Background

The ZigBee standard specifies the network (NET or NWK) and application (APP or APL) layers for low-rate wireless personal area networks. These NET- and APP-layer specifications build upon the PHY and MAC specifications of IEEE® 802.15.4™ [ 2 ]. ZigBee devices find application in home automation and sensor networking and are highly relevant to the Internet of Things (IoT) trend.

Architecture

A zigbee.NETFrameConfig configuration object is used both in generating and decoding ZigBee NET frames. Such objects describe a NET-layer frame and specify its frame type and all applicable properties. The zigbee.NETFrameGenerator function accepts a zigbee.NETFrameConfig object describing the frame, and optionally a NET-layer payload (APP-layer frame) in bytes (two-characters), and outputs the NET frame in bytes. The zigbee.NETFrameDecoder function accepts a NET Protocol Data Unit (NPDU) in bytes and outputs a zigbee.NETFrameConfig object describing the frame and possibly a NET-layer frame in bytes. Clause 3.3 in [ 1 ] describes the NET frame formats.

Decoding NET Frames of Home Automation ZigBee Radios

This section decodes NET frames transmitted from a commercial ZigBee radio enabling home automation, and captured using a USRP® B200-mini radio and the Communications Toolbox Support Package for USRP® radio.

The zigbee.NETFrameDecoder function can decode NET-layer ZigBee data frames and the header of net-command frame types.

load zigbeeNETCaptures % netFrame

[netConfig, netPayload] = zigbee.NETFrameDecoder(netFrame);
netConfig

netConfig = 

  NETFrameConfig with properties:

                FrameType: 'Data'
          ProtocolVersion: 'ZigBee 2007'
           SequenceNumber: 212

   Addressing:
            SourceAddress: '0000'
       DestinationAddress: '35EA'
           IEEEAddressing: 'None'

   Security:
                 Security: 1
           DataEncryption: 0
                MICLength: 0
            KeyIdentifier: 'Network'
            ExtendedNonce: 1
             FrameCounter: 193458
    SecuritySourceAddress: '24FD5B00000014B6'
              KeySequence: 0

   Routing:
                   Radius: 30
            DiscoverRoute: 1
            SourceRouting: 1
               RelayIndex: 0
                RelayList: [0x4 char]

   Multicast:
                Multicast: 0

Note that NET-layer decoding indicates that the NET-layer payload is encrypted (Security = true). Security can be used either in the network or the application layer; this frame uses network-layer security. On the one hand, the DataEncryption field is false in the frame and the Message Integrity Code (MIC) length is zero, which indicate that security level #0 is used and that the payload is not encrypted. However, according to the ZigBee standard (Clause 4.4.1.2 in [ 1 ]), these two fields are overwritten with values locally stored during network setup. In this case, this frame was secured with security level #5, which means that the NET-payload is encrypted and that the MIC length is 32 bits.

Generating NET Frames

The zigbee.NETFrameGenerator function can generate unsecure NET-layer ZigBee data frames. The configuration object can be further customized.

netConfig = zigbee.NETFrameConfig('SequenceNumber', 123, 'DestinationAddress', 'E568');
numOctets = 50;
payload = dec2hex(randi([0 2^8-1], numOctets, 1), 2);
netFrame = zigbee.NETFrameGenerator(netConfig, payload);

Further Exploration

You can further explore the following generator and decoding functions, as well as the configuration object:

Selected Bibliography