Request: [transaction sequence number: 1] [node ID:2]
Response: [transaction sequence number: 1] [status:1] [node ID:2] [endpoint count:1] [endpoint:1]*
There are two possible formats, depending on whether the destination is a group address or a device address. Device addresses include an endpoint, groups don't.
Request: [transaction sequence number: 1] [source EUI64:8] [source endpoint:1] [cluster ID:2] [destination address:3 or 10] Destination address: [0x01:1] [destination group:2] Or: [0x03:1] [destination EUI64:8] [destination endpoint:1]
Response: [transaction sequence number: 1] [status:1]
Request: [transaction sequence number: 1] [start index:1]
Response: [transaction sequence number: 1] [status:1] [binding table entries:1] [start index:1] [entry count:1] [entry:14/21]* [entry] = [source EUI64:8] [source endpoint:1] [cluster ID:2] [dest addr mode:1] [dest:2/8] [dest endpoint:0/1]
Request: [transaction sequence number: 1] [TLVs: varies]
Contains at least the APS Frame Counter Challenge TLV, which holds the sender EUI and the 64 bit challenge value.
Response: [transaction sequence number: 1] [TLVs: varies]
Contains at least the APS Frame Counter Response TLV, which holds the sender EUI, received challenge value, APS frame counter, challenge security frame counter, and 8-byte MIC.
Request: [transaction sequence number: 1] [tlvs: Variable] tlvs: [Count N:1][EUI64 1:8]...[EUI64 N:8]
Response: [transaction sequence number: 1] [status:1]
Request: [transaction sequence number: 1] [security decommission request EUI64 TLV:Variable] Security Decommission request EUI64 TLV: [Count N:1][EUI64 1:8]...[EUI64 N:8]
Response: [transaction sequence number: 1] [status:1]
Request: [transaction sequence number: 1] [node ID:2] [EUI64:8] [capabilities:1]
Request: [transaction sequence number: 1] [TLVs: varies]
Contains one or more Target IEEE Address TLVs (8 octets), which contain the EUI64 of the device of interest. See R23 spec section 2.4.3.4.3
Response: [transaction sequence number: 1] [status:1] [TLVs: varies]
Contains one or more Device Authentication Level TLVs (10 octets), which contain the EUI64 of the inquired device, along with the its initial join method and its active link key update method. See R23 spec section 2.4.4.4.3
Request: [transaction sequence number: 1] [TLVs: varies]
Contains one or more TLVs (1 octet), which the sender wants to get information
Response: [transaction sequence number: 1] [status:1] [TLVs: varies]
Contains one or more TLV tag Ids and their values in response to the request
Request: [transaction sequence number: 1] [node ID:2] [request type:1] [start index:1] [request type] = 0x00 single address response, ignore the start index = 0x01 extended response, sends kid's IDs as well
Response: [transaction sequence number: 1] [status:1] [EUI64:8] [node ID:2] [assoc dev count:1] [start index:1] [assoc dev list:2]*
Stacks certified prior to Revision 21 MAY or MAY NOT support this command. If this management command is not supported, a status of NOT_SUPPORTED SHALL be returned. All stacks certified to Revision 21 and later SHALL support this command.
Request: [transaction sequence number: 1] [EUI64:8] [flags:1] The flag bits are: 0x40 remove children 0x80 rejoin
Response: [transaction sequence number: 1] [status:1]
Request: [transaction sequence number: 1] [start index:1]
Response: [transaction sequence number: 1] [status:1] [neighbor table entries:1] [start index:1] [entry count:1] [entry:22]* [entry] = [extended PAN ID:8] [EUI64:8] [node ID:2] [device type, RX on when idle, relationship:1] [permit joining:1] [depth:1] [LQI:1]
The device-type byte has the following fields:
Name Mask Values
device type 0x03 0x00 coordinator 0x01 router 0x02 end device 0x03 unknown
rx mode 0x0C 0x00 off when idle 0x04 on when idle 0x08 unknown
relationship 0x70 0x00 parent 0x10 child 0x20 sibling 0x30 other 0x40 previous child reserved 0x10
The permit-joining byte has the following fields
Name Mask Values
permit joining 0x03 0x00 not accepting join requests 0x01 accepting join requests 0x02 unknown reserved 0xFC
Request: [transaction sequence number: 1] [node ID:2] [app profile ID:2] [input cluster count:1] [input cluster:2]* [output cluster count:1] [output cluster:2]*
Response: [transaction sequence number: 1] [status:1] [node ID:2] [endpoint count:1] [endpoint:1]*
Request: [transaction sequence number: 1] [EUI64:8] [request type:1] [start index:1] [request type] = 0x00 single address response, ignore the start index = 0x01 extended response, sends kid's IDs as well
Response: [transaction sequence number: 1] [status:1] [EUI64:8] [node ID:2] [assoc dev count:1] [start index:1] [assoc dev list:2]*
Request: [transaction sequence number: 1] [node ID:2] [tlvs: varies]
Response: [transaction sequence number: 1] [status:1] [node ID:2] [node descriptor: 13] [tlvs: varies]
Node Descriptor field is divided into subfields of bitmasks as follows: (Note: All lengths below are given in bits rather than bytes.) Logical Type: 3 Complex Descriptor Available: 1 User Descriptor Available: 1 (reserved/unused): 3 APS Flags: 3 Frequency Band: 5 MAC capability flags: 8 Manufacturer Code: 16 Maximum buffer size: 8 Maximum incoming transfer size: 16 Server mask: 16 Maximum outgoing transfer size: 16 Descriptor Capability Flags: 8 See ZigBee document 053474, Section 2.3.2.3 for more details.
