# ZigBeeNet: Decrypted Zigbee IoT Network Traffic Dataset in Smart Home Environment
## 7 Zigbee Network Traffic Dataset and Its Characteristics
### Network Traffic Characteristics
#### 7.2.7 Message Types and Layers  
In this section, we analyze the percentage distribution of packet types based on the protocol layer. The dataset used for this analysis includes various message types observed in the IEEE 802.15.4, Zigbee NWK, ZDP, and HA layers. The distribution of packet types across these layers provides insights into the structure and behavior of Zigbee network traffic.  
1. IEEE 802.15.4 Layer  
At the IEEE 802.15.4 layer, the majority of traffic consists of acknowledgment (ACK) messages, which are crucial for ensuring reliable communication in the network. Below is the breakdown:  
* ACK: 9,484,056 packets (91.9%);  
Figure 10: Packet transmission by network layer type: (**a**) overall, (**b**) Zigbee NWK, (**c**) Zigbee ZDP, (**d**) Zigbee HA.  
* Data request: 524,684 packets (5.1%);
* Data: 243,481 packets (2.4%);
* MLE: 57,118 packets (0.5%);
* Reserved: 4716 packets (0.1%).  
The overwhelming dominance of ACK messages (nearly 92%) reflects the importance of confirming data transmissions in Zigbee networks (Figure 10(a)).  
(2) Zigbee NWK Layer  
At the Zigbee NWK layer, the primary message types are related to routing operations, with route request and route record messages forming a significant portion of the traffic:  
* Route request: 3,954,354 packets (59.7%);
* Route record: 1,494,214 packets (22.5%);
* Link status: 1,142,182 packets (17.2%);
* APS ACK: 36,962 packets (0.6%).  
This layer's traffic is heavily focused on route discovery and maintenance, essential for mesh networking in Zigbee environments (Figure 10(b)).  
(3) Zigbee ZDP Layer  
At the ZDP layer, the traffic consists of control and network management messages, where network address request and response dominate:  
* Network address request: 17,485 packets (58.3%);
* Network address response: 9454 packets (31.5%);
* Device announcement: 1623 packets (5.4%);
* Match descriptor request: 986 packets (3.3%);
* Others: 441 packets (1.5%).  
These packets are critical for managing the addressing and discovery functions in the network; most of them are responsible for providing the network address (Figure 10(c)).  
Figure 11: Packet type distributed by network layer type: (**a**) IEEE 802.15.4, (**b**) Zigbee NWK, (**c**) Zigbee ZDP, (**d**) Zigbee HA.  
(4) Zigbee HA Layer  
The Zigbee HA layer handles messages related to device interaction and control, such as attribute readings and responses. The message distribution reveals heavy traffic in commands related to color and level control:  
* Read attributes color control response: 1,572,441 packets (20.5%);
* Read attributes color control: 1,375,916 packets (17.9%);
* Read attributes manufacturer-specific response: 1,178,953 packets (15.4%);
* Read attributes manufacturer-specific: 961,510 packets (12.5%);
* Read attributes on/off: 526,775 packets (6.9%);
* Read attributes on/off response: 513,430 packets (6.7%);
* Read attributes level control: 524,053 packets (6.8%)
* Read attributes level control response: 510,048 packets (6.7%);
* Others: 506,797 packets (6.6%).  
The Zigbee HA layer shows a high volume of attribute reporting and responses, particularly related to lighting control (color control and on/off commands), reflecting the network's use in smart lighting applications (Figure 11d).  
The analysis of network traffic across different layers reveals the distinct roles that each layer plays in the Zigbee protocol stack. While the IEEE 802.15.4 layer is dominated by ACK messages, ensuring communication reliability, the Zigbee NWK layer focuses on routing, and the ZDP layer manages network addresses and device discovery. The Zigbee HA layer shows extensive use of commands related to device control, particularly in lighting, with color control and on/off commands being the most prevalent. This distribution offers valuable insights into the communication patterns and the functional focus of the Zigbee network in the dataset.