NetworkCommissioning Cluster
Cluster ID: 0x0031 |
Endpoint: Typically on Endpoint 0 (Root Endpoint)
NetworkCommissioning is the most critical Cluster in the Matter device commissioning process, responsible for managing device network credentials — including Wi-Fi passwords, Thread network parameters, or Ethernet configurations. The Commissioner (phone App) uses this Cluster to scan available networks around the device, write network credentials, and instruct the device to connect to a specified network.
This Cluster is the infrastructure of the commissioning process. Nearly all Matter devices (except pure Ethernet devices) need it to complete network access. It does not control the device's business functions — it makes the device "go online." Only after network configuration is complete do remote operations from other Clusters become meaningful.
Features (Feature Map)
The NetworkCommissioning Cluster uses the Feature Map to indicate which network interface types the device supports. A device must support exactly one of the following three features (mutually exclusive):
Ethernet devices' NetworkCommissioning Cluster has only read-only attributes and does not support any commands (no scanning, adding networks, etc.). Checking the Feature Map is the first step in developing a commissioning flow — it determines which commands to call subsequently.
Commands
NetworkCommissioning commands fall into two categories: Client → Server (requests from the Commissioner to the device) and Server → Client (responses from the device). Commissioning operations follow a request-response pattern, where each request command has a corresponding response command.
Client → Server (Request Commands)
| ID | Name | Description | Required Feature |
|---|---|---|---|
0x00 |
ScanNetworks | Scan available nearby networks | WI or TH |
0x02 |
AddOrUpdateWiFiNetwork | Add or update Wi-Fi network credentials | WI |
0x03 |
AddOrUpdateThreadNetwork | Add or update Thread network credentials | TH |
0x04 |
RemoveNetwork | Remove stored network credentials | WI or TH |
0x06 |
ConnectNetwork | Instruct the device to connect to a specified network | WI or TH |
0x08 |
ReorderNetwork | Adjust network priority order | WI or TH |
Server → Client (Response Commands)
| ID | Name | Description | Corresponding Request |
|---|---|---|---|
0x01 |
ScanNetworksResponse | Return scan result list | ScanNetworks |
0x05 |
NetworkConfigResponse | Return network configuration operation result | Add / Remove / Reorder |
0x07 |
ConnectNetworkResponse | Return network connection result | ConnectNetwork |
ScanNetworks — Scan Networks (0x00)
Instructs the device to scan for available Wi-Fi or Thread networks nearby. This is typically the first step in the commissioning flow — showing users the list of networks they can connect to. The device returns ScanNetworksResponse.
| Parameter | Type | Required | Description |
|---|---|---|---|
| SSID | OctetString / Nullable | No | null = scan all networks; specified value = scan only matching SSID (Wi-Fi only) |
| Breadcrumb | uint64 | No | Commissioning progress marker, used by the Commissioner to track whether commissioning steps are executed as expected |
Usage Scenarios & Notes
After the Commissioner (App) initiates a scan, the device will complete scanning and return results within ScanMaxTimeSeconds. The device may be unable to process other commands during scanning. Wi-Fi devices return a WiFiInterfaceScanResultStruct list, and Thread devices return a ThreadInterfaceScanResultStruct list.
ScanNetworksResponse — Scan Results (0x01)
Response returned after the device completes a network scan, containing the list of discovered networks. Wi-Fi and Thread devices return different structures.
| Field | Type | Description |
|---|---|---|
| NetworkingStatus | NetworkCommissioningStatusEnum | Operation result status code |
| DebugText | String | Optional debug information (e.g., error description) |
| WiFiScanResults | WiFiInterfaceScanResultStruct[] | Wi-Fi scan result list (WI feature only) |
| ThreadScanResults | ThreadInterfaceScanResultStruct[] | Thread scan result list (TH feature only) |
AddOrUpdateWiFiNetwork — Add/Update Wi-Fi Network (0x02)
Write Wi-Fi network credentials (SSID + password) to the device. If credentials for the same SSID already exist, the password is updated; otherwise a new entry is added. The device returns NetworkConfigResponse.
| Parameter | Type | Required | Description |
|---|---|---|---|
| SSID | OctetString | Yes | SSID of the target Wi-Fi network (max 32 bytes) |
| Credentials | OctetString | Yes | Wi-Fi password (max 64 bytes) |
| Breadcrumb | uint64 | No | Commissioning progress marker |
| NetworkIdentity | OctetString | No | Network identity (Matter 1.3+, for Per-Device Credentials) |
| ClientIdentifier | OctetString | No | Client identifier (Matter 1.3+, for Per-Device Credentials) |
| PossessionNonce | OctetString | No | Possession proof nonce (Matter 1.3+, for Per-Device Credentials) |
Usage Scenarios & Notes
This is the key step in the commissioning flow for writing Wi-Fi credentials. Both SSID and password are OctetString type (binary), typically transmitted in Base64 encoding. Note: this command only stores credentials and does not connect immediately — a subsequent ConnectNetwork command is needed to actually connect.
