Zniffer results, need some advice, please

Hm, this would make sense, thanks for the hint.
Unfortunately, I dont have another spare stick, but I remember, when adding the Z- Stick as a secondary controller to remove the ghost, it did display nodes 1-5.
But who knows what happened since then?
So maybe it's not worth spending time on this... :thinking:

So, maybe, for some weird reasons, they now appear with different node-IDs?
Or maybe a flaw with the Zniffer software?

Like @jtp10181 mentioned they usually are the first few IDs in the list but if you have issues they can appear other places. They will NOT show up on the HE details page by design to avoid confusion. I don't think they would change automatically though without some sort of pairing device manipulation but don't know for sure. I am not sure about any of this.. so will refrain from speculation.

Switching drivers, all by itself, won't improve anything. You need to click Configure and make sure the device wakes up, to get any difference in drivers transferred to the actual device.

I repeat this detail because I actually know how easy it is to overlook. :smiley:

As to the virtual nodes... ignore them. If you see them let your eyes skip right over them. :slight_smile:

1 Like

Yeah, I do not think that this is the main part of my problem, just found it confusing.

Thanks, this is what I did, but it keeps sending those "what I take as explorer frames", still, it keeps reporting reliably.
So maybe this "issue" is related to the device itself?

Even it they don't have an ID between 2-5? So ID 85, in my case, could be one of them, as @jtp10181 mentioned?

When you run PC Controller, the node list exposes the virtuals:

Screen Shot 2022-01-09 at 8.09.22 AM

For me, that's when I know to NOT try to de-ghost them (remove them.)

Just did the same. My Virtual Nodes are at. addresses 2 - 5 and again at 167 - 170

1 Like

I have 4 ZWave networks in my home. 3 are in the 'Production' set and one is for development. As a result, I move my Z-Stick around a lot. I've just come to recognize that there are 4 Virtual Nodes per Controller. It's odd that all 8 of mine are clustered together for this one Hub, but not shocking :smiley:

I've only one controller but have 8? Or did the secondary controller (Z Stick) create the latter 4?

Each 700 series Controller creates 4 additional nodes, labeled 'Virtual Node'

I have just one C7 hub (and no other hubs). The Aeotec Z stick I've just connected is a Gen 5 model. Should I be seeing 4 virtual nodes or 8 (as I am). The only reason I'm asking is that I've been using the Z Stick on and off since last March, but only noticed the second set of 4 virtual nodes fairly recently.

I've trained myself to ignore those virtuals so that means I don't keep track of them on a stick by stick basis. :slight_smile:

If there's ever been a pair of 700 series controllers, then each would allocate their virtuals and those assignments would stick, I believe.


In the above screen cap of mine, the Secondary Controller (20) is also an Aeon Z-Stick (500 series) and the virtuals are still there, which matches your experience I believe.

I have one of these attached to one of my Mac Minis

and it's got 4 ZWave sticks and one portable DVD attached. :slight_smile: Meaning it's easy for me to confuse which ZWave stick is doing what after a few weeks. It's convenient to have a couple of ZWave sticks on different hub meshes. The 700 series stick is on one of my Production Hub's mesh and the one in the screen cap above (Aeon 500 series) is on my Development Hub's mesh.


OK thanks. I've only ever had the one. I include the Z stick when I want to include an older 500 device without security and exclude it again afterwards. I can see from their addresses when this was. I was having a complete nightmare including/excluding an Aeotec switch and the "new" virtual nodes appeared at that time. I'm wondering as I was having such a chew on whether there is something I could have clicked in the PC Controller software that could have caused them to be added again (I maybe used the NWI button rather than add)

Edit: Ignore that just seen your other message

Should only have 4, but I also have the same setup as you (only one hub) and I also have 8, one of the devs said there was probably some sort of corruption before the zwave sdk/firmware was updated to fix those issues and the hub created new ones (72-75 for me). Doesnt seems to be hurting anything besides annoying me.

This is weird, a few months ago, an Aeotec bulb suddenly became unresponsive, but I was not able to exclude it by any means. Also it was getting really, really hot.
After doing a factory reset, there was an unnamed device left, that the hub had not been able to keep on the failed node list.
And if I do remember correctly, one on the new virtual nodes took over it's ID, 85.
Though, using Z-Stick I was able to remove a ghost device, which didn't seem to hurt.
A week before, the same happened to an Aeotec D/W-Sensor 7, but I was able to get rid of it without having to use the Z-Stick.
It could be, that another new virtual node took over it's former ID, 33, since there's a gap in my node list.
Doesn't seem to make much sense, right? :roll_eyes:

Another question, does anyone know if there's a way to decrypt the S2-secured packets, I have no idea where to get the keys?
Edit found this as an answer:

1 Like

I normally hit the "Update" (not "Neighbors Update") button on occasion to refresh the stick info with the gateway. Not sure if that is the issue though.

Yeah you found my post... The S2 is a pain for sniffing. Once you get the Nonce it works while you keep it open but I think once you close the software it forgets it. You also have to get it for each device. Also if you save the trace and then open it later, it is not saved decrypted. So if you want to retain any info take screenshots.

Don't have a PC-Controller anymore, since my only stick is now busy with zniffing. :wink:
Looks like I need to get another one.

Yeah, it was the second hit when searching for "Zniffer". :slight_smile:
Actually, I don't have many S2-devices that support Supervision CC anymore, so I keep on letting it zniff and lurk around for a matching packet. Not that important to me, just for educational purposes. :wink:

Found some more inexplicable behaviour, maybe one of you guys have an idea how to rate this?


As you can see, the hub keeps spamming wake-up beams, also to targets that are non-FLiRS or don't even exist.
The weirdest thing is node-ID 233, isn't the maximum node-count at 232?
Also, my highest node-ID is at 96, so why calling 164 and 170?
And why tries the hub to wake up ID2?

Sorry for being that persistent, but may I ask you guys to have a look at this, am I the only one that thinks that this behaviour is not sane?
Video download size about 14MB.



Thanks in advance.

Edit says that I probably had been able to narrow down one of the issues.

All of my MS6 kept spamming battery status reports and explorer frames, they are USB-powered, though and had never seen a battery.
But still, they all seemed to behave like battery powered devices, I saw a lot of wake up notifications in rapid successions from all of them, especially the one in my livingroom, which is the busiest of them all.
So I re-included this one, et voila, no more battery spamming anymore, even the explorer frames are gone.
My theory is that, during an update with same hand-made firmware, all MS6's read-only parameter #9 had been set to battery-powered.
Tagging @bcopeland to verify that my findings make any sense.
Also, may I ask you to take a look at my video and tell me, what causes the hub to continously ask node 8 , which had been my livingroom sensor, to find all nodes in range.
Could this behaviour probably degrade my Z-Wave performance?
Thanks in advance for your efforts.