Perhaps a side conversation for the zniffer process
#zniffer for SWM 150
turbid chasm
@tame lake @high dawn should be getting my zniffer today and wanted to make a side conversation for this so I don't flood the main channel with my questions/findings...if that is ok with you
I wanted to ask, during the pairing process, is there a bunch of information that is being shown?
Once the device is paired to my account, the only things I can change is on my end is whether or not I would like to turn off the water valve is a low, medium or high threshold is met and to mute local buzzer on a water alarm.
There are a few back-end configurations, that only my dealer can do for me. such as as calibration of the meter, changing of the low, medium and high thresholds. If I have to ask my dealer to send these commands to the unit while i'm zniffing, that won't be an issue as he can do it for me no problem (unless this information is exposed on pairing/inclusion)
To make a list of what was missing when I pairied with z-wave js:
- ability to change low, medium and high water flow thresholds (alarm)
- consumption of water
- calibration of meter
- Low flow alarm was not actually working (I do have an active leak in my home).
turbid chasm
couple screenshots for the configuration UI
The above options are the ones that I do not see in Z-Wave Js
tame lake
Those could be Irrigation CC instead of config params.
not sure about timer or temp
how do you know they are not configuration parameters?
do you have a list of command classes the device supports?
If you do an inclusion, it will show everything that is interviewed. Unless the controller is getting information from some external configuration, it will show everything supported.
west nova
Thanks for spinning up this thread, I'm interested in the zniffer stuff you see and how it is used
turbid chasm
how do you know they are not configuration parameters?
they could very well be configuration parameters
turbid chasm
do you have a list of command classes the device supports?
command classes here, but I think I saw more when it was in z-wavejs https://ibb.co/JRcNWKy
also, this is the photo I wanted to show yesterday when I included it without S2, I just unchecked these two boxes https://ibb.co/DVDS8Qp
turbid chasm
I think you're right, there are more for sure.
turbid chasm
Fedex Delivery delayed 😭 we had a cold snap went down to -36 oC this morning probably some of their trucks did not start today 😀
turbid chasm
Out for delivery!
ok, looks I have to install some Studio code, and the add the zniffer tools and dev tools addon
on my Windows 10 64-bit machine
turbid chasm
sorry, I mean Z-Wave Programmer and Z-Wave Zniffer. I presume this what I need to install?
tame lake
Yeah. Those are separate, small downloads. Studio is a giant download with tons of extra stuff. You do need to create an account to download either.
turbid chasm
they may have changed it, it seems I do I have to download simplicity studio, first
tame lake
Did you click on the links?
Hmm, both links give me the same Programmer download
The Zniffer from Studio does not include the necessary firmware.
turbid chasm
when I click on the two links for Z-wave Programmer and Z-wave Zniffer, I get the message "Please download either a Controller SDK or Embedded SDK before downloading Z-Wave tools. Contact support if any queries."
im signed in
tame lake
Yeah, you have to do what it says. Download one of the SDKs so you agree to the terms of use.
turbid chasm
ok, will report back as I navigate the this....
tame lake
This forum post has the hex file (firmware). https://community.silabs.com/s/question/0D58Y00008fKLuySAG/to-convert-a-uzb-controller-to-a-zniffer-where-to-download-the-firmware-image-snifferzw050xusbvcphex
They have removed the standalone Zniffer download, so unfortunately you will need to download and install Studio.
turbid chasm
ok, thanks let me follow this.
high dawn
They have removed the standalone Zniffer download, so unfortunately you will nee...
I think they hid it in the sample application zip on their github
tame lake
Doesn't look like it. The demo zip is just a bunch of gbl/hex files.
tame lake
Neither
turbid chasm
the eagle has landed
I actually have Simplicity studio already installed from when I had to update my gen 7 stick's FW
updating SS
turbid chasm
Z-Wave Zniffer - 4.66.106 is installed in SS
im trying to see if I need the Z-Wave Programmer addon or if its already installed
do I need this one?
turbid chasm
I seem to have PC Controller and Z-Wave Zniffer installed already
I don't see PC Programmer
tame lake
https://bishopfox.com/blog/set-up-zniffer-for-z-wave, which was given earlier
you can only flash the zniffer firmware with PC Programmer
PC Controller is not involved in this endeavor
turbid chasm
ok, that makes sense
but I can't get past this step
"Please download either a Controller SDK or Embedded SDK before downloading Z-Wave tools. Contact support if any queries."
where is this controller SDK or Embedded SDK?