AddOrUpdateThreadNetwork — Add/Update Thread Network (0x03)
Write Thread network credentials (Operational Dataset) to the device. Thread credentials consist of a complete Operational Dataset containing PAN ID, Channel, Network Key, and other information. The device returns NetworkConfigResponse.
| Parameter | Type | Required | Description |
|---|---|---|---|
| OperationalDataset | OctetString | Yes | Thread Operational Dataset (TLV-encoded complete network parameters) |
| Breadcrumb | uint64 | No | Commissioning progress marker |
Usage Scenarios & Notes
Thread network credentials are not a simple SSID + password, but a binary data block containing multiple parameters (Operational Dataset). The Commissioner typically obtains this Dataset from a Thread Border Router, then writes it to the device. A subsequent ConnectNetwork is also needed to actually join the Thread network.
RemoveNetwork — Remove Network (0x04)
Remove stored network credentials from the device. Specify the network to remove via NetworkID. The device returns NetworkConfigResponse.
| Parameter | Type | Required | Description |
|---|---|---|---|
| NetworkID | OctetString | Yes | Network ID to remove (SSID for Wi-Fi, Extended PAN ID for Thread) |
| Breadcrumb | uint64 | No | Commissioning progress marker |
Usage Scenarios & Notes
Used to remove old credentials when switching networks, or to clean up network configuration before factory reset. If the currently connected network is removed, the device will disconnect.
NetworkConfigResponse — Network Config Response (0x05)
Unified response from the device for AddOrUpdateWiFiNetwork, AddOrUpdateThreadNetwork, RemoveNetwork, and ReorderNetwork commands.
| Field | Type | Description |
|---|---|---|
| NetworkingStatus | NetworkCommissioningStatusEnum | Operation result status code |
| DebugText | String | Optional debug information |
| NetworkIndex | uint8 | Index position of the operated network in the list |
| ClientIdentity | OctetString | Client identity (Matter 1.3+, Per-Device Credentials response) |
| PossessionSignature | OctetString | Possession proof signature (Matter 1.3+, Per-Device Credentials response) |
ConnectNetwork — Connect Network (0x06)
Instructs the device to connect to a network previously stored via AddOrUpdateWiFiNetwork / AddOrUpdateThreadNetwork. This is the step in the commissioning flow that makes the device "actually go online." The device returns ConnectNetworkResponse.
| Parameter | Type | Required | Description |
|---|---|---|---|
| NetworkID | OctetString | Yes | Network ID to connect to (must be a previously stored network) |
| Breadcrumb | uint64 | No | Commissioning progress marker |
Usage Scenarios & Notes
After sending ConnectNetwork, the device will attempt to connect within ConnectMaxTimeSeconds.
Important: During the connection process, the BLE or existing communication link between the Commissioner and device may be interrupted (because the device switches to the new network).
The Commissioner needs to rediscover and reconnect to the device through the new network.
ConnectNetworkResponse — Connection Result (0x07)
Network connection result returned by the device. If the connection fails, ErrorValue contains a platform-level error code to help troubleshoot issues.
| Field | Type | Description |
|---|---|---|
| NetworkingStatus | NetworkCommissioningStatusEnum | Connection result status code |
| DebugText | String | Optional debug information |
| ErrorValue | int32 / Nullable | Platform-level error code. For Wi-Fi: Status (802.11 defined), for Thread: OperationalError (Thread protocol defined) |
ErrorValue is not a Matter-defined error code, but a raw error code returned by the underlying platform (Wi-Fi chip driver or Thread protocol stack).
Common values in Wi-Fi scenarios include: wrong password (authentication failure), signal too weak (timeout), DHCP failure, etc.
Interpretation requires consulting the specific chip platform's documentation.
