Zigbee, Thread & Matter · Study deck

Zigbee Network Analyzer

Imagine a room sensor that stops reporting each afternoon.

Radio Remi is your guide for this deck.

zigbeediagnosticsanalyzer
Radio Remi, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • Explain: Device-health evidence records stale reporting, repeated retries, power-state warnings, missed check-ins, or changing link-quality observations without turning one metric into a universal diagnosis.
  • Explain: A Zigbee network analyzer is useful when it turns device observations, route symptoms, bridge logs, and packet evidence into a bounded diagnostic record.
  • Explain: A Zigbee analyzer sniffs raw IEEE 802.15.4 frames on one channel; Zigbee 2.4 GHz networks use channels 11 through 26.
  • Explain: Route-record commands in many-to-one routing can reveal the source route the coordinator will use back to a device.
iotclass.org

Major section

In 60 Seconds

Zigbee is a low-power wireless system used by many local device networks.

  • A gateway is a bridge between that local network and another system.
  • A network analyzer gathers observations that can help explain the missing report.
  • A matching chart is a clue, not proof that one event caused the other.
iotclass.org

Major section

In 60 Seconds (continued)

A gateway is the bridge from the local device network to another system.

  • This quick check cannot see every radio signal, device fault, or outside service.
  • Under the Hood examines capture limits, routing, and evidence conflicts.
  • A Zigbee network analyzer is useful when it turns device observations, route symptoms, bridge logs, and packet evidence into a bounded diagnostic record.
iotclass.org

Major section

Evidence Families

Topology evidence records parent, relay, coordinator, gateway, and single-dependency observations.

  • Traffic evidence records source, destination, command class, direction, repetition, missing response, and visible delivery.
  • Route-change evidence records what path changed, what symptom appeared, what recovered, and what remained unknown.
  • Correlation evidence compares analyzer output with gateway logs, site observations, support reports, commissioning records, and recent changes.

Numbers to remember

2.4 GHzZigbee 2.4 GHz networks use channels 11 through 26.
Zigbee analyzer evidence flow: a captured IEEE 802.15.4 frame decomposed into MAC, NWK, and APS headers plus payload and radio metadata, feeding an evidence flow from capture scope through correlation to a layer-naming review decision, owner, and retest trigger.
Zigbee analyzer evidence flow: a captured IEEE 802.15.4 frame decomposed into MAC, NWK, and APS headers plus payload and radio metadata, feeding an evidence flow from capture scope through correlation to a layer-naming review decision, owner, and retest trigger.
iotclass.org

Major section

Evidence Families (continued)

Device-health evidence records stale reporting, repeated retries, power-state warnings, missed check-ins, or changing link-quality observations without turning one metric into a universal diagnosis.

  • A Zigbee analyzer sniffs raw IEEE 802.15.4 frames on one channel; Zigbee 2.4 GHz networks use channels 11 through 26.
  • Reading a capture is therefore a layer-localization exercise.
  • The review should name the layer before naming the fix.
iotclass.org

Major section

Set the Capture Boundary

An analyzer record needs a boundary before the result can be trusted.

  • A broad absence of evidence usually means the review did not define what it was trying to find.
  • Two capture limits should be recorded before payload conclusions are trusted.
  • A sniffer may see addresses, PAN ID, frame types, and route activity while the application payload remains ciphertext.
iotclass.org

Major section

Review Traffic and Symptoms

Traffic review asks whether the analyzer sees the same problem that users, gateways, or support records describe.

  • A falling link-quality observation, a stale report, or a repeated message is a clue.
  • It becomes stronger evidence only when the review connects it to the path, event, user impact, and field context.
  • A single dropped packet is noise.
iotclass.org

Major section

Review Traffic and Symptoms (continued)

The diagnostic value of a capture is in trends across the timeline, not a single frame.

  • Falling LQI on a link can foreshadow a route change.
  • Repeated NWK route-request broadcasts can show route-discovery churn, meaning the route is unstable or missing rather than steady.
  • Route-record commands in many-to-one routing can reveal the source route the coordinator will use back to a device.
iotclass.org

Major section

Worked Review: Router Replacement

Scenario:: A relay device was replaced.

  • The analyzer shows changed paths for a small endpoint group, but only some support records show visible impact.
  • Separate analyzer-visible changes from user-visible service impact.
  • Decision:: Revise the topology and support notes when the analyzer and field records agree.
iotclass.org

Deck summary

Key takeaways

Zigbee is a low-power wireless system used by many local device networks.

