Node discovery API response format

I made an xbee java library of my own, in part so that I could separate out xbee from non-xbee licensing issues; and in part because I wanted to have a library in maven with essentially zero external dependencies. It’s definitely a work in progress, but I’m moving fast and am open to collaboration.

The manual I’m using right now is 9000976_V which I think is the most current. The documentation for these radios has always been pretty good, but there are definitely areas where I struggle. One of them is nework discovery.

Page 141 of this version of the manul describes the response body of an ND command as:

NI (Variable length)
DEVICE_TYPE (1 Byte: 0=Coord, 1=Router, 2=End Device)
STATUS (1 Byte: Reserved)
PROFILE_ID (2 Bytes)


I am in API v2 mode so there are no CRs but there are escapes and flags.

I launched a Remote ND command to a router 00 13 A2 00 40 8C 55 C0 and got this back:

Remote Command Response (API 2)
7E 00 36 97 01 00 7D 33 A2 00 40 47 5D 5D 00 00 4E 44 00 00 00 00 7D 33 A2 00 40 47 5D 5D 57 5A 32 42 2D 43 4F 4F 52 44 49 4E 41 54 4F 52 00 FF FE 00 00 C1 05 10 1E 00 00 00 FF 63

which he frame decoder interprets as:

Start delimiter: 7E
Length: 00 36 (54)
Frame type: 97 (Remote Command Response)
Frame ID: 01 (1)
64-bit source address: 00 13 A2 00 40 47 5D 5D
16-bit source address: 00 00
AT Command: 4E 44 (ND)
Status: 00 (Status OK)
Response: 00 00 00 13 A2 00 40 47 5D 5D 57 5A 32 42 2D 43 4F 4F 52 44 49 4E 41 54 4F 52 00 FF FE 00 00 C1 05 10 1E 00 00 00 FF
Checksum: 63

The actually interesting part is in the “Response” which the frame interpreter doesn’t decode (boo) leaving me to do it myself:
00 00 - This doesn’t show up in the ND description above
00 13 A2 00 40 47 5D 5D - this is the Device ID I sent the command to
57 5A 32 42 2D 43 4F 4F 52 44 49 4E 41 54 4F 52 00 - the NI, WZ2B-COORDINATOR
FF FE - parent nework address. Shouldn’t this be 03C9, my network address?
00 - Device type. Coordinator. But this came from a router.
00 - status. Manual says “reserved” so I have little idea what this means.
C1 05 - it’s a profile (ok)
10 1E - using a manufacturer ID(ok)
00 00 - module type “unspecified”
00 FF - product type - not in table

The module type / product type are supposed to be here but as you can see that’s pretty unhelpful - in factg, that page says “You can never fully trust the DD value returned.”

So putting all of this together, I am left with a number of questions:

  1. How do you from this message definitely determine what’s a router, coodinator, or end device?

  2. I issued a remote ND command for a device whose name is WEATHER, but what got returned to me is a response with WEATHER’s device ID but the coordinator’s NI. Why is that? I’m OK with getting both back - I can discern that - but the way it phrased the response really appears like it’s mixing up two different things

Found in some sample code HERE:

uint8_t device_type; // one of  

All of that makes sense but on some devices I get back a 3 and don’t know what that means. Programmable S2B, Router maybe?

1: You determine that by the Device Type field. That field is not a settable field and is based off of the firmware installed and its active roll.

2 Are you sure that you did not issue a DN command and not the ND command?

1 Like


#1: What I think is Device Type is coming back like this:
coordinator: 0xFE00
router: 0xFE01
Router / RS-485 adapter: 0FE01

I’m getting that from:

int deviceTypeNum = XbeeUtilities.toUnsignedIntBigEndien(getSliceAfterNI(START_DEVICE_TYPE_AFTER_NI, 2));

which means that I’m pulling a 2-byte value out, 2 bytes after the end of the Network Identification in the ND response.

My attempt to try to reconcile this with 0-coodinator, 1=router, 2=end-device came from here:

but it really doesn’t line up … though if you say it’s from deviceType then if I take the least significant nibble (or perhaps byte) then it does seem to line up.

#2 - yup:

XbeeTransmitATCommand cmd = new XbeeTransmitATCommand("ND", getNextSequence());

I also have the modem set up to send a few commands ahead of time:

BH is set to 0 (max radius)
DD is set to 0xFF (but you said I couldn’t change that?)
NO is set to 3 so I can see DD values and so that the device I’m talking to (the coordinator) returns its own ND response first.

I’ve tried a few other things too including sending a remote BH1 to try to stimulate things. I really haven’t had a ton of success doing that.

As a follow-up though … I’d like to be able to see the other message as well, type 0x95 but have never seen a single one. How does one request that?

Have you Queried that specific module that is giving you a 3 to see what it actually is?