A single 40 MHz Wi-Fi access point covers eight Zigbee channels at once. We measured it on a real site, and it produced zigscan: a free tool that sweeps all 16 channels, measures the Wi-Fi that is actually in the building, and tells you which channel to use. With evidence, on real hardware.
When an integrator installs a Zigbee system — Control4, Hue, any home automation hub — someone has to decide which 2.4 GHz channel that network will live on. Almost always that decision is the manufacturer's default, or a rule somebody learned by heart.
Six months later the call arrives: “the lights respond slowly.” That is where it gets expensive, because the real question — is it interference, or is it the mesh? — cannot be answered by looking at the system.
Which Zigbee channel should this system use in this building? Not in general, not according to the manual: here, with the Wi-Fi and the neighbours that exist today.
Wi-Fi site survey tools have been a solved problem for years. For Zigbee the offering is different: either sniffers built for security researchers, or generic spectrum analysers that show you energy without telling you what is producing it.
What an integrator needs is simpler and more specific: how many 802.15.4 frames are on each channel, which networks are already installed there, and which channel is free. That gap is the reason zigscan exists.
This is what changed the design of the tool. Zigbee channels occupy 2 MHz each and sit 5 MHz apart. A 2.4 GHz Wi-Fi access point running a 40 MHz channel width covers, on its own, everything from 2432 to 2472 MHz.
Eight of the sixteen Zigbee channels, wiped out by an access point whose owner does not know it is running at 40 MHz.
This is why zigscan computes overlap from real frequency spans rather than by comparing channel numbers. Channel arithmetic cannot see this case: you have to measure each AP's width and project it onto the spectrum.
And the Wi-Fi is measured, not drawn. Almost every guide shows the textbook Wi-Fi 1 / 6 / 11 bands as a diagram. zigscan reads the access points actually on the air using the laptop's own card — no passwords, no special permissions.
Zigbee channels 15, 20, 25 and 26 are the ones that fall in the gaps left by Wi-Fi 1 / 6 / 11. That is the starting point — and only that, because as shown above, one AP at 40 MHz breaks the assumption.
A spectrum reading tells you a channel is busy. It does not tell you who is on it. zigscan reads the frames and reconstructs a census of the networks present: their PAN ID, their stack profile, and — where possible — the manufacturer.
The brand comes from the OUI of device addresses, the first three bytes of every 64-bit address, which identify the manufacturer. In a real test the tool reported one network with Control4 and SONOFF hardware coexisting, and found something more interesting:
A network with permit-join open will accept a new device from anyone in range. That is no longer a survey data point: it is a security finding the customer deserves to hear about.
One technical detail worth stating, because it is an easy trap: the extended PAN ID is useless for identifying a vendor. Many coordinators generate it at random rather than deriving it from a MAC. Reading a brand out of it produces a confident, wrong answer — which is worse than no answer at all.
This is the expensive question, the one that decides whether the visit takes twenty minutes or two days. And the capture already holds the answer.
802.15.4 retransmits a frame using the same sequence number. Counting repeats measures how hard the radios are working to be heard. Cross that with how busy the channel is, and the diagnosis separates itself:
On the test installation the tool measured 21 % retransmissions on channel 15 and classified it as “working, but working hard”. That number matched a problem already known on that bench: a coordinator running old firmware that produced intermittent failures.
“RF is healthy — look elsewhere.” Proving that interference is not the problem is what stops a technician spending a day chasing it.
A measurement tool that overstates its reach is worse than no tool, because it produces confident, wrong decisions. These are the limits, written into the program itself as well:
A channel with zero frames means “there is no Zigbee here”. It never means “there is no interference here”.
For the same reason, the tool refuses to recommend a channel it did not measure: an unswept channel looks exactly as empty as a clean one, and that difference is what ruins a recommendation in front of a customer.
zigscan is published under GPL-3.0, the same licence as the Electronic Cats toolchain it runs on. It is a tool for technicians, and a tool you depend on in the field should be one you can read and fix.
The radio never transmits. The survey firmware is a passive receiver: it cannot join, pair or disturb the network you are measuring. That is what makes it safe to run inside a customer's live system.
The hardware and the capture engine are Electronic Cats' work — they build open hardware in Mexico: the CatSniffer board and its toolchain, both GPL-3.0. The hard part — getting a CC1352P7 to hand you 802.15.4 frames over USB — was solved by them. If this tool is useful to you, buy the board from them.
The sniffer firmware is Texas Instruments'. Deep frame dissection is Wireshark's. zigscan is the layer on top: the one that turns all of it into a number a technician can use on site.
The tool came out of a Control4 Zigbee reverse-engineering lab — Aurora's previous investigation. Separating the analysis half from the capture half made it clear the analysis was generic: it works with any Zigbee system, from any brand. That investigation is here →