This command can be used by a remote device to survey the end devices to determine how many potential parents they have access to.
Request: [transaction sequence number: 1] [TLVs: varies]
Contains one Beacon Survey Configuration TLV (variable octets), which contain the ScanChannelListStructure (variable length) and the ConfigurationBitmask (1 octet). This information provides the configuration for the end device's beacon survey. See R23 spec section 2.4.3.3.12 for the request and 3.2.2.2.1 for the ChannelListStructure.
Response: [transaction sequence number: 1] [status: 1] [TLVs: varies]
Contains one Beacon Survey Results TLV (4 octets), which contain the number of on-network, off-network, potential parent and total beacons recorded. If the device that received the request is not a router, a Potential Parent TLV (variable octects) will be found. This will contain information on the device's current parent, as well as any potential parents found via beacons (up to a maximum of 5). A Pan ID Conflict TLV can also found in the response. See R23 spec section 2.4.4.3.13 for the response.
Request: [transaction sequence number: 1] [scan channels list structure: Variable] [duration:1] [count:0/1] [nwkUpdateId:0/1] [manager:0/2] [configuration bitmask:0/1]
Response: [transaction sequence number: 1] [status:1] [scanned channels:4] [transmissions:2] [failures:2] [energy count:1] [energy:1]*
Request: [transaction sequence number: 1] [start index: 1]
Response: [transaction sequence number: 1] [status: 1] [ieee joining list update id: 1] [joining policy: 1] [ieee joining list total: 1] [start index: 1] [ieee joining count: 1] [ieee:8]*
Response: [transaction sequence number: 1] [status: 1] [channel in use: 4] [mac tx ucast total: 2] [mac tx ucast failures: 2] [mac tx ucast retries: 2] [period of time for results: 1]
Request: [transaction sequence number: 1] [scan channels:4] [duration:1] [count:0/1] [nwkUpdateId:0/1] [manager:0/2]
If the duration is in 0x00 ... 0x05, 'count' is present but not 'manager'. Perform 'count' scans of the given duration on the given channels.
If duration is 0xFE, 'channels' should have a single channel and 'count' and 'manager' are not present. Switch to the indicated channel.
If duration is 0xFF, 'count' is not present. Set the active channels and the network manager ID to the values given.
Unicast requests always get a response, which is INVALID_REQUEST if the duration is not a legal value.
Response: [transaction sequence number: 1] [status:1] [scanned channels:4] [transmissions:2] [failures:2] [energy count:1] [energy:1]*
This is broadcast and only servers which have matching children respond.
Request: [transaction sequence number: 1] [number of children:1] [child EUI64:8]*
The response contains the list of children that the recipient now holds.
Response: [transaction sequence number: 1] [status: 1] [number of children:1] [child EUI64:8]*
Request: [transaction sequence number: 1] [duration:1] [permit authentication:1]
No response if broadcasted to all routers.
Response: [transaction sequence number: 1] [status:1]
Request: [transaction sequence number: 1] [node ID:2]
Response: [transaction sequence number: 1] [status:1] [node ID:2] [current power mode, available power sources:1] [current power source, current power source level:1] See ZigBee document 053474, Section 2.3.2.4 for more details.
