Hi @jvm33 ,
I suppose that the zigbee.readAttribute command uses the default endpoint ( ${device.endpointId} )
There is a good example for using the "he raw" command here :
Here is an example from my FP1 driver :
cmds += ["he raw 0x${device.deviceNetworkId} 0 0 0x8002 {40 00 00 00 00 40 8f 5f 11 52 52 00 41 2c 52 00 00} {0x0000}", "delay 50",]
where it simulates the node descriptor response from Aqara E1 zigbee hub:
Frame 189: 62 bytes on wire (496 bits), 60 bytes captured (480 bits) on interface \\.\pipe\zboss_sniffer_COM6, id 0
IEEE 802.15.4 Data, Dst: 0xd022, Src: 0x0000
ZigBee Network Layer Data, Dst: 0xd022, Src: 0x0000
ZigBee Application Support Layer Data, Dst Endpt: 0, Src Endpt: 0
Frame Control Field: Data (0x40)
Destination Endpoint: 0
Node Descriptor Response (Cluster ID: 0x8002)
Profile: ZigBee Device Profile (0x0000)
Source Endpoint: 0
Counter: 253
ZigBee Device Profile, Node Descriptor Response, Rev: 22, Nwk Addr: 0x0000, Status: Success
Sequence Number: 1
Status: Success (0)
Nwk Addr of Interest: 0x0000
Node Descriptor
.... .... .... .000 = Type: 0 (Coordinator)
.... .... .... 0... = Complex Descriptor: False
.... .... ...0 .... = User Descriptor: False
.... 0... .... .... = 868MHz BPSK Band: False
..0. .... .... .... = 902MHz BPSK Band: False
.1.. .... .... .... = 2.4GHz OQPSK Band: True
0... .... .... .... = EU Sub-GHz FSK Band: False
Capability Information: 0x8f
.... ...1 = Alternate Coordinator: True
.... ..1. = Full-Function Device: True
.... .1.. = AC Power: True
.... 1... = Rx On When Idle: True
.0.. .... = Security Capability: False
1... .... = Allocate Short Address: True
Manufacturer Code: 0x115f
Max Buffer Size: 82
Max Incoming Transfer Size: 82
Server Flags: 0x2c41
Max Outgoing Transfer Size: 82
Descriptor Capability Field: 0x00
0000 40 00 02 80 00 00 00 fd 01 00 00 00 00 40 8f 5f
0010 11 52 52 00 41 2c 52 00 00
