Zigbee Communication with Network Coordinator with Light Switch

[NikhilVV]

Hi,

Am Implementing Zigbee on NRF52840 chip with help of VS Code.

Zigbee Stack : 2.5.2

I configured nrf52840 DK as Zigbee network coordinator and another custom made board which having nrf52840 configured as Zigbee light switch.

I Established connection and created Binding between both. But am not able to communicate with Light Switch from Coordinator through ZCL Commands.

Please find the attached document which i tried in shell command.

1) How to establish communication between network coordinator with end device or router using Zigbee.

please guide me to solve the issue.

2) What is the Traffic Key Zigbee coordinator Example using ? where can we change (API To change traffice Key) it?

Fullscreen JCG vs NRF DK Log-4 april 2024.txt Download

I: nRF5 802154 radio initialized
*** Booting nRF Connect SDK v2.5.2 ***
I: Starting ZBOSS Coordinator example
I: ZBOSS Coordinator example started


uart:~$ E: Zigbee shell endpoint: 1 is not registered.
I: Production configuration is not present or invalid (status: -1)
I: Zigbee stack initialized
I: Device started for the first time
I: Start network formation
I: Unimplemented signal (signal: 54, status: 0)
I: Network formed successfully, start network steering (Extended PAN ID: f4ce365044756cb7, PAN ID: 0xb435)
I: Unimplemented signal (signal: 54, status: 0)
I: Allow pre-Zigbee 3.0 devices to join the network
I: Network steering started

  bdb                clear              device             devmem
  flash              help               history            kernel
  nbr                nrf_clock_control  resize             retval
  sensor             shell              version            zcl
  zdo
uart:~$ bdb role set zc
role: wrong parameter count
role - Set/get role.
Subcommands:
  zc   :Set Coordinator role.
  zed  :Set End Device role.
  zr   :Set Router role.
uart:~$ bdb role
zc
Done
uart:~$ bdb start
Done
uart:~$ I: Unimplemented signal (signal: 54, status: 0)
I: Allow pre-Zigbee 3.0 devices to join the network
I: Network steering started
I: Network steering finished
I: Unimplemented signal (signal: 54, status: 0)
I: Network steering finished
I: nRF5 802154 radio initialized
*** Booting nRF Connect SDK v2.5.2 ***
I: Starting ZBOSS Coordinator example
I: ZBOSS Coordinator example started


uart:~$ E: Zigbee shell endpoint: 1 is not registered.
I: Production configuration is not present or invalid (status: -1)
I: Zigbee stack initialized
I: Device started for the first time
I: Start network formation
I: Unimplemented signal (signal: 54, status: 0)
I: Network formed successfully, start network steering (Extended PAN ID: f4ce365044756cb7, PAN ID: 0x7a66)
I: Unimplemented signal (signal: 54, status: 0)
I: Allow pre-Zigbee 3.0 devices to join the network
I: Network steering started
bdb start
Done
uart:~$ I: Unimplemented signal (signal: 54, status: 0)
I: Allow pre-Zigbee 3.0 devices to join the network
I: Network steering started
bdb roI: Device update received (short: 0x9153, long: f4ce369e3f3451ab, status: 1)
lI: New device commissioned or rejoined (short: 0x9153)
I: Joining period extended.
eI: Device authorization event received (short: 0x9153, long: f4ce369e3f3451ab, authorization type: 1, authorization status: 0)
I: Unimplemented signal (signal: 54, status: 0)

  bdb                clear              device             devmem
  flash              help               history            kernel
  nbr                nrf_clock_control  resize             retval
  sensor             shell              version            zcl
  zdo
uart:~$ zdo match_desc 0xfffd 0xfffd 0x0104 1 0 0
Sending broadcast request.