tame lake
turbid chasm
alright, everything going well in terms of the Z-wave progammer, its installed and running
however, I cannot download the zniffer software
when I click on the link, it just redownloads the programmer software
turbid chasm
sorry, I'm at he part where I have to flash my usb dongle
tame lake
you use PC Programmer to flash with the zniffer firmware file
turbid chasm
yes but I don;t have the file
tame lake
turbid chasm
because I cannot download the zniffer program
tame lake
turbid chasm
flashing as we speak!!
by the way, I found some more detailed instructions here:
slow AF but its going ....please don't brick 🙂
14446/131072 bytes written....so far
sucess!
done
so now, I go into Simplicity studio and start zniffing?
tame lake
Well, Zniffer via SS
if it's installed you can just go to the SS directory and open it
tame lake
nice
turbid chasm
here's what I see.
I dont know what is sensitive so just blocked a part out
how do I identify the device?
I think its multilevel sensor
FD34F7E5
turbid chasm
ill have to check what security panel node # it is
because now I have my zwave js network (22 devices) and my security panel has 2 devices
probably my neighbors z-wave devices, too (if they have it)
tame lake
you can filter on home ID
turbid chasm
Okay I'm going to get back at this in a bit my wife is telling me dinner is ready and I have to take the kids out for a walk!
Thanks so much @tame lake for getting us here couldn't have done it with all your help
turbid chasm
this is so cool, I found the home ID for my panel, and I can clearly see the device.
I pressed the valve close button and then valve open button and you can see the commands being sent for that here
so when you press open (or close) it takes 5 seconds of each actions, and then it sends report
the only other device I have on my security panel is a z-wave siren
tame lake
The valve open/close should work with Z-Wave JS and HA
turbid chasm
yes, it works, but this I just wanted to confirm that we are seeing the device
tame lake
time to set some configuration settings then
turbid chasm
so what is the next step? exclude and include
at the moment, do I have an active leak in my house, a low flow alarm is on
so that might also be pinging
tame lake
nothing in that screenshot would constitute an "alarm", it would be the software interpreting something
could have been reported earlier
Notifications are typically alarm type messages
turbid chasm
great! I think the alarms worked in HA/Zwave-js
tame lake
The Multilevel sensor reports might be water type readings.
turbid chasm
water usage probably
or temperature actually because I just saw a meter report show up
tame lake
The Zniffer might decode them for you, can't remember. Click on a frame it it shows details.
turbid chasm
oh yeah your right! there is some extra information
tame lake
it's also easy to decode the hex data
turbid chasm
heres what I see when I expand a meter report
see meter value, that is one thing that did not work in HA/Zwavejs, it was not reporting consumption, just instant flow rate
i guess from flow rate you can calculate total consumption (hourly, daily, weekly, monthly, yearly etc)
what is the hex data saying? im trying to decode it online but getting garbled stuff
for example
FD 34 F7 E5 2E 41 03 19 01 32 02 23 64 00 01 0C 45 01 DD 00 01 0C 3B 59 94
tame lake
Your screenshot shows the reports are consumption (import)
you can see the hex values in the details
turbid chasm
ahh, ok
ok...I still have to take the kids out for a walk....I can try changing parameters, configurations, and reinterview....can I export this data?
tame lake
you can save the trace. anyone with the zniffer software can load it.
turbid chasm
ok, ill give this a shot....I think what I will try first in remove and then learn the device back into my panel while its zniffing....good first step?
tame lake
sure, why not.
you'll have to be methodical with the config settings, in order to map the UI to the zniffer messages.
Sometimes the interview of Config CC, the device will report some characteristics.
turbid chasm
I can use time?
tame lake
Time, probably. At time X, you set this setting to this value, etc.
turbid chasm
correct! Ok, we have a plan
tame lake
Can't you annotate the frames?
turbid chasm
does not look like I can
tame lake
Thinking the icon that looks like a piece of paper does.
Or, the Bubble next to Save
Maybe the bubble is a single comment
Guess you can't
You can also use line numbers
Anyways, you get the idea.
If you're lucky, the Config CC version will be the latest and the interview will show parameter names and default/min/max values.
turbid chasm
Maybe the bubble is a single comment
this does allows you to comment, but not while its capturing unfortunately, but I can add my notes later to this list and save the file so then my comments can be saved
tame lake
Yeah, I was hoping for a per-frame annotation feature, but that doesn't seem to exist.
turbid chasm
lets hope the interview process gives us everything we need, fingers crossed.
