Z-Wave Sniffing, Zniffing And You: A Guide To Pulling Packets From Thin Air

Hum wonder if I should remove my Aeon MS6s and re-pair. @erktrek did you try this with your testing? Aeotec support still hasnt come back with anything meaningful to my question about why they operate ay 9.6 speed.

I'm going to remove mine and re-include it battery powered so it doesn't repeat. I've noticed the same thing about it. It's just such a pain to create a virtual device and assign everything over that current uses it, do the exclude, include and move everything back that I haven't done it yet. Mine is used in probably 10 or 15 places and I'm being lazy.

I don't believe this is correct anyway. The repeating aspect is done by the voltage used, it's something likes IF > 4.5 volts it's DC and repeat and if < 3.5 then it's battery and don't. Was reading something the other day, I assume on the technical data sheet.

I did twice - (re)paired first with batteries (and switched over to usb after) and then pairing as straight usb again - but the results have been mixed. Still getting lots of communication at 9.6. Have not added back in all my basement sensors yet + added a Aeotec 7 repeater and am still seeing similar behavior. NOTE: I am on the latest firmware for the MS6's on all my sensors. Maybe the new fw detects power..

I do understand that there may always be some 9.6 comms depending upon the device and message but if you have all zw+ devices it should be minimal right?

Ugh glad I am not the only one. I will update my ticket again saying I know of other people with the same experience. Maybe this will help increase the priority.

2 Likes

Nope, I removed the HEM's on Friday. This is current. 059 = Zooz Water Valve, 011 = WADWAZ-1 Window Sensor.

It's a battery device that will need to clear out the routing table. As long as it's working and reporting then it's using another route which is what it's supposed to do. If it stops working then you will need to wake it up and refresh it.

Yep, the Window sensor is working completely fine.

Then it's all good :slight_smile:

I have a few devices currently giving me the "routed error" because of some major device movements I did last night. Things are working fine and I wouldn't even know about it without zniffing the network.

zniffing is great as it can help you find problems.... but it's bad too because it makes you look for problems that don't exist.

3 Likes

And likely why the "we need more troubleshooting tools" falls on deaf ears. Errors don't necessarily point to a specific problem. The Zniffer app is probably only useful after you have a better understanding your network on a physical level and what might be interfering with a good strong mesh.

2 Likes

Hi,

Thanks for your guide, but I have a few problems in installing the device. The version I have is the Euro Version.

When I open device manager, the device shows as "USB Serial Device (Com 4)". When I try to update the driver, despite pointing to the correct location, Windows is telling me "the best drivers for your device are already installed." When I check the driver, it is C;\WINDOWS\system32\DRIVER\usber.sys. I assume this is the default Windows driver, how do I force it to install zw05xxprg.inf?

Secondly, when I try to flash the driver (not sure I should be doing this yet until the first issue is resolved), there is the file you mention for the ZW050 (...USBVCP.hex), but for the ZW020 and 030 versions, there looks to be European files as well. Does the ZW050 USBVCP.hex cover all versions?

Thanks in anticipation.

Don't just supply the folder and let it try to find drivers. You have to install a device by providing the "disk" location. I'm not going to supply screenshots because I'm a phone but if you do it again just fight against going down the automatic route and you'll eventually get the option to supply a disk.

Don't try to flash until the correct driver is installed.

I don't know what firmware to use for non-US frequencies.

2 Likes

Thanks,

I thought pointing to the folder would allow the driver to be loaded as there is only one driver in this folder, but it's the second box I have to select "Let me pick...", this gives me the opportunity to select from the disk and then navigate to the same folder; anyway it worked. Now for the next stage. Thanks again.

So, having eventually got the Zniffer working I thought I'd try and analyse what was going on, the following is a Screenshot of the Zniffer showing my Aeotec TriSensor Reporting Motion:

I worked my way through various Z Wave documents and on line articles to try and analyse each line of data, adding it to a spreadsheet to work out what was going on, and got this:

I can work out quite a bit, but can't find any Z Wave documentation that explains the 2 Frame Control Fields and the 2 Header Fields (highlighted in Orange), I assume they relate to the type of transmission, i.e. singlecast or multicast and the type of message, e,g, acknowledgment. If anyone can point me in the direction of the right documents for these areas, it would be appreciated.

I am reasonably confident of the data (or most of it anyway) as the XML code for this is locatable easily on the PC (in my case at C:\Users[user]\AppData\Roaming\Sigma Designs\Z-Wave Zniffer Secured).

I also can't work out why the Notification is reported twice, Lines 1 and 2 which I assume are transfers between the routing devices and then again at Lines 6 and 7, with an extra field in the second pair. Does anyone have any ideas?

Any help appreciated.

"reported twice"

Is indeed the traffic through the repeaters.

Line 1 shows a Source of 030 and a Destination of (001) via 027

Line 2 shows a source of 027 (but having been sourced by 030) and a Destination of (001) via 006

Line 3 shows (presumably) the packet from 006 to 001, but the Zniffer is out of range.

You can see the routing under Data: Routed (30) - 27 - 6 - (1)

ZWave Frames

Zniffer shows "Transport Frame" -- the physical has no interesting elements, since they are static bytes.

3 Likes

Thanks, happy with the routing, and the concept of the Physical Frame not being shown, any idea the reason for what appears to be a repeated transmission (lines 6 and 7), with the extra field? If I am correct, the breakdown in the Excel spreadsheet is just showing the Transport Frame (I think!).

For the benefit of the community what Z-Wave frequency are you using specifically and which firmware did you flash?

I am using the Euro Frequency. The device I bought was a ACC-UZB3-E-STA which from what I can gather is the EU version of the stick; looking at the Mouser website the only difference appears to be an "E" as opposed to a "U". Other than that the drivers and firmware look to be as described right back in the first post:
Zniffer_v4_57\PC\ZW050x_USB_Programming_Driver\zw05xxprg.inf
sniffer_ZW050x_USBVCP.hex
Zniffer_v4_57/PC\uzb.inf

1 Like

Has anyone had success flashing the UZB3 back to being a controller?

Using mac with vmware fusion...i can see the device - COM4 using generic windows driver. Despite all attempts (even manually installation (legacy) and forcing the driver I want, no joy. Anybody else have this issue. Have changed ports and the same result. It thinks the windows built-in driver is the better driver. I'm still playing with it, but it's driving me nuts.