src_addr=9153 ep=1
uart:~$ zdo ieee_addr 9153
f4ce369e3f3451ab
Done
uart:~$ zdo eui64
f4ce365044756cb7
Done
uart:~$ zdo mgmt_bind 9153
[idx] src_address      src_endp cluster_id dst_addr_mode dst_addr         dst_endp
Total entries for the binding table: 0
Done
Done
uart:~$ zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 2 0 3 0
on: wrong parameter count
on - Create bind entry.
     Usage: on <h:source_eui64> <d:source_ep> <h:destination_addr>
     <d:destination_ep> <h:source_cluster_id> <h:request_dst_addr>
uart:~$ zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 2 0 3I: Network steering finished
zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 I: Network steering finished
I: Unimplemented signal (signal: 54, status: 0)
zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 0x0000 9153
Done
uart:~$ zdo mgmt_bind 9153
[idx] src_address      src_endp cluster_id dst_addr_mode dst_addr         dst_endp
[  0] f4ce369e3f3451ab        1       0000           003 f4ce365044756cb7      010
Total entries for the binding table: 1
Done
uart:~$ zcl attr read 9153 1 0x0000 0x0104 0
Error: Request timed out
uart:~$ zdo match_desc 0xfffd 0xfffd 0x0104 1 0 0
Sending broadcast request.

src_addr=9153 ep=1
Done
uart:~$ zcl attr read 9153 1 0x0000 0x0104 0x00 0x21 0x0F
read: wrong parameter count
read - Send Read Attribute Zigbee command.
       Usage: read <h:dst_addr> <d:ep> <h:cluster> [-c] <h:profile> <h:attr_id>
       -c switches the server-to-client direction.
       h: is for hex, d: is for decimal.
uart:~$ zcl attr write 9153 1 0x0000 0x0104 0x00 0x21 0x0F
Error: Request timed out
uart:~$ I: Enter identify mode
zdo nwk_addr f4ce365044756cb7
Error: Network address request timed out
uart:~$ zdo match_desc 0xfffd 0xfffd 0x0104 1 0 0
Sending broadcast request.

src_addr=9153 ep=1
Done
uart:~$ zdo match_desc 0xfffd 0xfffd 0x0104 1 0 0I: Find and bind target finished (status: 0)
zdo simple_desc_req 9153 1
Sending broadcast request.

