# ZigBeeNet: Decrypted Zigbee IoT Network Traffic Dataset in Smart Home Environment
## 7 Zigbee Network Traffic Dataset and Its Characteristics
### Network Traffic Characteristics
#### 7.2.4 Packets Distribution by Network Layer  
The dataset contains 24,679,823 captured packets and the captured traffic is distributed across different layers of the Zigbee protocol stack, which is built on the IEEE 802.15.4 standard. Zigbee operates in the lower layers (physical and MAC) defined by IEEE 802.15.4, \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Device Type** & **No** & **Device Name** & **Address** &
\begin{tabular}{c} **Number of** \\ **Packets** \\ \end{tabular} & **Percentage** \\ \hline Hub & 1 & Hue Bridge & 0 xd7a7 & 3,257,732 & 43.4\% \\ \hline Power Plug & 2 & Hue Smart Plug & 0 xe7f5 & 243,766 & 3.3\% \\ \hline \multirow{4}{*}{Smart Light} & 3 & Hue White and Color & 0 xe46c & 374,103 & 5.0\% \\  & & Ambiance Play \#1 & 0 xc370 & 384,155 & 5.1\% \\ \cline{2-6}  & 4 & Hue White and Color & 0 xc9b3 & 366,791 & 4.9\% \\ \hline \multirow{4}{*}{Smart Bulb} & 6 & Hue White and Color & 0x1d6e6 & 370,916 & 4.9\% \\  & & Ambiance Bulb \#1 & 0 xb85c & 360,000 & 4.8\% \\ \cline{2-6}  & 7 & Hue White and Color & 0 xb85c & 360,000 & 4.8\% \\ \cline{2-6}  & 8 & Hue White & 0 xa163 & 212,195 & 2.8\% \\ \cline{2-6}  & 9 & Hue White & 0 xe8 eb & 206,929 & 2.7\% \\ \cline{2-6}  & 10 & Hue White & 0x8a76 & 207,384 & 2.8\% \\ \cline{2-6}  & 11 & Held Lyardo & 0 xdfe1 & 747,588 & 10.0\% \\ \cline{2-6}  & 12 & Held Lyardo & 0 xb9f06 & 725,862 & 9.7\% \\ \hline \multirow{4}{*}{Wall Switch} & 13 & Hue Dimmer Switch & 0x6395 & 5597 & 0.1\% \\  & & (upstairs) & 0x69 bd & 5388 & 0.1\% \\ \cline{1-1} \cline{2-6}  & 14 & Hue Dimmer Switch & 0x69 bd & 5388 & 0.1\% \\ \cline{1-1} \cline{2-6}  & 15 & Hue Motion Sensor & 0x2a30 & 28,291 & 0.4\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Number of packets sent by each device on the network (without retransmitted packets). Figure 7: Zigbee traffic distribution by device type. and the higher layers consist of the Zigbee Network layer (NWK) and application layer protocols like Zigbee Device Profile (ZDP) and Zigbee Home Automation (ZHA). The packet breakdown is as follows:  
* IEEE 802.15.4 packets: A total of 10,343,419 packets (41.9%) are at the IEEE 802.15.4 layer, which includes operations at the MAC layer such as channel access and frame control. * Zigbee Network packets: A total of 6,636,492 packets (26.9%) belong to the NWK layer, handling tasks like device addressing and routing within the mesh network. * Zigbee Device Profile packets: A total of 29,989 packets (0.1%) correspond to the layer used for device discovery and management. * Zigbee Home Automation packets: A total of 7,669,923 packets (31.1%) are related to the ZHA layer, which is used for communication and data exchange between smart home IoT devices. Figure 8 presents a pie chart visualizing the proportion of packets across different layers. This distribution highlights the importance of the Zigbee Home Automation layer; with nearly one-third of the traffic dedicated to smart home devices, it contains the most significant data from an end-user perspective. Broadcast vs. Unicast  
The dataset comprises a total of 27,394,823 packets, with 5,401,398 packets (21.9%) classified as broadcast messages and 19,278,425 packets (78.1%) as unicast messages. This predominance of unicast traffic highlights the typical communication patterns in Zigbee networks, where direct device-to-device communication is preferred. To further explore broadcast traffic, we categorized packets based on different Zigbee layers, as shown in Figure 9, which presents a pie chart of overall broadcast traffic (a). The results are as follows:  
* IEEE 802.15.4 broadcast packets: 151,110 packets (1.5%)
* Zigbee NWK broadcast packets: 5,096,603 packets (76.8%)
* Zigbee ZDP broadcast packets: 18,640 packets (62.2%)
* Zigbee HA broadcast packets: 135,045 packets (1.8%)  
These findings indicate that while unicast messages dominate Zigbee communication, broadcast packets represent a significant portion, particularly within the Zigbee NWK layer.