End device Polling

This page contains observations of sniffed ZigBee traffic in regard of end-device polling behavior and how various routers deal with it.

Routers

Innr lights

Drops frame to end device silently, no NWK transaction expired message.

Philips hue LCT007, firmware 5.50.1.19085, 20160810

Drops frame to end device silently after ~3-7 seconds, no NWK transaction expired message.

OSRAM Smart+ plug

NWK transaction expired after 20 seconds.

Ikea E27 W opal 1000lm, FW: 1.2.214, Datecode: 20170302

NWK transaction expired after 8 seconds. (might be standard which says 7680 milliseconds)

Issue nwkUpdateId:

• The local nwkUpdateId is not updated after a power-cycle, if it is 1 and there is a newer network with nwkUpdateId 2 it will stay 1.
• End-devices which try to rejoin the network and already know nwkUpdateId 2 will ignore the Ikea light as parent candidate.

Ikea GU10 WS 400lm, FW: 1.2.221, Datecode: 20180410

Xiaom motion sensor (RTCGQ11LM) as child test:

• Gateway firmware 0x262d0500
• Hourly report 0xff01 is relayed to gateway (no motion activation in between).
  Therefore child wasn't removed after one hour sleeping.
• NWK Route Record is send to gateway prior to relay
• Test NVRAM child table is kept after light power cycle OK

End-devices

Xiaomi motion sensor (RTCGQ11LM)

Version: 3000-0001
Model id: lumi.sensor_motion.aq2

• Polls once per hour ~500 ms after manufacturer specific special basic cluster attribute (0xff01) report
• Doesn't poll after Occupancy sensing and Illuminance measurement cluster reports
• None of the attribute reports have APS ACK enabled
• None of the attribute reports have ZCL default response enabled
• When button is pressed once, it polls once and does attribute reports every 5 seconds without polling (setup / test mode)

Parent loss

• When parent (coordinator) is not reachable on activation Occupancy sensing and Illuminance measurement reports are repeated 23x and then 4x
• No further action to rejoin to another parent is taken for the next 4 activations (with one minute offset)
• The fifth activation causes recovery to search for a new parent

Xiaomi square multi sensor (WSDCGQ11LM)

Version: 3000-0001
Model id: lumi.weather

Parent loss

• When parent (router / FLS-PP lp) is not reachable on sensor measurement reports these are repeated 4x
• No further action to rejoin to another parent is taken for the next 4 sensor measurement reports (with 3 minutes offset)
• The fifth activation causes recovery to search for a new parent

Ikea Tradfri remote control

Invalid power descriptor: 0xc110

Polls every 5 minutes.

Ikea Tradfri motion sensor

Invalid power descriptor: 0xc110

Poll every 5 minutes.

OSRAM Motion-Sensor-A

Polls every 5 seconds.

OSRAM 4 button remote control

Polls 3x with 1 second delay after power configuration cluster report, every 1 hour.

Polls 4x with 1 second delay after button press.

invalid power descriptor: 0xc110

Trust remote control ZYCT-202

https://www.trust.com/en/product/71171-zigbee-remote-control-zyct-202

Polls only once after button press, stays silent otherwise.

NWK 0x0093

group 1 0x0091 group 2 0x0092 group 3 0x0093 group 4 0x0094 group 5 0x0095 group 6 (all) 0x0096

Trust motion sensor ZPIR-8000

• polls once after motion detection
• polls once after battery report every 20 minutes

Philips hue Dimmer switch

Polls 4x with 5 seconds delay after power configuration cluster report, very 5 minutes.