ReorderNetwork — Adjust Network Priority (0x08)
Adjust the priority order of stored networks. The device attempts connections from highest to lowest priority during restart or network switching. The device returns NetworkConfigResponse.
| Parameter | Type | Required | Description |
|---|---|---|---|
| NetworkID | OctetString | Yes | Network ID to reposition |
| NetworkIndex | uint8 | Yes | Target position index (0 = highest priority) |
| Breadcrumb | uint64 | No | Commissioning progress marker |
Usage Scenarios & Notes
When the device has stored multiple network credentials (MaxNetworks > 1), this command can adjust connection priority. Most consumer devices have MaxNetworks = 1, so this command is rarely used.
Attributes
NetworkCommissioning Cluster attributes describe the capabilities and current state of the network interface. Click an attribute ID in the summary table below to jump to its detailed description.
| ID | Name | Type | Group | Description |
|---|---|---|---|---|
0x00 |
MaxNetworks | uint8 | Network Capacity | Maximum storable networks |
0x01 |
Networks | list<NetworkInfoStruct> | Network Capacity | List of configured networks |
0x02 |
ScanMaxTimeSeconds | uint8 | Timing Parameters | Maximum scan duration (seconds) |
0x03 |
ConnectMaxTimeSeconds | uint8 | Timing Parameters | Maximum connection duration (seconds) |
0x04 |
InterfaceEnabled | bool | Interface Status | Whether the network interface is enabled |
0x05 |
LastNetworkingStatus | enum8 / null | Interface Status | Result status of the last network operation |
0x06 |
LastNetworkID | octstr / null | Interface Status | Network ID involved in the last operation |
0x07 |
LastConnectErrorValue | int32 / null | Interface Status | Platform-level error code of the last connection failure |
0x08 |
SupportedWiFiBands | list<WiFiBandEnum> | Wi-Fi Extensions | List of supported Wi-Fi bands |
0x09 |
SupportedThreadFeatures | bitmap16 | Thread Extensions | Supported Thread features bitmap |
0x0A |
ThreadVersion | uint16 | Thread Extensions | Thread protocol version |
Network Capacity (0x00-0x01)
Describes how many network credentials the device can store, and which networks are currently configured.
| ID | Name | Type | Description |
|---|---|---|---|
0x00 |
MaxNetworks Max Networks |
uint8 | Maximum number of network credentials the device can store. Most consumer devices support 1 |
0x01 |
Networks Network List |
list<NetworkInfoStruct> | List of configured network credentials. Each entry contains a NetworkID (SSID for Wi-Fi or Extended PAN ID for Thread) and connection status |
NetworkInfoStruct Structure
| Field | Type | Description |
|---|---|---|
| NetworkID | OctetString (1-32 bytes) | Network identifier. SSID for Wi-Fi, Extended PAN ID for Thread |
| Connected | bool | Whether the device is currently connected to this network |
| NetworkIdentifier | OctetString | Optional, network identity (Matter 1.3+) |
| ClientIdentifier | OctetString | Optional, client identifier (Matter 1.3+) |
The Networks list does not contain passwords — for security reasons, network credentials cannot be read back once written to the device. You can only see the network ID and connection status, not the original password.
Timing Parameters (0x02-0x03)
Define the maximum duration for scan and connect operations, helping the Commissioner set reasonable timeouts.
| ID | Name | Type | Description |
|---|---|---|---|
0x02 |
ScanMaxTimeSeconds Scan Timeout |
uint8 | Maximum time for the device to complete a network scan (seconds). The Commissioner should wait at least this long before declaring a timeout |
0x03 |
ConnectMaxTimeSeconds Connection Timeout |
uint8 | Maximum time for the device to complete a network connection (seconds). Includes DHCP IP acquisition time |
In practice, the App-side timeout should be set to ScanMaxTimeSeconds + reasonable margin (e.g., +5 seconds).
Wi-Fi device scanning typically completes within 10-30 seconds, Thread devices may be faster.
Connection timeout is generally 30-120 seconds, depending on network conditions and DHCP response speed.
Interface Status (0x04-0x07)
The network interface's enabled state and last operation result are core information for troubleshooting commissioning issues.
| ID | Name | Type | Description |
|---|---|---|---|
0x04 |
InterfaceEnabled Interface Enabled |
bool | Whether the network interface is enabled. When false, the device will not connect to any network, and scan/connect commands may be rejected |
0x05 |
LastNetworkingStatus Last Operation Status |
NetworkCommissioningStatusEnum / null | Result status of the last network operation. null means no network operation has been performed yet |
0x06 |
LastNetworkID Last Operated Network |
OctetString / null | Network ID involved in the last network operation. Combined with LastNetworkingStatus, it helps identify which network had issues |
0x07 |
LastConnectErrorValue Last Connection Error Code |
int32 / null | Platform-level error code from the last failed ConnectNetwork. null means no error or no connection has been attempted yet |
When commissioning fails, prioritize reading these three "Last*" attributes: LastNetworkingStatus tells you the general cause (wrong password? network not found?),
LastNetworkID confirms which network, and LastConnectErrorValue provides the underlying specific error code.
