Transmission, addressing, and routing ZDO transmissions
XBee/XBee-PRO ZigBee RF Modules User Guide 69
Refer to the ZigBee specification for a detailed description of all ZigBee Device Profile services.
Sending a ZDO command
To send a ZDO command, an explicit transmit API frame must be used and formatted correctly. The source and
destination endpoints must be set to 0, and the profile ID must be set to 0. The cluster ID must be set to match the
cluster ID of the appropriate service. For example, to send an active endpoints request, the cluster ID must be set
to 0x0005.
The first byte of payload in the API frame is an application sequence number (transaction sequence number) that
can be set to any single byte value. This same value will be used in the first byte of the ZDO response. All
remaining payload bytes must be set as required by the ZDO. All multi-byte values must be sent in little endian
byte order.
Receiving ZDO commands and responses
In XBee ZB firmware, ZDO commands can easily be sent using the API. In order to receive incoming ZDO
commands, receiver application addressing must be enabled with the AO command; see the examples later in
this section. Not all incoming ZDO commands are passed up to the application.
When a ZDO message is received on endpoint 0 and profile ID 0, the cluster ID indicates the type of ZDO message
that was received. The first byte of payload is generally a sequence number that corresponds to a sequence
number of a request. The remaining bytes are set as defined by the ZDO. Similar to a ZDO request, all multi-byte
values in the response are in little endian byte order.
Example 1: send a ZDO LQI request to read the neighbor table contents of a remote
Looking at the ZigBee specification, the cluster ID for an LQI Request is 0x0031, and the payload only requires a
single byte (start index). This example will send an LQI request to a remote device with a 64-bit address of
0x0013A200 40401234. The start index will be set to 0, and the transaction sequence number will be set to 0x76
API frame
7E 0016 11 01 0013A200 40401234 FFFE 00 00 0031 0000 00 00 76 00 CE
0x0016 - length
0x11 - Explicit transmit request
0x01 - frame ID (set to a non-zero value to enable the transmit status message, or set to 0 to disable)
0x0013A200 40401234 - 64-bit address of the remote
0xFFFE - 16-bit address of the remote (0xFFFE = unknown). Optionally, set to the 16-bit address of the destination
if known.
0x00 - Source endpoint
0x00 - Destination endpoint
Routing Table Request 0x0032 Request to retrieve routing table entries from a remote device.
Network Address Response 0x8000 Response that includes the 16-bit address of a device.
LQI Response 0x8031 Response that includes neighbor table data from a remote device.
Routing Table Response 0x8032 Response that includes routing table entry data from a remote device.
Cluster Name Cluster ID Description