ZB Packet Utility

Zigbee Frame Decoder

Decode Zigbee IEEE 802.15.4 MAC frame hexadecimal bytes and inspect the frame-control field, frame type, security flag, PAN ID compression, sequence number, addressing modes, source and destination PAN IDs, MAC addresses, payload and optional FCS.

✓ IEEE 802.15.4 ✓ Frame Control ✓ PAN IDs ✓ 16/64-bit Addresses ✓ MAC Payload

Zigbee Frame Decode

● Ready

Frame Interpretation Designed for the classic MAC data-frame structure commonly encountered with Zigbee traffic.

FCS Handling Packet-capture tools may include or omit the two-byte MAC Frame Check Sequence.

Zigbee / IEEE 802.15.4 Frame Hex Bytes Spaces, commas, colons and hyphens are accepted. Continuous hexadecimal input and 0x-prefixed bytes are also supported.

Decoder scope: this calculator decodes the IEEE 802.15.4 MAC frame structure used by Zigbee. Zigbee NWK, APS and ZCL payload interpretation depends on the specific upper-layer frame, profile, cluster and sometimes security keys. Encrypted payload data cannot be meaningfully decoded without the required security context.

Zigbee Frame Decode Result Frame Decoded

Decoded Frame —

Frame Type —

Frame Control —

Sequence Number —

Security Enabled —

ACK Request —

PAN Compression —

Destination PAN —

Destination Address —

Source PAN —

Source Address —

MAC Payload —

Frame Length —

Byte-Level Decode Breakdown —

What Is a Zigbee Frame Decoder?

A Zigbee Frame Decoder helps inspect hexadecimal packets captured from a Zigbee wireless network. Zigbee uses IEEE 802.15.4 for its lower physical and MAC layers, so a raw Zigbee packet commonly begins with an IEEE 802.15.4 MAC header.

The MAC header can reveal the frame type, sequence number, addressing configuration, PAN identifiers, source and destination addresses and whether MAC-layer security is enabled. Bytes remaining after the MAC header form the MAC payload and may contain a Zigbee network-layer frame.

IEEE 802.15.4 Frame Control Field

The first two MAC bytes form a little-endian 16-bit Frame Control Field, usually abbreviated FCF. Individual bits describe how the remainder of the frame should be parsed.

FCF Bits	Meaning
0–2	Frame Type
3	Security Enabled
4	Frame Pending
5	ACK Request
6	PAN ID Compression
10–11	Destination Addressing Mode
12–13	Frame Version
14–15	Source Addressing Mode

Zigbee Addressing Modes

IEEE 802.15.4 frames can omit an address or use either a 16-bit short address or a 64-bit extended address. Multi-byte addresses are transmitted least-significant byte first.

Raw address bytes:
78 56

Displayed 16-bit address:
0x5678

Raw extended-address bytes:
08 07 06 05 04 03 02 01

Displayed address:
01:02:03:04:05:06:07:08

PAN ID Compression

When source and destination devices belong to the same PAN, some classic IEEE 802.15.4 frame layouts can omit the source PAN ID and reuse the destination PAN ID. This is indicated by the PAN ID Compression bit in the Frame Control Field.

Correctly applying this rule is important because assuming that another PAN ID is present shifts every following byte and produces incorrect source addresses and payload offsets.

Zigbee MAC Payload vs Zigbee NWK Payload

The bytes following the IEEE 802.15.4 MAC header are the MAC payload. For a Zigbee data packet, these bytes can begin a Zigbee Network Layer (NWK) frame.

A complete Zigbee protocol decoder may subsequently need to interpret NWK frame control, destination and source network addresses, radius, sequence number, APS headers, clusters, endpoints, ZCL commands and security fields. Those meanings should not be guessed from arbitrary bytes.

Example Zigbee MAC Frame

41 88 5A CD AB 34 12 78 56 48 65 6C 6C 6F

FCF bytes:
41 88

FCF:
0x8841

Sequence:
0x5A

Destination PAN:
CD AB → 0xABCD

Destination:
34 12 → 0x1234

PAN compression:
Enabled

Source address:
78 56 → 0x5678

Remaining payload:
48 65 6C 6C 6F

What About Zigbee Encryption?

Zigbee commonly protects network traffic using AES-based security. A packet capture can still expose some structural fields, but encrypted payload bytes cannot be converted into meaningful application data merely by interpreting them as hexadecimal values.

Decrypting protected traffic requires the appropriate network or link key, security header information, frame counter and nonce-related context. This tool therefore reports the bytes structurally rather than inventing decoded application values.

Zigbee Frame Decoder FAQs

Does Zigbee use IEEE 802.15.4?

Yes. Zigbee uses IEEE 802.15.4 for the PHY and MAC layers and adds its own network and application layers above them.

Why are Zigbee addresses reversed?

Multi-byte IEEE 802.15.4 address and PAN ID fields are transmitted little-endian, so packet bytes may appear reversed compared with their usual human-readable hexadecimal form.

What is an IEEE 802.15.4 short address?

It is a 16-bit address that can identify a device within a PAN after network association.

What is a Zigbee extended address?

It is the device’s 64-bit IEEE address. Packet captures store its octets in the protocol’s transmitted byte order, while tools often display it in reversed human-readable order.

What is PAN ID compression?

It is an IEEE 802.15.4 MAC-header mechanism that can avoid transmitting a redundant PAN identifier in applicable addressing configurations.

Does the frame always contain an FCS?

The transmitted MAC frame has a Frame Check Sequence, but capture hardware or software may remove it before presenting packet bytes to you.

Can this decoder decrypt Zigbee packets?

No. Structural decoding and cryptographic decryption are different tasks. Protected Zigbee payloads require the appropriate keys and security context.

Can this decode Zigbee ZCL commands?

This page focuses on the underlying IEEE 802.15.4 MAC frame. A complete ZCL interpretation additionally requires valid Zigbee NWK and APS parsing and cluster-specific context.

Decode Zigbee Frame Hex Bytes

Inspect IEEE 802.15.4 MAC headers, addressing fields, PAN identifiers, frame-control flags and payload boundaries before analyzing higher-level Zigbee protocol data.