Using all three together enables rapid diagnosis of most commissioning issues.
Wi-Fi Extensions (0x08)
Wi-Fi related attributes added in Matter 1.3, present only when the Feature Map includes WI.
| ID | Name | Type | Description |
|---|---|---|---|
0x08 |
SupportedWiFiBands Supported Wi-Fi Bands |
list<WiFiBandEnum> | List of Wi-Fi bands supported by the device (e.g., 2.4GHz, 5GHz) |
Thread Extensions (0x09-0x0A)
Thread related attributes added in Matter 1.3, present only when the Feature Map includes TH.
| ID | Name | Type | Description |
|---|---|---|---|
0x09 |
SupportedThreadFeatures Thread Feature Support |
bitmap16 | Bitmap of Thread protocol features supported by the device |
0x0A |
ThreadVersion Thread Version |
uint16 | Thread protocol version number supported by the device |
Enums & Structs
NetworkCommissioningStatusEnum
All network operation command responses include this status code to indicate the operation result. This is the first field to check when troubleshooting commissioning issues.
Wrong password → 7 (AuthFailure);
Wrong network name or router is off → 5 (NetworkNotFound);
Network storage full → 2 (BoundsExceeded);
Device doesn't support 5GHz → the network won't appear in scan results; forcing a connection may yield 8 (UnsupportedSecurity) or 9 (OtherConnectionFailure).
WiFiBandEnum
Identifies the Wi-Fi operating band, used in scan results and the SupportedWiFiBands attribute.
WiFiSecurityBitmap
Security type bitmap for Wi-Fi networks. A network can support multiple security protocols simultaneously (multiple bits set to 1).
A scan result with security = 12 (binary 01100) means the network supports both WPA2-PERSONAL (Bit 3) and WPA-PERSONAL (Bit 2).
A value of 4 (binary 00100) means only WPA-PERSONAL is supported.
WiFiInterfaceScanResultStruct
Detailed information for each network in Wi-Fi scan results.
| Field | Type | Description |
|---|---|---|
| Security | WiFiSecurityBitmap | Security type bitmap |
| SSID | OctetString (0-32 bytes) | Network name |
| BSSID | OctetString (6 bytes) | Access point MAC address |
| Channel | uint16 | Wi-Fi channel number |
| WiFiBand | WiFiBandEnum | Operating band (2.4G / 5G, etc.) |
| RSSI | int8 | Signal strength (dBm), higher values mean better signal (typically -30 excellent, -70 fair, -90 poor) |
ThreadInterfaceScanResultStruct
Detailed information for each network in Thread scan results.
| Field | Type | Description |
|---|---|---|
| PanId | uint16 | Personal Area Network ID (PAN identifier) |
| ExtendedPanId | uint64 | Extended PAN ID (globally unique network identifier) |
| NetworkName | String (1-16 characters) | Thread Network name |
| Channel | uint16 | Thread channel number |
| Version | uint8 | Thread protocol version |
| ExtendedAddress | OctetString (8 bytes) | Device extended MAC address (IEEE EUI-64) |
| RSSI | int8 | Signal strength (dBm) |
| LQI | uint8 | Link Quality Indicator (link quality metric, 0-255, higher is better) |
Standard Example
Attribute Data Example
The following is typical attribute data for a commissioned Wi-Fi device:
{
// --- Network Capacity ---
"0x00": 1, // MaxNetworks = 1 (max 1 network credential)
"0x01": [{ // Networks = List of configured networks
"networkID": "TXlIb21lV2lGaQ==", // Base64-encoded SSID
"connected": true // Currently connected
}],
// --- Scan & Connection Timeout ---
"0x02": 30, // ScanMaxTimeSeconds = 30 seconds
"0x03": 60, // ConnectMaxTimeSeconds = 60 seconds
// --- Interface Status ---
"0x04": true, // InterfaceEnabled = true (network interface enabled)
// --- Last Operation Result ---
"0x05": 0, // LastNetworkingStatus = Success
"0x06": "TXlIb21lV2lGaQ==", // LastNetworkID (network ID of last operation)
"0x07": null // LastConnectErrorValue = null (no error)
}
Scan Networks Flow Example
Commissioner initiates a Wi-Fi scan and retrieves results:
// Commissioner → Device: Scan Wi-Fi networks
{
"invokeRequests": [{
"commandPath": {
