Zigbee · site survey · free tool

That “clear” Zigbee channel in your install probably isn’t

A single 40 MHz Wi-Fi access point covers eight Zigbee channels at once. We measured it on a real site, and it produced zigscan: a free tool that sweeps all 16 channels, measures the Wi-Fi that is actually in the building, and tells you which channel to use. With evidence, on real hardware.

1

The problem: picking a channel blind

When an integrator installs a Zigbee system — Control4, Hue, any home automation hub — someone has to decide which 2.4 GHz channel that network will live on. Almost always that decision is the manufacturer's default, or a rule somebody learned by heart.

Six months later the call arrives: “the lights respond slowly.” That is where it gets expensive, because the real question — is it interference, or is it the mesh? — cannot be answered by looking at the system.

The question to answer on site

Which Zigbee channel should this system use in this building? Not in general, not according to the manual: here, with the Wi-Fi and the neighbours that exist today.

2

There is no shortage of spectrum analysers. There is a shortage of ones that speak Zigbee

Wi-Fi site survey tools have been a solved problem for years. For Zigbee the offering is different: either sniffers built for security researchers, or generic spectrum analysers that show you energy without telling you what is producing it.

What an integrator needs is simpler and more specific: how many 802.15.4 frames are on each channel, which networks are already installed there, and which channel is free. That gap is the reason zigscan exists.

3

The finding: one 40 MHz AP eats eight Zigbee channels

This is what changed the design of the tool. Zigbee channels occupy 2 MHz each and sit 5 MHz apart. A 2.4 GHz Wi-Fi access point running a 40 MHz channel width covers, on its own, everything from 2432 to 2472 MHz.

Real site measurement · 2400–2485 MHz
11
2405
12
2410
13
2415
14
2420
15
2425
16
2430
17
2435
18
2440
19
2445
20
2450
21
2455
22
2460
23
2465
24
2470
25
2475
26
2480
covered by a single Wi-Fi AP (channel 9, 40 MHz) outside that band

Eight of the sixteen Zigbee channels, wiped out by an access point whose owner does not know it is running at 40 MHz.

This is why zigscan computes overlap from real frequency spans rather than by comparing channel numbers. Channel arithmetic cannot see this case: you have to measure each AP's width and project it onto the spectrum.

And the Wi-Fi is measured, not drawn. Almost every guide shows the textbook Wi-Fi 1 / 6 / 11 bands as a diagram. zigscan reads the access points actually on the air using the laptop's own card — no passwords, no special permissions.

Practical rule

Zigbee channels 15, 20, 25 and 26 are the ones that fall in the gaps left by Wi-Fi 1 / 6 / 11. That is the starting point — and only that, because as shown above, one AP at 40 MHz breaks the assumption.

4

Who is already on the air, and which brand

A spectrum reading tells you a channel is busy. It does not tell you who is on it. zigscan reads the frames and reconstructs a census of the networks present: their PAN ID, their stack profile, and — where possible — the manufacturer.

The brand comes from the OUI of device addresses, the first three bytes of every 64-bit address, which identify the manufacturer. In a real test the tool reported one network with Control4 and SONOFF hardware coexisting, and found something more interesting:

Census output · real network
channel
15
profile
Zigbee PRO
brands
Control4 + SONOFF, read from device OUIs
signal
−48 dBm — inside this building, not the neighbour's
state
permit-join open

A network with permit-join open will accept a new device from anyone in range. That is no longer a survey data point: it is a security finding the customer deserves to hear about.

One technical detail worth stating, because it is an easy trap: the extended PAN ID is useless for identifying a vendor. Many coordinators generate it at random rather than deriving it from a MAC. Reading a brand out of it produces a confident, wrong answer — which is worse than no answer at all.

5

Interference, or the mesh?

This is the expensive question, the one that decides whether the visit takes twenty minutes or two days. And the capture already holds the answer.

802.15.4 retransmits a frame using the same sequence number. Counting repeats measures how hard the radios are working to be heard. Cross that with how busy the channel is, and the diagnosis separates itself:

retries high + channel busy
Interference. Moving the network to another channel fixes it.
retries high + channel quiet
Not RF. It is routing, distance or missing repeaters. Changing channel will not help.
retries low
The air is healthy. The problem is somewhere else.

On the test installation the tool measured 21 % retransmissions on channel 15 and classified it as “working, but working hard”. That number matched a problem already known on that bench: a coordinator running old firmware that produced intermittent failures.

The result that saves the most money

“RF is healthy — look elsewhere.” Proving that interference is not the problem is what stops a technician spending a day chasing it.

6

What the tool cannot see — and why we say so

A measurement tool that overstates its reach is worse than no tool, because it produces confident, wrong decisions. These are the limits, written into the program itself as well:

Wi-Fi
Produces no 802.15.4 frames. That is why it is measured separately, with the laptop's card.
Lutron Type X
Clear Connect Type X (RA3 / QSX) is 2.4 GHz but uses a proprietary PHY: it occupies the air and stays invisible here.
Bluetooth, microwaves
Same band, different modulation. They do not show up.
Sub-GHz
Lutron RA2 / Caséta (~434 MHz) and Vantage are in another band. Out of reach.
Idle Zigbee
A network with no activity barely speaks. A short sweep can miss it.

The rule

A channel with zero frames means “there is no Zigbee here”. It never means “there is no interference here”.

For the same reason, the tool refuses to recommend a channel it did not measure: an unswept channel looks exactly as empty as a clean one, and that difference is what ruins a recommendation in front of a customer.

7

The tool is free

zigscan is published under GPL-3.0, the same licence as the Electronic Cats toolchain it runs on. It is a tool for technicians, and a tool you depend on in the field should be one you can read and fix.

What you need
Antenna
Electronic Cats CatSniffer v3.x — with a 2.4 GHz antenna fitted
Firmware
TI sniffer. It does not ship fitted; the manual covers both stages
Laptop
macOS. Drag to install; the app opens your browser on its own
Network
Only to install. After that it works offline — job sites rarely have usable Wi-Fi

Code, manual and download on GitHub →

The radio never transmits. The survey firmware is a passive receiver: it cannot join, pair or disturb the network you are measuring. That is what makes it safe to run inside a customer's live system.

8

What it is built on

The hardware and the capture engine are Electronic Cats' work — they build open hardware in Mexico: the CatSniffer board and its toolchain, both GPL-3.0. The hard part — getting a CC1352P7 to hand you 802.15.4 frames over USB — was solved by them. If this tool is useful to you, buy the board from them.

The sniffer firmware is Texas Instruments'. Deep frame dissection is Wireshark's. zigscan is the layer on top: the one that turns all of it into a number a technician can use on site.

The tool came out of a Control4 Zigbee reverse-engineering lab — Aurora's previous investigation. Separating the analysis half from the capture half made it clear the analysis was generic: it works with any Zigbee system, from any brand. That investigation is here →

zigscan · free tool under GPL-3.0 · built on Electronic Cats' CatSniffer hardware and toolchain, and on Texas Instruments firmware. The measurements quoted come from real captures taken on our own test bench. Not affiliated with Electronic Cats, Texas Instruments, Control4 / Snap One, SONOFF or Lutron.