Request: [transaction sequence number: 1] [TLVs: varies]
Contains one or more Authentication Token ID TLVs (1 octet), which contain the TLV Type Tag ID of the source of the authentication token. See R23 spec section 2.4.3.4.2
Response: [transaction sequence number: 1] [status:1] [TLVs: varies]
Contains one or more 128-bit Symmetric Passphrase Global TLVs (16 octets), which contain the symmetric passphrase authentication token. See R23 spec section 2.4.4.4.2
Request: [transaction sequence number: 1] [start index:1]
Response: [transaction sequence number: 1] [status:1] [routing table entries:1] [start index:1] [entry count:1] [entry:5]* [entry] = [destination address:2] [status:1] [next hop:2]
The status byte has the following fields: Name Mask Values
status 0x07 0x00 active 0x01 discovery underway 0x02 discovery failed 0x03 inactive 0x04 validation underway
flags 0x38 0x08 memory constrained 0x10 many-to-one 0x20 route record required
reserved 0xC0
Request: [transaction sequence number: 1] [TLVs: varies]
Contains one or more Global TLVs (1 octet), which contain the TLV Type Tag ID, and their value.
Response: [transaction sequence number: 1] [status:1]
Request: [transaction sequence number: 1] [node ID:2] [endpoint:1]
Response: [transaction sequence number: 1] [status:1] [node ID:2] [length:1] [endpoint:1] [app profile ID:2] [app device ID:2] [app device version, app flags:1] [input cluster count:1] [input cluster:2]* [output cluster count:1] [output cluster:2]*
Request: [transaction sequence number: 1] [TLVs: varies]
Contains one or more Curve25519 Public Point TLVs (40 octets), which contain an EUI64 and the 32-byte Curve public point. See R23 spec section 2.4.3.4.1
This command SHALL NOT be APS encrypted regardless of whether sent before or after the device joins the network. This command SHALL be network encrypted if the device has a network key, i.e. it has joined the network earlier and wants to negotiate or renegotiate a new link key; otherwise, if it is used prior to joining the network, it SHALL NOT be network encrypted.
Response: [transaction sequence number: 1] [status:1] [TLVs: varies]
Contains one or more Curve25519 Public Point TLVs (40 octets), which contain an EUI64 and the 32-byte Curve public point, or Local TLVs. See R23 spec section 2.4.4.4.1
This command SHALL NOT be APS encrypted. When performing Key Negotiation with an unauthenticated neighbor that is not yet on the network, network layer encryption SHALL NOT be used on the message. If the message is being sent to unauthenticated device that is not on the network and is not a neighbor, it SHALL be relayed as described in section 4.6.3.7.7. Otherwise the message SHALL have network layer encryption.
Request: [transaction sequence number: 1] [TLVs: varies]
Contains one or more TLVs. These TLVs can be Selected Key Negotiation Method TLVs (10 octets), Fragmentation Parameters Global TLVs (5 octets), or other TLVs. See R23 spec section 2.4.3.4.6
This SHALL NOT be APS encrypted or NWK encrypted if the link key update mechanism is done as part of the initial join and before the receiving device has been issued a network key. This SHALL be both APS encrypted and NWK encrypted if the link key update mechanism is performed to refresh the link key when the receiving device has the network key and has previously successfully joined the network.
Response: [transaction sequence number: 1] [status:1]
See R23 spec section 2.4.4.4.6
This is broadcast and only servers which have matching services respond.
Request: [transaction sequence number: 1] [server mask:2]
The response contains the request services that the recipient provides.
Response: [transaction sequence number: 1] [status (== EMBER_ZDP_SUCCESS):1] [server mask:2]
There are two possible formats, depending on whether the destination is a group address or a device address. Device addresses include an endpoint, groups don't.
Request: [transaction sequence number: 1] [source EUI64:8] [source endpoint:1] [cluster ID:2] [destination address:3 or 10] Destination address: [0x01:1] [destination group:2] Or: [0x03:1] [destination EUI64:8] [destination endpoint:1]
Response: [transaction sequence number: 1] [status:1]
Defines for ZigBee device profile cluster IDs follow. These include descriptions of the formats of the messages.
Note that each message starts with a 1-byte transaction sequence number. This sequence number is used to match a response command frame to the request frame that it is replying to. The application shall maintain a 1-byte counter that is copied into this field and incremented by one for each command sent. When a value of 0xff is reached, the next command shall re-start the counter with a value of 0x00.
The Device Profile describes devices in one of two configurations:
Restricted Mode (
apsZdoRestrictedMode) is a mode where a device will conditionally accept specific ZDO commands, depending on the restricted criteria, source address, and encryption policy of the incoming command. If a command is accepted, it is subject to normal command processing. The acceptance criteria is explain further below:apsZdoRestrictedModein the AIB is set to FALSE, the command is not restricted.