Have you looked at the xbee/zigbee module? (The name changed recently from zigbee -> xbee).
This module contains a function called getnodelist(), which performs a discovery on the network and returns a list of node objects for each one found. The node objects contain the 64 bit address and can be transformed into a destination that is accepted by the zigbee socket sendto() function by using the to_socket_addr().
An example:
#> python
>>> import xbee
>>> dir(xbee)
[‘doc’, ‘name’, ‘package’, ‘ddo_command’, ‘ddo_get_param’, ‘ddo_set_param’, ‘get_node_list’, ‘getnodelist’,
‘register_joining_device’, ‘unregister_joining_device’]>>>
>>>
>>> node_list = xbee.getnodelist()
>>> for node in node_list:
… print node
…
>>> print dir(node)
[‘class’, ‘delattr’, ‘doc’, ‘format’, ‘getattribute’, ‘hash’, ‘init’, ‘new’, 'reduce
', ‘reduce_ex’, ‘repr’, ‘setattr’, ‘sizeof’, ‘str’, ‘subclasshook’, ‘addr_extended’, ‘addr_paren
t’, ‘addr_short’, ‘device_type’, ‘label’, ‘manufacturer_id’, ‘profile_id’, ‘to_socket_addr’, ‘type’]
>>>