Sonoff zbmini changing short network (NWK) address?

[deviantintegral]

I had one of my two ZBMINI switches go offline recently. I was away, so there were no real changes being made to the network. There were no power outages or anything like that.

I did some investigation with wireshark, and discovered that the network address changed! z2m had it as 0x8BB3, but it was reporting with 0x54ed when I flipped the physical switch. This also had the side effect of knocking a few end devices that were using it as a router.

To test, I was able to stop zigbee2mqtt and edit the database.db file, changing the network address to the decimal equivalent of 21741. I restarted, and the zbmini showed up soon after.

I also pulled out the database from a backup of about a month ago, and it had the original NWK of 0x8BB3. So, I don't think this is a z2m or herdsman bug somehow corrupting the NWK.

Has anyone else ever seen any behaviour like this with the zbmini or other devices? I would expect the NWK to only change when pairing a device, and if the zbmini fully reset I'd expect it to lose the encryption keys too.

[Koenkk]

This is nothing strange, Zigbee devices can change their network address (but never their ieee address).

[deviantintegral]

Ah, makes sense.

So then, I wonder why z2m didn't detect the address change? According to the thread at https://community.nxp.com/t5/Wireless-Connectivity/Why-does-the-short-address-of-the-device-change/m-p/1022898 and the ZCL spec, there's supposed to be a set of network status frames that are sent to indicate the new address. I suppose those could be missed if an address change happens while z2m is down. Is there code in herdsman that's supposed to handle seeing the address change outside of those frames? I'm thinking I can try flipping changing the NWK in the database again, and see why z2m never updated its database.

[Koenkk]

The link status messages are not forwarded to zigbee-herdsman by the zigbee stack. But z2m updates the network address on a device announce: https://github.com/Koenkk/zigbee-herdsman/blob/0a0621159d366d81d3ef8ba5da548104ad4dd3fc/src/controller/controller.ts#L446

[deviantintegral]

Thanks. My guess is either the device never sent a a network update command (see herdsman, or the zigbee spec at "3.4.10 Network Update Command"), or it did but z2m was down at the time.

What I know for sure is that the packet capture I have from 2 days later, for around 45 minutes, didn't capture any network update commands.

Unfortunately I didn't have debug logging on, so I don't have a log message from z2m.

It looks like this case is supposed to be handled already at https://github.com/Koenkk/zigbee-herdsman/blob/0a0621159d366d81d3ef8ba5da548104ad4dd3fc/src/controller/controller.ts#L547-L554. I manually modified the database again, and after a minute z2m correctly fixed up the NWK. If this happens again, I'll look deeper to see if I can figure out why this wasn't working earlier.

[deviantintegral]

A quick update that this happened again to the same device. Again, I didn't have debug logging on (it figures that I turned it off yesterday!), and it was the same fix to update the short address. Since its been 4 months since this happened, and has only happened to one of the two zbminis I have installed, I think this must most likely be an issue with my network topology or the specific device.

[deviantintegral]

I continued to have this issue every 4-6 months. Yet a second one installed has worked fine for years now.

I replaced the relay with a new ZBMINI I had (it was a 4 pack) in June and so far it hasn't dropped. But it will take several more months before I can say that the problem was with that one device.

[saveriol]

Hello!
In #20045 devices change address but this is not reflected in Z2M.

It looks like this case is supposed to be handled already at https://github.com/Koenkk/zigbee-herdsman/blob/0a0621159d366d81d3ef8ba5da548104ad4dd3fc/src/controller/controller.ts#L547-L554

So I don't think this is working.

[saveriol]

I see! The ember adapter code is also very obscure for me compared to the z-stack one...
In any case if this gets merged I'll get a z-stack adapter ;)

[Nerivec]

I haven't had that issue with over a dozen ZBMINI. Must be different firmware versions (they could have changed the code and not the reported version...).
Seems like the device changes address but isn't advertising it on reconnect. Does it work again if you power-cycle the ZBMini (without any manual change)?

@deviantintegral Sidenote: a lot of methods in silabs code have multiple names but point to the same place, and several are just wrappers for basic ZDO requests (like that one).

[deviantintegral]

No, it doesn't work if I power cycle the zbmini :(

Mine have firmware date 20200927. I do have a vague memory of them having two different firmwares for it - but no published firmware updates or update support.

One difference might be that my garage light (which is where I see this problem) doesn't have a direct connection at all to the coordinator, whereas my kitchen table light (which has been fine for years) does.

[Nerivec]

Indeed mine are all 20210320/2.0.0. Though as I mentioned, I don't particularly trust that dates/versions get properly updated whenever they actually compile a new version, since these are manually set, especially for devices that don't support OTA or never (will) get firmware updates.

Can you lookup which router it is connected to (if it's one of the usual troublemakers, Tuya, Aqara...)? Might be something there, if the message gets lost, or is not passed to the coordinator... Would need sniffing to get more details though.

[deviantintegral]

When I last looked, it was routing through Hue bulbs. I've also seen it route through Enbrighten light switches. However, I think this was fixed in Koenkk/zigbee-herdsman#1194. So far, I've had no drops!