I'll try this in the next couple of hours
turbid chasm
lots of traffic on inclusion!
tons of "Configuration Set"
and "Configuration Get"
I think once its included, it gets commands from alarm.com to set the defauls
before I forget, inclusion date time Dec 7,2022. 21:32 MST
when I send the file
link for file here:
inclusion.zlf
home: FD34F7E5
I ran water from 21:44 to 21:47 (towards the end)
so the file captures inclusion process plus some running water
please let me know what you see!
high dawn
I'm unable to check that file for now. I'll let you guys check it 😇
tame lake
Nothing that interesting from my POV. There are some Config gets and sets. You can compare it to Z-Wave JS later.
tame lake
When the water is on there are meter reports, water flow and water temp notifications. z-wave js supports all of those.
high dawn
I think the main point was to figure out the undocumented config params? Which is which, range, value size, (default)?
tame lake
Yeah, I thought so as well.
The interview shows a possible set of config param numbers, but no meaning behind them.
turbid chasm
Maybe I can shed some light on this, I would say that the device is like 75% supported in zwave js. I can tell you what I don't see...
I don't see of have the ability to set these parameters here:
and there is something up with the low flow alarm condition
I do have an active leak in my home, low flow. Its not untill I add the device to alarm.com and then back to zwavejs that I actually see the low flow alarm
the low flow sensor has something to do with the voltage sensor
whereas the medium and high flow alarms work
but it uses the other sensor (the flow rate sensor)
tame lake
You're going to have to figure out how those are implemented I think.
turbid chasm
I think you mean I have to change the parameters above, and intercept that?
tame lake
That is part of it. How do you know the settings are related to configuration parameters? Maybe they are part of the software, and the alarms are set based on readings.
turbid chasm
you're right, I don't know that at all
tame lake
So yeah, to start with. Change a setting, see if there's anything in the zniffer associated with it.
turbid chasm
ok, i'll have to get my dealer to do some of the settings. I don't have access on my UI for some of these settings such as
- changing the temperature units
- Volume units
- set irrigation defaults
- meter calibration
- high flow threshold
- high flow timer
- med flow threshold
- med flow timer
- low flow timer
- high and low temp threshold
however, it does sound like some of these are software-based
tame lake
There aren't any interesting z-wave alarms in the trace. I think see a water temperature alarm going to idle (not alerted).
turbid chasm
its possible that alarm already happened or happened after the trace
tame lake
There's also a system heartbeat notification.
Right
Pretty sure z-wave js supports all the possible notifications
turbid chasm
if I factory default the the device and add it to z-wavejs, it does not pick up the low issue....just the med and high flow alarms
tame lake
could be one of the config settings being set to adjust a low flow alarm value. maybe the default higher than needed for your install.
low flow temperature?
tame lake
param 6 is reported as 0x4
turbid chasm
its possible my water is cold and below 4oC right now
is it low temperature or low flow?
perhaps both
but they would be separate
tame lake
I don't see a "low flow" setting in the pdf, what is it?
turbid chasm
low flow timer, on page 2
by the way. do you see anthing with water consumption? that never worked either...the number just stayed the same
turbid chasm
if you look at the last 4 minutes of that trace, does the value for consumption change? I think its meter report
tame lake
yes, it changes
turbid chasm
great! that might need to be fixed because I didn't see a change for the water consumption sensor in JS
it basically just read the starting value, and stayed at that value
tame lake
You'd need a full Z-Wave JS driver log of the interview and afterwards.
Looking at one of your logs, yeah there are no meter reports for water after the initial
perhaps enabling meter reports is some config option being set.
turbid chasm
that would be good too
turbid chasm
You'd need a full Z-Wave JS driver log of the interview and afterwards.
I have not done this yet, just aftewards.
this would be good too
tame lake
The zwavejs_2022-08-11.log file seems to be an interview.
turbid chasm
oh you're right, I remember now
tame lake
Lifeline association group looks good.
turbid chasm
I can redo that once I'm back in js
What I could try next is just me changing the parameters (that I can change)...which is basic, I only have 6 of them, for example, turn the local buzzer on or off on alarm, and turn the valve on or off on alarm for each low, medium and high flow condition. I just emailed my dealer, hopefully he agrees that he can also change some settings on his end (ie this list #1049736024605081741 message and here https://github.com/zwave-js/node-zwave-js/files/9325135/Water.Shut.Off.and.Meter.-.Setting.Options.pdf) and i'll try to match the time stamp for this
tame lake
Yeah. I wonder how they (Building 36) get away with not publishing the config params.