  • A gateway is the bridge from the local device network to another system.
  • Topology evidence records parent, relay, coordinator, gateway, and single-dependency observations.
  • Device-health evidence records stale reporting, repeated retries, power-state warnings, missed check-ins, or changing link-quality observations without turning one metric into a universal diagnosis.
  • An analyzer record needs a boundary before the result can be trusted.
iotclass.org

Retrieval practice

Recall check 1 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q1A Zigbee analyzer shows a route change and repeated messages for one endpoint group. What is the strongest use of that observation?

ATreat it as bounded evidence and correlate it with gateway logs and field reports
BConclude that every network issue has now been fully explained
CApprove the deployment because the analyzer looks generally healthy
DIgnore the gateway logs since the analyzer already shows traffic
Show answer

Answer: A Analyzer output is bounded evidence to correlate with gateway logs and field reports, not a complete explanation.

iotclass.org

Retrieval practice

Recall check 2 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q2In a Zigbee capture, what does the LQI value on a frame tell you?

AIt reports received link quality for that captured frame.
BIt contains the decoded application payload carried by the APS frame.
CIt records how many mesh hops the frame has traveled from the source.
DIt names the PAN ID that identifies which Zigbee network was captured.
Show answer

Answer: A A capture has MAC, NWK, and APS fields plus radio metadata such as LQI and RSSI.

iotclass.org

Retrieval practice

Recall check 3 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q3An analyzer shows Zigbee frames flowing between devices, but every application payload is unreadable. What is the most likely cause?

AThe analyzer does not have approved key material for decrypting the payloads.
BThe devices are on a frequency the analyzer cannot receive at all.
CThe APS endpoints are using the wrong cluster for every command.
DThe LQI value is too low to allow any captured bytes to be decoded.
Show answer

Answer: A Zigbee headers can be visible without payload decryption; key material, channel, and RF placement bound capture evidence.

iotclass.org

Retrieval practice

Recall check 4 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q4A capture shows repeated NWK route-request broadcasts for the same destination over several minutes. What does this most likely indicate?

AThe route is unstable or missing, so the network keeps rediscovering it.
BNormal discovery for intermittent traffic, because an idle route may need to be rebuilt.
CA missing analyzer key, because encrypted packets can be difficult to classify as route requests.
DThe endpoints are reporting application measurements too often.
Show answer

Answer: A Diagnose from trends such as LQI decline, route-discovery churn, duplicate APS counters, and rejoins.

iotclass.org

Retrieval practice

Recall check 5 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q5A Zigbee analyzer shows a route change and repeated messages for one endpoint group. The record does not include gateway logs, field context, owner, or retest trigger. What is the strongest review decision?

AApprove the network as fully explained, because the analyzer has already connected the symptom to its root cause without further records.
BAccept the bounded analyzer observation, record missing context, and require gateway or field evidence before deployment decisions.
CWithhold the route-change observation until gateway logs confirm it, because independent records reduce the chance of a capture error.
DApprove the record once the topology map is removed, because path maps mislead more reviews than they help.
Show answer

Answer: B The analyzer supports a bounded diagnostic claim, but deployment decisions need correlation plus an owner and retest trigger.

iotclass.org

Retrieval practice

Recall check 6 of 6

Radio Remi says: answer from memory, then check your reasoning.

Q6A dashboard says all visible Zigbee devices are healthy, but users report intermittent control failures in one room. What review response best preserves quality?

AClose the issue as resolved, because the dashboard's healthy label outranks anecdotal user reports.
BSkip the diagnostic review entirely and replace every device in the affected room to clear the fault quickly.
CBound the analyzer claim and compare traffic and topology observations with gateway logs and support reports.
DTrust the topology map over the user reports, because captured maps are more reliable than anecdotes.
Show answer

Answer: C Conflicting evidence requires correlation, a narrowed claim, recorded missing context, and an owned retest path.

iotclass.org

Print reference

Answers 1 of 2

Answer key.

  1. A · Analyzer output is bounded evidence to correlate with gateway logs and field reports, not a complete explanation.
  2. A · A capture has MAC, NWK, and APS fields plus radio metadata such as LQI and RSSI.
  3. A · Zigbee headers can be visible without payload decryption; key material, channel, and RF placement bound capture evidence.
  4. A · Diagnose from trends such as LQI decline, route-discovery churn, duplicate APS counters, and rejoins.
iotclass.org

Print reference

Answers 2 of 2

Answer key.

  1. B · The analyzer supports a bounded diagnostic claim, but deployment decisions need correlation plus an owner and retest trigger.
  2. C · Conflicting evidence requires correlation, a narrowed claim, recorded missing context, and an owned retest path.
iotclass.org