"endpointId": 0,
"clusterId": "0x0031",
"commandId": "0x00" // ScanNetworks
},
"commandFields": {
"ssid": null, // null = scan all networks
"breadcrumb": 1 // Commissioning progress marker
}
}]
}
// Device → Commissioner: Return scan results
{
"networkingStatus": 0, // Success
"wiFiScanResults": [
{
"security": 4, // WPA2-Personal
"ssid": "MyHomeWiFi",
"bssid": "AA:BB:CC:DD:EE:FF",
"channel": 6,
"wiFiBand": 0, // 2.4GHz
"rssi": -45
},
{
"security": 8, // WPA3-Personal
"ssid": "Office5G",
"bssid": "11:22:33:44:55:66",
"channel": 36,
"wiFiBand": 1, // 5GHz
"rssi": -62
}
]
}
Add Wi-Fi Network Example
Write Wi-Fi credentials to the device:
// Add Wi-Fi network credentials
{
"invokeRequests": [{
"commandPath": {
"endpointId": 0,
"clusterId": "0x0031",
"commandId": "0x02" // AddOrUpdateWiFiNetwork
},
"commandFields": {
"ssid": "TXlIb21lV2lGaQ==", // Base64 of "MyHomeWiFi"
"credentials": "cGFzc3dvcmQ=", // Base64 of password
"breadcrumb": 2
}
}]
}
// Device replies with NetworkConfigResponse
{
"networkingStatus": 0, // Success
"networkIndex": 0 // Stored at index 0
}
Both SSID and password are OctetString (byte arrays) in the Matter protocol, typically transmitted using Base64 encoding.
The "TXlIb21lV2lGaQ==" in the example above decodes to "MyHomeWiFi".
Common Scenarios
Scenario 1: Complete Wi-Fi Device Commissioning Flow
- Commissioner establishes a PASE secure channel with the device via BLE
- Read
FeatureMapto confirm it is a Wi-Fi device (Bit 0 = 1) - Read
ScanMaxTimeSeconds (0x02)to get scan timeout - Send
ScanNetworks (0x00)with SSID =nullto scan all networks - Receive
ScanNetworksResponse (0x01)and display Wi-Fi list to the user - User selects a network and enters the password
- Send
AddOrUpdateWiFiNetwork (0x02)to write SSID + password - Receive
NetworkConfigResponse (0x05)and confirmNetworkingStatus = 0 (Success) - Send
ConnectNetwork (0x06)to instruct the device to connect - Device connects to Wi-Fi and returns result via
ConnectNetworkResponse (0x07) - Commissioner rediscovers the device through the Wi-Fi network and continues with subsequent commissioning steps (NOC certificate installation, etc.)
Scenario 2: Thread Device Commissioning
- Commissioner establishes a PASE secure channel with the device via BLE
- Read
FeatureMapto confirm it is a Thread device (Bit 1 = 1) - Commissioner obtains the Operational Dataset from the Thread Border Router
- Send
AddOrUpdateThreadNetwork (0x03)to write the Dataset - Send
ConnectNetwork (0x06)to instruct the device to join the Thread network - After the device joins the Thread network, the Commissioner continues commissioning through the Thread network
Note: Thread commissioning typically does not require scanning first, as the Dataset already contains all parameters for the target network.
Scenario 3: Commissioning Failure Troubleshooting
- Read
LastNetworkingStatus (0x05)to check the error type - Read
LastNetworkID (0x06)to confirm which network - Read
LastConnectErrorValue (0x07)to get the platform-level error code
Common issue reference:
- Status = 7 (AuthFailure): Wrong password, ask the user to re-enter
- Status = 5 (NetworkNotFound): Network not in range, check if the router is on and if the signal is too weak
- Status = 10 (IPV6Failed): Router may not support IPv6, check router settings
- Status = 8 (UnsupportedSecurity): Device does not support the target network's encryption, check SupportedWiFiBands and scan results
Scenario 4: Switching Wi-Fi Networks
- Read
Networks (0x01)to view currently stored networks - Read
MaxNetworks (0x00); if only 1 can be stored, delete the old network first - Send
RemoveNetwork (0x04)to remove old credentials - Follow the Scenario 1 flow to add and connect to the new network
Note: Removing the currently connected network will cause the device to disconnect. If MaxNetworks > 1, you can add the new network first and then remove the old one to minimize downtime.