turbid chasm
by the way, there is a voltage sensor and pulse sensor...any ideas what these are for? I think for the low flow alarms (i.e. the leaks that are just dripping), I believe it uses the voltage sensor for this. For example, see this photo here (from an alarm.com field technician), he simulated a low flow leak, and you see the voltage spikes. Here's the photo, at the end of this comment https://github.com/zwave-js/node-zwave-js/discussions/4902#discussioncomment-3377776
I always thought that config parameters don't have to be shared because the z-wave backend manuals website says that the company is not affiliated with this and there could be errors...but I wouldn't know
tame lake
Well, I believe certification requires it to be published. They are using Z-Wave logos on the product, which I also thought meant you had to be certified.
turbid chasm
interesting. maybe its not certified, but then how can you sell it? interesting
tame lake
Not sure, you could try contacting the Z-Wave Alliance and see if they have any details.
I think someone else contacted them about a product and got some kind of response.
turbid chasm
actually, I did contact them and the told me to contact the manufacturer. I've probably sent them (B36) like 15 emails (a few different people) not 1 response.
high dawn
Well, I believe certification requires it to be published. They are using Z-Wave...
Maybe they certified a different firmware and never re-certified after adding parameters
tame lake
they have a different product in the DB, but not this one.
turbid chasm
I think I've seen the regular on/off valve product from B36, not the valve + meter, which is the device we're trying to probe right now
tame lake
yeah
turbid chasm
Well I spoke to my dealer he didn't say yes but he didn't say no either, to send those back-end commands so that I can zniff them.
turbid chasm
Long Live open source open home
The only thing I can do on my end is like I said turning the buzzer on and off on alarm and automatically shutting the valve off on alarm. I can get those commands for you tonight (I'm in MST time zone) ... but these sound like software things because I can easily do this with Z-Wave JS and automations
west nova
thats when you say "nope, i dont think it worked, try again.... maybe again.... try the other one now"
"lets just go through them all"
turbid chasm
exactly, I can say I think my water is too cold can you please change the threshold to +7oC 🙂 I want to know sooner before I drink a cold glass of water and my teeth shatter
or wait, the meter is off, can you please calibrate it lol
high dawn
I guess what we mainly need to know using their help is which config param (number, size) does what. Once we know that you can just figure out the limits through trial and error in zwave-js
turbid chasm
I guess what we mainly need to know using their help is which config param (numb...
you're right, but we can't see this with zniffing?
tame lake
if said dealer applies every single option possible, sure
turbid chasm
got it ok
high dawn
You need some way to correlate it though
turbid chasm
i'll work on my dealer....give him a bottle of scotch
high dawn
That sounds like a plan
tame lake
how does the parameter scanning work? the zniffer show param numbers not listed in that output.
high dawn
how does the parameter scanning work? the zniffer show param numbers not listed ...
In Config CC v3, each response tells us the next param number, if that's what you mean
There's also the "legacy" scan but I don't think any application exposes it, which just tests every param from 1 to 255
tame lake
Yeah, that one
high dawn
Just 255 gets in a row
tame lake
Huh. They are setting some that don't show in that list.
high dawn
Waiting for a response or timeout
tame lake
Possibly write only?
high dawn
Possible
Makes figuring out the limits interesting
Without being able to verify the changes
tame lake
Definitely
turbid chasm
on the dealer end, there is setting to "set irrigation defaults", I wonder if this basically sends several commands one after other, that would be a good zniff
turbid chasm
Did another capture.
Here are all the options that I see on my end.
https://ibb.co/ts4w0Lf
What I did was starting from the top, I selected the option and turned it on, saved, then turned it off, and saved again. I repeated the medium flow one.
And here is the time stamps and actions list.
and here is the associated capture file
https://filetransfer.io/data-package/YXSMTgbV#link
hopefully some more information arises from this capture
I should also say that every one of those options resulted in some configuration set on the device itself
high dawn
Any chance you can collect all these attempts in a single location?
So I don't have to scroll through 1000 messages to find everything when I have time to look at it
turbid chasm
I can try to do this, but if you filter by home FD34F7E5, I only have 2 devices the water valve device and a zwave siren. The siren is not so chatty.
Is this what you are asking? Please let me know how I can make this easier for you.
high dawn
Is this what you are asking? Please let me know how I can make this easier for y...
I'm on mobile mostly so I can't check what's behind the links and in the captures. I'll try to do this in January, ideally I only have to download one archive with everything in it, captures and description
turbid chasm
Ok, I will try to consolidate everything for you by January!