This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC2652R: Node Description Response truncated over ZNP/MT

Part Number: CC2652R

We are seeing an issue where (sometimes) on join we are getting truncated ZDO:nodeDescRsp messages from znp.

This results in the AREQ ZDO:nodeDescRsp packet being unparsable as it is shorter than defined by the MT spec.

Error while parsing ZDO:nodeDescRsp (len:6), error: Error: Expected a single parsed message got 0 from data d7d080d7d000

If we dump the NPI packet this is what we see:

fe 06 45 82 d7 d0 80 d7 d0 00 41

The FCS for this packet is valid, the packet reads as addr 0xd0d7, status 0x80, nwkaddrofinterest 0xd0d7, logicaltype_cmplxdescavai_userdescavai 0x00, (remaining missing)

The length of 6 indicates that MT was instructed to transmit a 6 byte response to the nodeDescRsp packet. Unfortunately the code responsible for handling the Zigbee -> MT handling for ZDO commands like this appears to not be within the ZNP code base (blob?).

Every time we have seen this issue the truncation is at the same point, the status is always 0x80.

From wireshark the packet looks valid:

Frame 37699: 106 bytes on wire (848 bits), 106 bytes captured (848 bits) on interface 0
Internet Protocol Version 4, Src: 192.168.1.3, Dst: 192.168.1.3
User Datagram Protocol, Src Port: 17760, Dst Port: 17760
TI Radio Packet Info
IEEE 802.15.4 Data, Dst: 0x0000, Src: 0xd0d7
ZigBee Network Layer Data, Dst: 0x0000, Src: 0xd0d7
ZigBee Application Support Layer Data, Dst Endpt: 0, Src Endpt: 0
ZigBee Device Profile, Node Descriptor Response, Rev: 21, Nwk Addr: 0xd0d7, Status: Success
Sequence Number: 228
Status: Success (0)
Nwk Addr of Interest: 0xd0d7
Node Descriptor
.... .... .... .010 = Type: 2 (End Device)
.... .... .... 0... = Complex Descriptor: False
.... .... ...0 .... = User Descriptor: False
.... 0... .... .... = 868MHz BPSK Band: False
..0. .... .... .... = 902MHz BPSK Band: False
.1.. .... .... .... = 2.4GHz OQPSK Band: True
0... .... .... .... = EU Sub-GHz FSK Band: False
Capability Information: 0x00
Manufacturer Code: 0x1015
Max Buffer Size: 80
Max Incoming Transfer Size: 80
Server Flags: 0x2a00
.... .... .... ...0 = Primary Trust Center: False
.... .... .... ..0. = Backup Trust Center: False
.... .... .... .0.. = Primary Binding Table Cache: False
.... .... .... 0... = Backup Binding Table Cache: False
.... .... ...0 .... = Primary Discovery Cache: False
.... .... ..0. .... = Backup Discovery Cache: False
.... .... .0.. .... = Network Manager: False
0010 101. .... .... = Stack Compliance Revision: 21
Max Outgoing Transfer Size: 80
Descriptor Capability Field: 0x00
.... ...0 = Extended Active Endpoint List Available: False
.... ..0. = Extended Simple Descriptor List Available: False

This test was conducted with a CC2652 is with the latest SimpleLink SDK and a Develco Motion sensor.

As we pair more and more sensors (we are currently evaluating the total capacity of our ZNP firmware & config) it does seem like it happens more and more. But that could be my bias.

Can anyone help?

  • Hi Mathew,

    I believe that this is a valid Generic ZDP response to the ZNP and that the message was not truncated.  Referring to ZDO_ProcessNodeDescReq, if the NwkAddrOfInterest does not match the short address of the destination device then it will respond with a status of ZDP_INVALID_REQTYPE/0x80 with an abbreviated ZDP_GenericRsp.  Are you sure that the wireshark packet is the only Node Descriptor Response sent from 0xd0d7?  The CC2652R ZNP does not accept a valid packet and then modify it locally to display the invalid request type error.

    Regards,
    Ryan