Z-Wave Sniffing, Zniffing And You: A Guide To Pulling Packets From Thin Air

Even if it could be built in, it would undoubtedly add a great deal of extra work to the HE system. That would affect the timing etc. Having this external means everything operates as normal or as normal as it can be. It isn't an expensive tool to add if you are having issues.

1 Like

I say built in but didn't mean it, as i agree with your next comment. I ment a way to bolt it onto the Hub. Like being able to open a port for this software to see the traffic. :slight_smile:

2 Likes

Agreed. Too bad it only runs in Windows. Something like this, packaged into a Raspberry Pi and deployed when needed could be a very inexpensive troubleshooting tool.

1 Like

If you wish to focus on one Home Network or one Source, etc, there's the tiny icons to the left of each column. It's a funnel or filter icon. Click on it and a popup allows you to limit the display.. repeat, the display.

Your two home networks are EC90... and F09A...

Click on the filter at the top left of the home Id column... and type in 'ec' (no quotes) and you'll filter the display to just that home network. The filter icon turns red to inform you that you have a filter active.

Above the pane captured, there's the row of Tools/buttons. Just left of the word Zoom is another Filter (funnel) icon and that toggles the filters you've entered.. disabling them all or enabling them all. This way you can focus on a specific conversation and then by clicking first on the display row, and then on the Filter Toggle, see the Row in context of everything else.

By the way, 9.6k is not a BAD device, it's OLD and IF it is used as a router, yes, it slows everything along that path. CRCs have at least two sources.. one is just that the device is too far from the Zniffer. The hub to device path may have 3 routes, but the Zniffer is trying to hear the most distant device.. it might get such a weak signal that it's got CRC errors. Look carefully at the next packets. If it looks like the conversation is proceeding, then it's a signal strength error and you have to either ignore or move the Zniffer (antenna) to a better spot. If the packet gets repeated, then indeed you are seeing a problem device.

2 Likes

Okay thanks for the info!!

I have no old Zwave devices left after the great purge - the flaky one identified by the zniffing was the ZW+ Nano Switch. As soon as I disabled it speeds jumped. I swapped it out with another Nano and got the same result. I now have an EnerWave hooked up (running out of switches!) and am in the process of testing. I just noticed the hot on my toggle switch may have been loose so it's possible that was what was causing the issue. I know the Nanos are generally decent.

It's kind of fun watching a Z-Wave repair via zniffing. (I am SUCH a nerd)

2 Likes

Good stuff, guys. Good information, suggestions and support here.

should the channel remain the same?
40 and 41 are contact sensors


Channel is fine. This is not Zigbee :slight_smile:

You mention device 40,41 but they are not in the screenshot. Looks like a bad repeater in there though.

Thanks, so if I find the bad repeater will it become obvious or will I have to run a repair to see improvement?

Once the bad repeater is offline you should see it right away with the sniffer. You won't need to do a repair as the sniffer is seeing all traffic.

the hard part is finding it as there was no node ID. Run the sniffer more and if you can move it around and see if you see the same traffic patterns. If you can move the sniffer around you should be able to play a hot-cold game and be able to narrow down at least the vicinity of the device or what devices are physically close by.

So the closer to the defective device the more crc errors??

I would think the closer you are, the better the RSSI would be. That is usually how I find things with sniffers.

Typically RSSI is represented as a negative number, but in that tool it is a positive number - not sure if they just dropped the negative or did something else as I don't use that tool. When represented as a negative, closer to zero=stronger signal.

1 Like

what am i looking for for a bad repeater?
what do the bracketed numbers mean in the sours/destination/data?

What are devices 30 and 55?

Also 55 is running at 9.6Kbs so you probably want to remove that device completely anyways.

What is device 15?

30 is a sleapy trv
55 is a tkb68 plug in switch/socket - edit - removed, it was close to hub as well 6ft no obstructions so might have been used for routing
15 is tkb underfloor heating

Good. That guy was running at 9.6Kbs. Did you exclude it? Leave it offline and run the sniffer for longer in that area and see what it looks like.

what does it mean then these keep poping up with "routed" in the data? same device

Here's my opinion :slight_smile:

The 2nd line shows "006(001)" and "15" in the source/destination column. It's an ACK and the Data column shows what it means... Controller 1 is trying to ack to the device (node 15) it must route thru node 6 to do it. Simple enough, but nowhere is that first packet (node 1 to node 6) displayed.. it's probably the CRC packet. The Zniffer may be too far from the Hub to correctly hear the traffic. Obviously Node 6 hears just fine.

1 Like

strange... 6 is in the loft directly about 15 which is above 1? all the way up to 2rd floor to come down to the 1st floor?

RF has no concept of building structure, rooms or such.

1 Like