Send ZigBee commands to devices in the network

[bobo-cher]

Thank you for this wonderful tool. It's a pleasure to work with.

Using the instructions from Wiki I was able to run sniffer without any troubles. I'm now wondering if there is a way to send ZigBee commands using ember-cli.

For example I've captured a simple On/Off command, which I've sent from Home Assistant app to a switch:

 1	0.000000	0x0000	0xc882	ZigBee HA	112	ZCL OnOff: Off, Seq: 79

Frame 1: 112 bytes on wire (896 bits), 112 bytes captured (896 bits) on interface lo0, id 0
Null/Loopback
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
User Datagram Protocol, Src Port: 17754, Dst Port: 17754
ZigBee Encapsulation Protocol, Channel: 12, Length: 48
IEEE 802.15.4 Data, Src: 0x0000, Dst: 0xc882
ZigBee Network Layer Data, Dst: 0xc882, Src: 0x0000
    Frame Control Field: 0x0248, Frame Type: Data, Discover Route: Enable, Security Data
    Destination: 0xc882
    Source: 0x0000
    Radius: 30
    Sequence Number: 0
    [Extended Source: SiliconLabor_ff:fe:8c:1e:e0 (7c:c6:b6:ff:fe:8c:1e:e0)]
    [Origin: 1]
    ZigBee Security Header
ZigBee Application Support Layer Data, Dst Endpt: 1, Src Endpt: 1
    Frame Control Field: Data (0x40)
        .... ..00 = Frame Type: Data (0x0)
        .... 00.. = Delivery Mode: Unicast (0x0)
        ..0. .... = Security: False
        .1.. .... = Acknowledgement Request: True
        0... .... = Extended Header: False
    Destination Endpoint: 1
    Cluster: On/Off (0x0006)
    Profile: Home Automation (0x0104)
    Source Endpoint: 1
    Counter: 132
ZigBee Cluster Library Frame
    Frame Control Field: Cluster-specific (0x01)
        .... ..01 = Frame Type: Cluster-specific (0x1)
        .... .0.. = Manufacturer Specific: False
        .... 0... = Direction: Client to Server
        ...0 .... = Disable Default Response: False
    Sequence Number: 79
    Command: Off (0x00)

I guess I want to send Command: Off (0x00) or Command: Toggle (0x02) to device Dst: 0xc882.

That's probably possible using custom script in router mode but I have no clue what to put into that script.

Could you please provide an example? Thank you.

[Nerivec]

Thanks!

Sending high level payloads is not quite easy, ember-zli was not designed for this. Although the whole EZSP protocol is exposed through the ezsp reference, it requires sending "raw" payloads. You can see an example here:

ember-zli/src/commands/router/index.ts

Lines 545 to 574 in a89959a

	private async menuPingCoordinator(): Promise<boolean> {
	if (!this.ezsp) {
	logger.error(`Invalid state, no EZSP layer available.`)
	return this.exit(1)
	}
	const [status] = await this.ezsp.send(
	EmberOutgoingMessageType.DIRECT,
	ZSpec.COORDINATOR_ADDRESS,
	{
	profileId: ZSpec.HA_PROFILE_ID,
	clusterId: Zcl.Clusters.genBasic.ID,
	sourceEndpoint: ROUTER_FIXED_ENDPOINTS[0].endpoint,
	destinationEndpoint: ROUTER_FIXED_ENDPOINTS[0].endpoint,
	options: DEFAULT_APS_OPTIONS,
	groupId: 0,
	sequence: 0,
	},
	// type 'readResponse', cluster 'genBasic', data '{"zclVersion":8}'
	Buffer.from('1801010000002008', 'hex'),
	0,
	0,
	)
	if (status !== SLStatus.OK) {
	logger.error(`Failed to ping coordinator with status=${SLStatus[status]}.`)
	}
	return false
	}

As you can see, the payload to the send command is a raw buffer. Easiest way to generate these, would be to either copy the decrypted payload of the APS layer in Wireshark, or to generate them using zigbee-herdsman zspec (that would require writing some code to trigger these functions and retrieve the result, which is basically what the zigbee-herdsman Controller does).
There's a whole lot of parameters going into sending a ZigBee APS payload, and some side-effects may also be expected once you do!

Note: Running custom script was meant as a debugging tool for specific cases, you may need to customize ember-zli itself to get it to do what you want in the way you want it. Also, sending improper payloads can disrupt a network, so, be careful if you try this on anything but a test network.

[bobo-cher]

Thank you very much! With you help I've managed to write a working script 😉

This example script sends toggle command to network address 3646:

/**
 * @param cmd Command The invoking oclif command object https://oclif.io/
 *        - The EZSP layer is available through `cmd.ezsp`
 * @param logger winston.Logger The winston logger https://github.com/winstonjs/winston
 */
async function custom(cmd, logger) {
    logger.info('Sending our ZigBee command') 

    const [status] = await cmd.ezsp.send( 
        0,     // EmberOutgoingMessageType.DIRECT, 
        3646,  // Destination
        { 
            profileId: 0x0104,      // Profile: Home Automation (0x0104)
            clusterId: 0x0006,      // Cluster: On/Off (0x0006)
            sourceEndpoint: 1,      // Source Endpoint: 1
            destinationEndpoint: 1, // Destination Endpoint: 1
            options: 0, 
            groupId: 0, 
            sequence: 0, 
        }, 
                
        //    ZigBee Cluster Library Frame:
        //      Frame Control Field: Cluster-specific (0x01)
        //      Sequence Number: 0
        //      Command: Toggle (0x02)
        Buffer.from('010002', 'hex'), 
        0, 
        0, 
    ) 
}

export default custom;

[bobo-cher]

During my testing I've stumbled upon a minor issue. When using command "Run external script" the script is loaded only once. If I change the file and use the command again the previously loaded version of the script is executed. I needed to stop ember-zli and run it again each time I made a change to the script.

I wonder if this can be improved or maybe there is a workaround for this?

[Nerivec]

You're hitting the module caching system of nodejs. It can usually be bypassed with some tricks (using URL query params similar to how it's done in browsers to invalidate caching), but the old modules stay in cache (until the nodejs process exits), so, it's not so good for memory (basically a leak).