src_addr=9153 ep=1
uart:~$ zdo simple_desc_req 0x9153 1
src_addr=0x9153 ep=1 profile_id=0x0104 app_dev_id=0x104 app_dev_ver=0x0 in_clusters=0x0000,0x0003 out_clusters=0x0003,0x0005,0x0004,0x0006,0x0008 
Done
Done
uart:~$ zdo cmd f4ce369e3f3451ab 1 0x0008 -p 0x0104 0x00 -l 0affff
zdo - ZDO manipulation.
Subcommands:
  active_ep        :Send active endpoint request.
                    Usage: active_ep <h:16-bit destination_address>
  simple_desc_req  :Send simple descriptor request.
                    Usage: simple_desc_req <h:16-bit destination_address>
                    <d:endpoint>
  match_desc       :Send match descriptor request.
                    Usage: match_desc <h:16-bit destination_address>
                    <h:requested address/type> <h:profile ID> <d:number of input
                    clusters> [<h:input cluster IDs> ...] <d:number of output
                    clusters> [<h:output cluster IDs> ...] [-t | --timeout
                    d:number of seconds to wait for answers]
  nwk_addr         :Resolve EUI64 address to short network address.
                    Usage: nwk_addr <h:EUI64>
  ieee_addr        :Resolve network short address to EUI64 address.
                    Usage: ieee_addr <h:short_addr>
  eui64            :Get/set the eui64 address of the node.
                    Usage: eui64 [<h:eui64>]
  short            :Get the short address of the node.
  bind             :Create/remove the binding entry in the remote node.
  mgmt_bind        :Get binding table (see spec. 2.4.3.3.4)
                    Usage: <h:short> [d:start_index]
  mgmt_leave       :Perform mgmt_leave_req (see spec. 2.4.3.3.5)
                    Usage: mgmt_leave <h:16-bit dst_addr> [h:device_address
                    eui64] [--children] [--rejoin]
                    --children - Device should also remove its children when
                    leaving.
                    --rejoin - Device should rejoin network after leave.
  mgmt_lqi         :Perform mgmt_lqi request.
                    Usage: mgmt_lqi <h:short> [d:start index]
uart:~$ zdo
zdo - ZDO manipulation.
Subcommands:
  active_ep        :Send active endpoint request.
                    Usage: active_ep <h:16-bit destination_address>
  simple_desc_req  :Send simple descriptor request.
                    Usage: simple_desc_req <h:16-bit destination_address>
                    <d:endpoint>
  match_desc       :Send match descriptor request.
                    Usage: match_desc <h:16-bit destination_address>
                    <h:requested address/type> <h:profile ID> <d:number of input
                    clusters> [<h:input cluster IDs> ...] <d:number of output
                    clusters> [<h:output cluster IDs> ...] [-t | --timeout
                    d:number of seconds to wait for answers]
  nwk_addr         :Resolve EUI64 address to short network address.
                    Usage: nwk_addr <h:EUI64>
  ieee_addr        :Resolve network short address to EUI64 address.
                    Usage: ieee_addr <h:short_addr>
  eui64            :Get/set the eui64 address of the node.
                    Usage: eui64 [<h:eui64>]
  short            :Get the short address of the node.
  bind             :Create/remove the binding entry in the remote node.
  mgmt_bind        :Get binding table (see spec. 2.4.3.3.4)
                    Usage: <h:short> [d:start_index]
  mgmt_leave       :Perform mgmt_leave_req (see spec. 2.4.3.3.5)
                    Usage: mgmt_leave <h:16-bit dst_addr> [h:device_address
                    eui64] [--children] [--rejoin]
                    --children - Device should also remove its children when
                    leaving.
                    --rejoin - Device should rejoin network after leave.
  mgmt_lqi         :Perform mgmt_lqi request.
                    Usage: mgmt_lqi <h:short> [d:start index]
uart:~$ zdo active_ep 0x9153
src_addr=9153 ep=1 
Done
uart:~$ zcl cmd f4ce369e3f3451ab 1 0x0008 -p 0x0104 0x00 -l 0affff
Error: Request timed out
uart:~$ zdo ping f4ce369e3f3451ab 30
zdo - ZDO manipulation.
Subcommands:
  active_ep        :Send active endpoint request.
                    Usage: active_ep <h:16-bit destination_address>
  simple_desc_req  :Send simple descriptor request.
                    Usage: simple_desc_req <h:16-bit destination_address>
                    <d:endpoint>
  match_desc       :Send match descriptor request.
                    Usage: match_desc <h:16-bit destination_address>
                    <h:requested address/type> <h:profile ID> <d:number of input
                    clusters> [<h:input cluster IDs> ...] <d:number of output
                    clusters> [<h:output cluster IDs> ...] [-t | --timeout
                    d:number of seconds to wait for answers]
  nwk_addr         :Resolve EUI64 address to short network address.
                    Usage: nwk_addr <h:EUI64>
  ieee_addr        :Resolve network short address to EUI64 address.
                    Usage: ieee_addr <h:short_addr>
  eui64            :Get/set the eui64 address of the node.
                    Usage: eui64 [<h:eui64>]
  short            :Get the short address of the node.
  bind             :Create/remove the binding entry in the remote node.
  mgmt_bind        :Get binding table (see spec. 2.4.3.3.4)
                    Usage: <h:short> [d:start_index]
