Z-Wave Sniffing, Zniffing And You: A Guide To Pulling Packets From Thin Air

[csteele]

I doubt I'd know. The Controller would correct it before I could discover it.

[mark.cockcroft]

[jeubanks]

@mark.cockcroft

I just want to prove to HE my mesh is ok

You don't want a sniffer for that. You want to run a controller where you can use the IMA tool to perform a network test. In basic terms this does a power level test between nodes to verify communications and signal strength. Here's a doc for you.
https://www.silabs.com/documents/login/user-guides/INS12712-Z-Wave-Network-Installation-maintenance-Procedures-User-Guide.pdf

[codahq]

@yannick00000

Should I stick to the STA ? what's the difference ?

I found this.
Static Controller - Development Tools - Silicon Labs
Bridge Controller - Development Tools - Silicon Labs

Other than that I don't know.

There isn't anything about it in the Z-Wave Programmer user guide either.

I guess I know that the STA works.

[codahq]

@njanda

Hey, If your up for it, could you set your stick to AUS freq. and then try to communicate with your US devices ??

It allowed me to start a trace with ANZ selected but it never saw any traffic (as it shouldn't). So, that's sort of inconclusive.

*edit: Just finished reading the topic. @csteele may have found the answer for you.

@csteele

When I set it to ANZ, I see no packets. I put it back to US and packets show as soon as I click Start Capture.

I have another device that is capable of operating at ANZ frequency and when I put it into Include, I see packets from that device. I do not see US frequency packets when set to ANZ. Therefore, I'd say it does in fact receive at multiple (settable) frequencies.

[mark.cockcroft]

Thanks for that, two nodes at 5 and 4 network health.
But I can't seem to get it to display the routing to see what they pass through.

I want to see this as there is another device 3" from it which shows network health 10

[mark.cockcroft]

Is there a way to pull the routing table out of the stick?

[zarthan]

@mark.cockcroft

Does it have to be a specific stick

I don't know if there is a specific requirement but when I had a couple of flash failures on a spare HUSBZB-1, it is now only recognized as a USB serial device.

[syepes]

Note that you can do the same thing with the classic Gen5 Z-Stick (Z-Stick Z-Wave USB antenna • Aeotec)
You just have to flash it with the same FW as the UZB..

Also note that once flashing it it won't work as controller anymore.
If you want to use it again as controller you'll have to make a backup before flashing..

[csteele]

The Aeon is too valuable (because of it's portability) to cripple as a sniffer,. I still use it as an Always Reliable Exclude Tool.

[zarthan]

All I wanted to point out is that it can go bad so be prepared to loose the device. I will get another device to try again. Although I do have an Aeotec Zstick, I like it as a secondary controller to HE.

[zarthan]

@mark.cockcroft

routing table out of the stick?

There will be multiple routes to any device. If the preferred route is unsuccessful the hub will try other known routes (something like 5 although not positive). Any command to a device could be different than the last.

[codahq]

@mark.cockcroft

Is there a way to pull the routing table out of the stick?

You can see routes as you sniff but you couldn't just pull the entire table. You can get routes by joining a secondary controller and using Z-Wave PC Controller.

[mark.cockcroft]

ive got a 2nd and using pc controller but cant seem to find them in the program or there all directly conecting to hub

[njanda]

That is awesome news.
Thanks very much for doing the testing.

[adamkempenich]

+1 for DigiKey! Sweet company in MN... I have a few friends that work there — I’d had good experiences with them for years before I even realized they were an hour away from my home town

[yannick00000]

Thanks I'll get the STA Then

[csteele]

Here's a sample of what it 'pulls from the air' and a brief explanation...

Line #1 is an unsolicited message from a ZWave device (Node #42) telling the Hub (Node #1) that it has a Sensor Binary Report to make. Device#42 is an Aeon Multisensor 6 and it just detected Motion. Line #1 is showing that Node 42 has a known route back to the Hub.. Node 42 --> 39 --> 18 --> 1. Therefore, it takes 3 packets (at 9.6k) to get the motion message, to the Hub.

Starting with Line #4, the Hub ACK's the report. The path back is the same.. #1 --> 18 --> 39 --> 42 PLUS there's the ACK of the ACK in line 7.

Looking at the Delta column, all the packets are 20'ish ms apart. The message is 17 bytes, the ACK is 14 bytes. The Hub, eats an additional 10-15 ms processing.. the delta time between getting the packet and starting the ACK chain.

Selecting Line 1 and looking at the Frame details:

Is a not too interesting decode of the message contents.

Line 8 begins the 2nd unsolicited message for the SAME thing, but using the other format, a Notification format. The decode of message content is so much more interesting (not really ):

One message, formatted 7 ways.

The total time (12:331 - 11:776) is 555ms or half a second.

My purpose here is to show that as magical as pulling packets from thin air sounds, it's ultra boring.

[nh.schottfam]

The question I have is can you optimize the routes to improve the timing?

[csteele]

No, not really. One ZWave repair would undo anything you had cobbled together.

For the most part, Zniffer is used in a Lab environment.. where the hub and target device are a few feet apart. The intent is to have ZNiffer RELIABLY acquire both sides of the conversation so that the conversation can be decoded and (probably) coerced into working.

Yes, it can be used as I've shown above, but it happens that all 4 devices (hub, target, two intermediary nodes/routers) are in a 18' circle of the Zniffer. I'm not missing anything in the trace. If I wanted to see the packets out by my Pool, I would not necessarily see any part of the conversation. In other words, Lab is nice, easy. Real World takes a chance on being a torture.