# ZigBeeNet: Decrypted Zigbee IoT Network Traffic Dataset in Smart Home Environment
## 7 Zigbee Network Traffic Dataset and Its Characteristics
### Network Traffic Characteristics
#### 7.2.6 Packet Transmission Analysis  
In this subsection, a detailed analysis of the packet distribution within the captured Zigbee network traffic is presented. Specifically, the focus is on the proportion of packets originating from devices (source packets), packets retransmitted by intermediate devices (relay packets), and packets transmitted directly between devices (direct packets). This analysis is conducted across three distinct layers: Zigbee NWK, Zigbee ZDP, and Zigbee HA. The insights are based on a comprehensive breakdown of packet traffic and can be visualized through Figure 10 which illustrate the packet distribution across the layers.  
Overall Packet Distribution Across Zigbee Layers  
Across all layers above or equal to the Zigbee stack, we observed a total of 14,336,403 packets. Of these, 52.3% were source packets, while 47.7% represented retransmitted packets. Direct packets, i.e., packets transmitted directly from one device to another without intermediate retransmission, made up 22.2% of the overall traffic. This indicates a significant reliance on retransmission mechanisms within the Zigbee network, likely due to the inherent nature of mesh networking protocols (Figure 10a).  
Source packets: 7,496,697 packets (52.3%);  
Relay packets: 6,839,706 packets (47.7%);  
Direct packets: 3,181,136 packets (22.2%).  
Packet Distribution in the Zigbee NWK Layer  
Focusing solely on the Zigbee NWK layer, which forms the fundamental communication framework for all Zigbee devices, we observed a total of 6,636,492 packets. The majority of these packets (64.8%) were retransmitted by intermediate devices, highlighting the extensive role of relaying in maintaining connectivity within this layer. Direct communication, on the other hand, was minimal, accounting for only 0.1% of the traffic (Figure 10b).  
Source packets: 2,333,492 packets (64.8%);  
Relay packets: 4,302,999 packets (35.2%);  
Direct packets: 7269 packets (0.1%).  
Packet Distribution in the Zigbee ZDP Layer  
Within the Zigbee Device Profile layer, which facilitates management and control functionalities such as device discovery and binding, we captured a total of 30,335 packets. Source packets accounted for 23.4% of the traffic, while relay packets made up the bulk,  
Figure 9: Comparison of (**a**) broadcast vs. unicast and (**b**) broadcast packet distribution by Zigbee layer.  
contributing 76.6%. Direct communication at this layer remains negligible, constituting only 1.2% of the total traffic (Figure 10c).  
* Source packets: 7019 packets (23.4%);
* Relay packets: 22,970 packets (76.5%);
* Direct packets: 346 packets (0.1%).
* Packet Distribution in the Zigbee HA Layer  
The Zigbee Home Automation layer, responsible for communication between devices in smart home environments, exhibited a significantly different distribution of packet types compared to other layers. Out of 7,669,923 packets, a significant portion (41.4%) were direct packets, reflecting the nature of home automation systems, where devices often communicate directly. In contrast, relay packets comprised 32.8% of the traffic, while source packets accounted for 67.2% of all packets (Figure 10d).  
* Source packets: 5,156,186 packets (67.2%);
* Relay packets: 2,513,737 packets (32.8%);
* Direct packets: 3,173,521 packets (41.4%).  
The analysis of packet distribution across the various Zigbee layers reveals distinct communication patterns. While the Zigbee NWK and ZDP layers rely heavily on retransmission, the Zigbee HA layer shows a preference for direct communication, likely due to the topology and proximity of devices in home automation environments. This variability in packet transmission behavior is crucial for understanding the efficiency and reliability of Zigbee-based networks in different applications.