  mgmt_leave       :Perform mgmt_leave_req (see spec. 2.4.3.3.5)
                    Usage: mgmt_leave <h:16-bit dst_addr> [h:device_address
                    eui64] [--children] [--rejoin]
                    --children - Device should also remove its children when
                    leaving.
                    --rejoin - Device should rejoin network after leave.
  mgmt_lqi         :Perform mgmt_lqi request.
                    Usage: mgmt_lqi <h:short> [d:start index]
uart:~$ zcl ping f4ce369e3f3451ab 30
Error: Request timed out after 9900 ms.
uart:~$ zdo mgmt_bind 9153
[idx] src_address      src_endp cluster_id dst_addr_mode dst_addr         dst_endp
[  0] f4ce369e3f3451ab        1       0000           003 f4ce365044756cb7      010
Total entries for the binding table: 1
Done
uart:~$ zdo cmd f4ce369e3f3451ab 1 0x0008 -p 0x0104 0x00 -l 0affff
zdo - ZDO manipulation.
Subcommands:
  active_ep        :Send active endpoint request.
                    Usage: active_ep <h:16-bit destination_address>
  simple_desc_req  :Send simple descriptor request.
                    Usage: simple_desc_req <h:16-bit destination_address>
                    <d:endpoint>
  match_desc       :Send match descriptor request.
                    Usage: match_desc <h:16-bit destination_address>
                    <h:requested address/type> <h:profile ID> <d:number of input
                    clusters> [<h:input cluster IDs> ...] <d:number of output
                    clusters> [<h:output cluster IDs> ...] [-t | --timeout
                    d:number of seconds to wait for answers]
  nwk_addr         :Resolve EUI64 address to short network address.
                    Usage: nwk_addr <h:EUI64>
  ieee_addr        :Resolve network short address to EUI64 address.
                    Usage: ieee_addr <h:short_addr>
  eui64            :Get/set the eui64 address of the node.
                    Usage: eui64 [<h:eui64>]
  short            :Get the short address of the node.
  bind             :Create/remove the binding entry in the remote node.
  mgmt_bind        :Get binding table (see spec. 2.4.3.3.4)
                    Usage: <h:short> [d:start_index]
  mgmt_leave       :Perform mgmt_leave_req (see spec. 2.4.3.3.5)
                    Usage: mgmt_leave <h:16-bit dst_addr> [h:device_address
                    eui64] [--children] [--rejoin]
                    --children - Device should also remove its children when
                    leaving.
                    --rejoin - Device should rejoin network after leave.
  mgmt_lqi         :Perform mgmt_lqi request.
                    Usage: mgmt_lqi <h:short> [d:start index]
uart:~$ zcl cmd f4ce369e3f3451ab 1 0x0008 -p 0x0104 0x00 -l 0affff
Error: Request timed out
uart:~$ zdo simple_desc_req 0x9153 10
Error: Simple descriptor request failed
uart:~$ zdo simple_desc_req 0x9153 1
src_addr=0x9153 ep=1 profile_id=0x0104 app_dev_id=0x104 app_dev_ver=0x0 in_clusters=0x0000,0x0003 out_clusters=0x0003,0x0005,0x0004,0x0006,0x0008 
Done
uart:~$ zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 3 
on: wrong parameter count
on - Create bind entry.
     Usage: on <h:source_eui64> <d:source_ep> <h:destination_addr>
     <d:destination_ep> <h:source_cluster_id> <h:request_dst_addr>
uart:~$ zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 3 0
Error: Incorrect destination network address for the request
uart:~$ zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 2 3 0
on: wrong parameter count
on - Create bind entry.
     Usage: on <h:source_eui64> <d:source_ep> <h:destination_addr>
     <d:destination_ep> <h:source_cluster_id> <h:request_dst_addr>
uart:~$ zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 2 0 3 0
on: wrong parameter count
on - Create bind entry.
     Usage: on <h:source_eui64> <d:source_ep> <h:destination_addr>
     <d:destination_ep> <h:source_cluster_id> <h:request_dst_addr>
uart:~$ zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 2 0 3 0
on: wrong parameter count
on - Create bind entry.
     Usage: on <h:source_eui64> <d:source_ep> <h:destination_addr>
     <d:destination_ep> <h:source_cluster_id> <h:request_dst_addr>
uart:~$ zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 3 0 0
on: wrong parameter count
on - Create bind entry.
     Usage: on <h:source_eui64> <d:source_ep> <h:destination_addr>
     <d:destination_ep> <h:source_cluster_id> <h:request_dst_addr>
uart:~$ zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 3 0 
Error: Incorrect destination network address for the request
uart:~$ zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 3
on: wrong parameter count
on - Create bind entry.
     Usage: on <h:source_eui64> <d:source_ep> <h:destination_addr>
     <d:destination_ep> <h:source_cluster_id> <h:request_dst_addr>
uart:~$ zdo bind on f4ce369e3f3451ab 1 f4ce365044756cb7 10 0x0003 9153
Done
uart:~$ zdo mgmt_bind 9153
[idx] src_address      src_endp cluster_id dst_addr_mode dst_addr         dst_endp
[  0] f4ce369e3f3451ab        1       0000           003 f4ce365044756cb7      010
[  1] f4ce369e3f3451ab        1     0x0003           003 f4ce365044756cb7      010
Total entries for the binding table: 2
Done
uart:~$ zcl attr read 9153 1 0x0003 0x0104 0
Error: Request timed out
uart:~$ zcl attr write 9153 1 0x0003 0x0104 0x00 0x21 0x0F
Error: Request timed out
uart:~$ 
uart:~$ 
uart:~$ 

