Z-Wave Sniffing, Zniffing And You: A Guide To Pulling Packets From Thin Air

Thanks I'll get the STA Then

Here's a sample of what it 'pulls from the air' and a brief explanation...

Line #1 is an unsolicited message from a ZWave device (Node #42) telling the Hub (Node #1) that it has a Sensor Binary Report to make. Device#42 is an Aeon Multisensor 6 and it just detected Motion. Line #1 is showing that Node 42 has a known route back to the Hub.. Node 42 --> 39 --> 18 --> 1. Therefore, it takes 3 packets (at 9.6k) to get the motion message, to the Hub.

Starting with Line #4, the Hub ACK's the report. The path back is the same.. #1 --> 18 --> 39 --> 42 PLUS there's the ACK of the ACK in line 7.

Looking at the Delta column, all the packets are 20'ish ms apart. The message is 17 bytes, the ACK is 14 bytes. The Hub, eats an additional 10-15 ms processing.. the delta time between getting the packet and starting the ACK chain.

Selecting Line 1 and looking at the Frame details:

Is a not too interesting decode of the message contents.

Line 8 begins the 2nd unsolicited message for the SAME thing, but using the other format, a Notification format. The decode of message content is so much more interesting (not really :slight_smile: ):

One message, formatted 7 ways.

The total time (12:331 - 11:776) is 555ms or half a second.

My purpose here is to show that as magical as pulling packets from thin air sounds, it's ultra boring. :smiley:

2 Likes

The question I have is can you optimize the routes to improve the timing?

No, not really. One ZWave repair would undo anything you had cobbled together.

For the most part, Zniffer is used in a Lab environment.. where the hub and target device are a few feet apart. The intent is to have ZNiffer RELIABLY acquire both sides of the conversation so that the conversation can be decoded and (probably) coerced into working.

Yes, it can be used as I've shown above, but it happens that all 4 devices (hub, target, two intermediary nodes/routers) are in a 18' circle of the Zniffer. I'm not missing anything in the trace. If I wanted to see the packets out by my Pool, I would not necessarily see any part of the conversation. In other words, Lab is nice, easy. Real World takes a chance on being a torture. :slight_smile:

Thanks @codahq.
Received my UZB today from Mouser (No tariff surcharge).
Fired right up.

Couple of notes:
I had to down load a SDK from Silicon Labs before they would let me download "Z-Wave Programmer" and "Z-Wave Zniffer"
Took two tries to flash the stick.
The program I needed to run was ZWaveZnifferUI.exe
My path:
"E:\Program Files (x86)\Sigma Designs\Z-Wave Zniffer 4 Secured\ZWaveZnifferUI.exe"
Just trying to make it even easier for the next person.
Thanks again!

4 Likes

Very cool thanks all for the instructions - device arrived today and am up an zniffing away!! wooooooooo.. :man_dancing:

I notice some routing and crc errors. So what do I do next?

1 Like

Yikes. 1st thing you need to do is figure out what device(s) are forcing your mesh to just 9.6kb speed and throw it/them in the trash.

Unless I'm reading that wrong (which is very possible as my sniffer works/looks a little different than this one).

2 Likes

How do I correlate this report with devices on HE?

Source and destination addresses should match up with the device numbers shown on the HE zwave details page.

1 Like

Wow... definitely some older devices in that network... time to find and trash.

Thanks forgot about the Z-Wave details page.. am looking into now. Likely THIS is the cause of my issues.

I just purged all my z-wave devices. The only things left I have are MS6's, Zooz Media Power outlet, Nano Switches, Dual Nano & Dual Qubino and an EcoNet Valve.

Also have some suspect GE Door Hinge devices that are ZW+ but I don't really use them so am removing now - and running a repair.

I may disable a few as well to see what happens.. I am SO glad I got into zniffing!!!!!!

@jeubanks & @JasonJoel

Okay so this is very cool - I identified a Nano switch for my Living Room Sconces as the possible culprit and disabled. Now the network speeds at least according to zniffing are MUCH better. So my guess is that this is a bad device. wow.

@codahq was right about this being addictive - arghhhhhh!!!

4 Likes

Post another screenshot when you time, would love to see how it looks with that device removed.

I would hope you could get to 40kb. 100kb is doable sometimes, but not always.

Not sure whats happening with the yellow section but this looks a lot better than the other one...

2 Likes

Now that looks A Lot better!

1 Like

Awesome! Some nodes cap out at 40kbit, or have a low enough signal that they can't quite work at 100kb, so that isn't that uncommon.

That should make a very noticeable difference in your zwave experience though.

Nice job.

2 Likes

Yeah should make a big difference really!

Does the "Home ID" distinguish different hubs? I actually have 2 hubs that use ZW, my main one and an upstairs hub. My laptop/uzb is definitely closer to the main hub right now.

Different zwave mesh/network, yes.

4 Likes