How to detect routers with the wrong operating PAN ID?

I have several zigbee router devices that have bound themselves to the wrong coordinator operating PAN ID (16bit id). The devices are fairly inaccessible, is there someway I can use the coordinator node (that has a cell link) to scan/detect what operating PAN ID these routers are looking for, connect to the routers and update them?

I have just discovered how the network watchdog and forcing device disassociations on device startup, so all further router devices will do this, but I would like to ‘recover’ the deployed router devices wirelessly without having to physically update their software.

No that is not something you can do. You are going to need to either connect with another router and join the network they are on or issue a network reset locally.

Would it be possible to guess the operating panid ( I have an idea what it is ), then try to configure a coordinator to impersonate that operating panid?

Are there zigbee network sniffing tools to see what routers might be saying on the network when they don’t yet have a coordinator on their operating panid?

You would need to follow the steps outlined for replacing a coordinator on page 42 of the manual located at http://www.digi.com/resources/documentation/digidocs/PDFs/90000976.pdf