[Amanda Hsieh]

Hi, 

1. Could you use Zigbee: Shell to run as coordinator to test?

2. See this post.

Regards,
Amanda H.

[NikhilVV]

hi,

Thank you for your feedback.

1. I configured Zigbee Shell example Proj.conf as follows.

//CONFIG_ZIGBEE_ROLE_ROUTER = y

CONFIG_ZIGBEE_ROLE_COORDINATOR = y

Does i need to modify anything else in source code ?

Because i tried to steering and device is not connecting with it.

2. Can u tell by default which key it is using in Network Coordinator Sample?

3. I like to ask regarding Attribute Type and Attribute ID .

is it generating dynamically or pre-configured?

when coordinator generate or receive or know attribute id and type of end device cluster.

how can i know attribute id and type of end device ?

Regards,

Nikhil.

[Amanda Hsieh]

Hi, 

Q1a.
See the example here and here.  

There is also some information about this in the documentation here: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/zboss/3.11.3.0/using_zigbee__z_c_l.html#process_zcl_cmd

Q1b. 

If you mean Zigbee packets in general then this is handled internally by the stack and is not visible to the application.

2) The packets in the sniffer log are encrypted. Please share the network key or capture a new sniffer log where they start the sniffer before the coordinator starts the network.

Q3a.

You should be able to handle this in the ZCL handler

[NikhilVV]

HI,

I tried to capture the traffic using sniffer tool which is not working well. Bit slow to start and capturing logs.

I have compared the previous captured pcap data which i uploaded in previous post with Captured data on Simplicity Studio which also posted in previous post as Image.

while comparing i have found that the zigbee packets are same as pcap. So i am posting here the full packet which i received on other device which act as sniffer for reference.

Please check the packet data and let me know how can i handle the packet in Shell or Coordinator sample.

_nikhil

[Amanda Hsieh]

Hi, 

NikhilVV said:

I tried to capture the traffic using sniffer tool which is not working well.

Here is the guide for nRF Sniffer for 802.15.4. Please create a new support case if it doesn't work. 

NikhilVV said:

Please check the packet data and let me know how can i handle the packet in Shell or Coordinator sample.

It's hard for us to analyze the issue without the proper sniffer log. Please share the network key or capture a new sniffer log where they start the sniffer before the coordinator starts the network. 

-Amanda H.

[NikhilVV]

Hi,

I have followed the same steps which is mentioned in link to capture the sniffer log but when i starting wireshark it taking time to capture the packet and before that coordinator get start.

You can check the image which i uploaded in previous post in which all frames are clearly visible including the Data bytes in Hex. 

we are not modified the Network key using default key "zigbee alliance 09 " .

if compare with Pcap log vs image you can see that all packet till APS Frame (Zigbee cluster Library) are same. ie IEEE 802.15.4 , zigbee network , zigbee network security and Zigbee application support  are same. But due to encryption zigbee cluster library packets are not visible to compare in pcap. So we are using the Other platform sniffer to observe data. 

