Generic ZigBee neighbors discovery from an End Device

Hello!

I am stuck with the following problem: using one XBee with the End Device API firmware, I would like to identify its neighbors (IEEE64 or NWK16 addresses) or at least the parent device.
I assume that none of the neighbors are XBee nodes, hence I cannot rely on remote XBee commands, otherwise a broadcast remote ND command would have done the trick.
Therefore I must rely on local queries or ZDO commands. Unfortunately, all the ZDO client commands shall not be broadcast. The LQI request would work if broadcast (forbidden), but it I receive packets back practically from the parent only because no provisions exist to avoid transmission conflicts.

Any suggestions?
Thanks!