //Start of Frame
	0x04 //Primary Header
	0x01 //Secondary Header
	0x1F //Frame Sequence Number
	0x08 //ZDO Unicast Payload Length
	0x14 0x1A //Node ID (0x1A14)
	0x31 0x00 //Mgmt_Lqi_req command (ClusterID = 0x0031)
	0x04 //Response Options
	0x00 //TSN
	0x01 //Payload Length
	0x00 //Command Payload (StartIndex = 00)
	0x09 0x00 //Checksum

/**
	LQI Table Response Wrapped In A Serial ZDO Response Received Command (0x04, 0x05)
**/
//Command Received
	F1 04 05 B0 20 14 1A 31 80 0A 1A 00 01 00 01 1F B8 30 80 DC 8B E3 EA E7 16 0F 00 00 46 24 00 00 00 04 02 00 FF 14 09

//Command Breakdown
	0xF1 //Start of Frame
	0x04 //Primary Header
	0x05 //Secondary Header
	0xB0 //Frame Sequence Number
	0x20 //ZDO Response Received Payload Length
	0x14 0x1A //Node ID (0x1A14)
	0x31 0x80 //Mgmt_Lqi_rsp command (ClusterID = 0x8031)
	0x0A //TSN
	0x1A //Payload Length
	00 01 00 01 1F B8 30 80 DC 8B E3 EA E7 16 0F 00 00 46 24 00 00 00 04 02 00 FF //Payload
		0x00 // Status
		0x01 // Neighbour Table Entries
		0x00 //Start Index
		0x01 //Neighbour Table List Count
		1F B8 30 80 DC 8B E3 EA E7 16 0F 00 00 46 24 00 00 00 04 02 00 FF //Neighbour Table List (Table 2.127 In ZDO Spec)

Active Endpoint Request / Response (Active_EP_req, Active_EP_rsp)

The Active_EP_req command is generated from a local device wishing to acquire the list of endpoints on a remote device with simple descriptors. This command shall be unicast either to the remote device itself or to an alternative device that contains the discovery information of the remote device.

Example Active Endpoint Request & Response

/**
Active Endpoint Request
**/
//Command Sent
	F1 04 01 20 09 14 1A 05 00 04 00 02 14 1A 95 00

//Command Breakdown
	0xF1 //Start of Frame
	0x04 //Primary Header
	0x01 //Secondary Header
	0x20 //Frame Sequence Number
	0x09 //ZDO Unicast Payload Length
	0x14 0x1A //Node ID (0x1A14)
	0x05 0x00 //Active_EP_req command (ClusterID=0x0005)
	0x04 //Response Options
	0x00 //TSN
	0x02 //Payload Length
		0x14 0x1A// Network Address Of Interest ( 0x1A14 = Node ID Of Target)
/**
Active Endpoint Response
**/
//Command Received
	F1 04 05 AE 0B 14 1A 05 80 0B 05 00 14 1A 01 01 B5 01

//Command Breakdown
	0xF1 //Start of Frame
	0x04 //Primary Header
	0x05 //Secondary Header
	0xAE //Frame Sequence Number
	0x0B //ZDO Response Received Payload Length
	0x14 0x1A //Node ID (0x1A14)
	0x05 0x80 //Active_EP_rsp command (ClusterID=0x8005)
	0x0B //TSN
	0x05 //Payload Length
	0x00 0x14 0x1A 0x01 0x01 //Payload
		0x00 // Status
		0x14 0x1A// Network Address Of Interest ( 0x1A14 = Node ID Of Target)
		0x01 //Active Endpoint Count
		0x01 //Active Endpoint List

Simple Descriptor Request / Response

The Simple_Desc_req command is generated from a local device wishing to inquire as to the simple descriptor of a remote device on a specified endpoint. This command shall be unicast either to the remote device itself or to an alternative device that contains the discovery information of the remote device.

A Simple Descriptor contains information such as the:

  • Device Profile
  • Device Type
  • Input Clusters
  • Output Clusters

For a full breakdown of the Simple Descriptor please refer to Table 2.39 of the ZDO Specification (ZigBee Document 053474r20)

Example Simple Descriptor Request & Response

/**
	Simple Descriptor Request
**/
//Command Sent
	F1 04 01 21 0A 14 1A 04 00 04 00 03 14 1A 01 98 00

//Command Breakdown
	0xF1 //Start of Frame
	0x04 //Primary Header
	0x01 //Secondary Header
	0x21 //Frame Sequence Number
	0x0A //ZDO Unicast Payload Length
	0x14 0x1A //Node ID (0x1A14)
	0x04 0x00 //Simple_Desc_req command (ClusterID=0x0005)
	0x04 //Response Options
	0x00 //TSN
	0x03 //Payload Length
	14 1A 01 //Payload
		0x14 0x1A// Network Address Of Interest ( 0x1A14 = Node ID Of Target)
		0x01 //Endpoint

/**
	Simple Descriptor Response
**/
//Command Received
	F1 04 05 AF 20 14 1A 04 80 0C 1A 00 14 1A 16 01 04 01 01 01 01 06 00 00 03 00 04 00 05 00 06 00 08 00 01 0A 00 28 02 	

//Command Breakdown
	0xF1 //Start of Frame
	0x04 //Primary Header
	0x05 //Secondary Header
	0xAF //Frame Sequence Number
	0x20 //ZDO Response Received Payload Length
	0x14 0x1A //Node ID (0x1A14)
	0x04 0x80 //Simple_Desc_Rsp Command (ClusterID=0x8004)
	00 14 1A 16 01 04 01 01 01 01 06 00 00 03 00 04 00 05 00 06 00 08 00 01 0A 00 // Payload
		0x00 //Status
		0x14 0x1A// Network Address Of Interest ( 0x1A14 = Node ID Of Target)
		0x16 //Length
		01 04 01 01 01 01 06 00 00 03 00 04 00 05 00 06 00 08 00 01 0A 00 //Simple Descriptor (Table 2.39)
On This Page

In This Space

Related Content

Filter by label

There are no items with the selected labels at this time.

Legal Notices

Copyright © 2020 MMB Networks, Inc. All rights reserved.
Confidential materials prepared and delivered by MMB Networks for receipt and review only by any partner subject to a valid and enforceable MMB Networks confidentiality agreement. Any receipt, review, or misuse of any of the content exchanged hereunder by any party not a party to this confidential exchange shall be subject to any and all rights available under the law. All rights, title and interest to the materials shall remain with MMB Networks.
Any suggestions provided to MMB Networks with respect to MMB Networks' products or services shall be collectively deemed “Feedback.” You, on behalf of yourself, or if you are providing Feedback on behalf of your employer or another entity, represent and warrant that you have full legal authority to bind such entity to these terms, agree to grant and hereby grant to MMB Networks a nonexclusive, perpetual, irrevocable, royalty free, worldwide license to use and otherwise exploit such Feedback within any MMB Networks products and services.