Please find data bytes details of ZCL Frame.

ZCL Frame Control : 0x05

Manufacture Code : 0x1002

Sequence Number : 0x73

Command Identifier  : 0x01

Application PayLoad :

0x00 0x00 0x00 0x02 0x14 0x00 0x03 0x01 0x4F 0x00 0x14 0x01 0xAD 0x1A

0xAC 0x40 0x05 0x2C 0x67 0xF2 0x40 0xA3 0x00 0x01 0x00 0x01 0x0A 0x4C

Hope these information helps you.

_Nikhil

[Amanda Hsieh]

Hi, 

NikhilVV said:

we are not modified the Network key using default key "zigbee alliance 09 " .

I have the Zigbee alliance 09 key in Wireshark, so your network is not using that as the Trust Center link key, as then I would be able to see the content of the packets. 

The zigbee alliance 09 key is used for the first Transport Key packet, before the device has been commissioned to the network, like here (this is from a different sniffer log):

But this is not the actual network key, or Trust Center Link Key, as that will be one the ZC has randomly generated (unless you have specified one using e.g. shell commands).

After the device has been fully commissioned it will start using the actual network key, as you can see here (from the same sniffer log as the previous screenshot):

If you can see the actual frames, then it should be possible for you to get the network key from the Zigbee security header. It would be the same key as in my last screenshot.

Another option is to manually set a network key on the ZC before starting the network, using for example bdb nwkkey, and then share the network key so we can decrypt the packets. But then you have to collect new logs anyway. 

-Amanda H.

[NikhilVV]

hi,

I understand that zigbeeAlliance 09 key is exchanging at starting of network formation and TC Link key exchange for data exchange.

i captured the sniffer from before coordinator start but still i did not find the TC Link key exchange frame in Wireshark. attaching herewith the captured sniffer logs for reference.

zigbee_ch16_Log.pcapng

zigbee_APS.pcapng 

please check the above logs and confirm.

[Amanda Hsieh]

Hi, 

The key doesn't work. 

Are you using install codes? If you are using install code, the packets will be encrypted even if having the network key in Wireshark. Could you turn off the feature and provide the log again?

-Amanda H.

[NikhilVV]

Hi,

i did not get u what it mean by install codes.

How to differentiate it ?

Who will generate Transport key or who holds the key in zigbee network.  does the coordinator or end device?

which feature u want to turn off and how.?

Can u tell the settings of wireshark which i need to config.

please find the transport key packet decrypted from other sniffer tool.

[Amanda Hsieh]

Hi, 

I tried with all the possible network keys I could find in all screenshots, both normal and reverse, but none of them worked. So the only suggestions I have are

• If you can see the content of the packets, if you open the sniffer log in Wireshark or if it's only in Simplicity Studio
• Verify that the screenshots showing the network key are from the same sniffer logs as you have uploaded. When the coordinator creates the network, it will generate a network key, so if the screenshots are from different tests with other networks, then the network key will not be the same. 
  Additionally, the network key should be part of the Zigbee Security Header in the Zigbee Network Layer, as in the following screenshot that I sent previously, so it would be nice to verify whether they see a Zigbee Security Header with a network key in your sniffer log

 

• Collect new sniffer logs of the issue where you have manually set the network key. The network key must be set before the Zigbee stack is started. You can either set it in the code using zb_secur_setup_nwk_key() or if you are using Zigbee shell as coordinator you can set it with the shell command bdb nwkkey.
  Then share the sniffer log and the network key you set manually in the ticket.

NikhilVV said:

I have followed the same steps which is mentioned in link to capture the sniffer log but when i starting wireshark it taking time to capture the packet and before that coordinator get start.

You can just start the sniffer log earlier, no need to wait to start it until the coordinator starts up. 

-Amanda H.