NetworkCommissioning Cluster

Cluster ID: 0x0031  |  Endpoint: Typically on Endpoint 0 (Root Endpoint)

NetworkCommissioning is the most critical Cluster in the Matter device commissioning process, responsible for managing device network credentials — including Wi-Fi passwords, Thread network parameters, or Ethernet configurations. The Commissioner (phone App) uses this Cluster to scan available networks around the device, write network credentials, and instruct the device to connect to a specified network.

Core Purpose

This Cluster is the infrastructure of the commissioning process. Nearly all Matter devices (except pure Ethernet devices) need it to complete network access. It does not control the device's business functions — it makes the device "go online." Only after network configuration is complete do remote operations from other Clusters become meaningful.

Features (Feature Map)

The NetworkCommissioning Cluster uses the Feature Map to indicate which network interface types the device supports. A device must support exactly one of the following three features (mutually exclusive):

Bit 0
WI — WiFiNetworkInterface Device supports Wi-Fi network interface, can scan Wi-Fi networks and store SSID + password
Bit 1
TH — ThreadNetworkInterface Device supports Thread network interface, can scan Thread networks and store Operational Dataset
Bit 2
ET — EthernetNetworkInterface Device uses Ethernet connection, no scanning or credential configuration needed (plug and play)
Developer Tip

Ethernet devices' NetworkCommissioning Cluster has only read-only attributes and does not support any commands (no scanning, adding networks, etc.). Checking the Feature Map is the first step in developing a commissioning flow — it determines which commands to call subsequently.

Commands

NetworkCommissioning commands fall into two categories: Client → Server (requests from the Commissioner to the device) and Server → Client (responses from the device). Commissioning operations follow a request-response pattern, where each request command has a corresponding response command.

Client → Server (Request Commands)

ID Name Description Required Feature
0x00 ScanNetworks Scan available nearby networks WI or TH
0x02 AddOrUpdateWiFiNetwork Add or update Wi-Fi network credentials WI
0x03 AddOrUpdateThreadNetwork Add or update Thread network credentials TH
0x04 RemoveNetwork Remove stored network credentials WI or TH
0x06 ConnectNetwork Instruct the device to connect to a specified network WI or TH
0x08 ReorderNetwork Adjust network priority order WI or TH

Server → Client (Response Commands)

ID Name Description Corresponding Request
0x01 ScanNetworksResponse Return scan result list ScanNetworks
0x05 NetworkConfigResponse Return network configuration operation result Add / Remove / Reorder
0x07 ConnectNetworkResponse Return network connection result ConnectNetwork

ScanNetworks — Scan Networks (0x00)

Instructs the device to scan for available Wi-Fi or Thread networks nearby. This is typically the first step in the commissioning flow — showing users the list of networks they can connect to. The device returns ScanNetworksResponse.

ParameterTypeRequiredDescription
SSID OctetString / Nullable No null = scan all networks; specified value = scan only matching SSID (Wi-Fi only)
Breadcrumb uint64 No Commissioning progress marker, used by the Commissioner to track whether commissioning steps are executed as expected
Usage Scenarios & Notes

After the Commissioner (App) initiates a scan, the device will complete scanning and return results within ScanMaxTimeSeconds. The device may be unable to process other commands during scanning. Wi-Fi devices return a WiFiInterfaceScanResultStruct list, and Thread devices return a ThreadInterfaceScanResultStruct list.

ScanNetworksResponse — Scan Results (0x01)

Response returned after the device completes a network scan, containing the list of discovered networks. Wi-Fi and Thread devices return different structures.

FieldTypeDescription
NetworkingStatus NetworkCommissioningStatusEnum Operation result status code
DebugText String Optional debug information (e.g., error description)
WiFiScanResults WiFiInterfaceScanResultStruct[] Wi-Fi scan result list (WI feature only)
ThreadScanResults ThreadInterfaceScanResultStruct[] Thread scan result list (TH feature only)

AddOrUpdateWiFiNetwork — Add/Update Wi-Fi Network (0x02)

Write Wi-Fi network credentials (SSID + password) to the device. If credentials for the same SSID already exist, the password is updated; otherwise a new entry is added. The device returns NetworkConfigResponse.

ParameterTypeRequiredDescription
SSID OctetString Yes SSID of the target Wi-Fi network (max 32 bytes)
Credentials OctetString Yes Wi-Fi password (max 64 bytes)
Breadcrumb uint64 No Commissioning progress marker
NetworkIdentity OctetString No Network identity (Matter 1.3+, for Per-Device Credentials)
ClientIdentifier OctetString No Client identifier (Matter 1.3+, for Per-Device Credentials)
PossessionNonce OctetString No Possession proof nonce (Matter 1.3+, for Per-Device Credentials)
Usage Scenarios & Notes

This is the key step in the commissioning flow for writing Wi-Fi credentials. Both SSID and password are OctetString type (binary), typically transmitted in Base64 encoding. Note: this command only stores credentials and does not connect immediately — a subsequent ConnectNetwork command is needed to actually connect.

AddOrUpdateThreadNetwork — Add/Update Thread Network (0x03)

Write Thread network credentials (Operational Dataset) to the device. Thread credentials consist of a complete Operational Dataset containing PAN ID, Channel, Network Key, and other information. The device returns NetworkConfigResponse.

ParameterTypeRequiredDescription
OperationalDataset OctetString Yes Thread Operational Dataset (TLV-encoded complete network parameters)
Breadcrumb uint64 No Commissioning progress marker
Usage Scenarios & Notes

Thread network credentials are not a simple SSID + password, but a binary data block containing multiple parameters (Operational Dataset). The Commissioner typically obtains this Dataset from a Thread Border Router, then writes it to the device. A subsequent ConnectNetwork is also needed to actually join the Thread network.

RemoveNetwork — Remove Network (0x04)

Remove stored network credentials from the device. Specify the network to remove via NetworkID. The device returns NetworkConfigResponse.

ParameterTypeRequiredDescription
NetworkID OctetString Yes Network ID to remove (SSID for Wi-Fi, Extended PAN ID for Thread)
Breadcrumb uint64 No Commissioning progress marker
Usage Scenarios & Notes

Used to remove old credentials when switching networks, or to clean up network configuration before factory reset. If the currently connected network is removed, the device will disconnect.

NetworkConfigResponse — Network Config Response (0x05)

Unified response from the device for AddOrUpdateWiFiNetwork, AddOrUpdateThreadNetwork, RemoveNetwork, and ReorderNetwork commands.

FieldTypeDescription
NetworkingStatus NetworkCommissioningStatusEnum Operation result status code
DebugText String Optional debug information
NetworkIndex uint8 Index position of the operated network in the list
ClientIdentity OctetString Client identity (Matter 1.3+, Per-Device Credentials response)
PossessionSignature OctetString Possession proof signature (Matter 1.3+, Per-Device Credentials response)

ConnectNetwork — Connect Network (0x06)

Instructs the device to connect to a network previously stored via AddOrUpdateWiFiNetwork / AddOrUpdateThreadNetwork. This is the step in the commissioning flow that makes the device "actually go online." The device returns ConnectNetworkResponse.

ParameterTypeRequiredDescription
NetworkID OctetString Yes Network ID to connect to (must be a previously stored network)
Breadcrumb uint64 No Commissioning progress marker
Usage Scenarios & Notes

After sending ConnectNetwork, the device will attempt to connect within ConnectMaxTimeSeconds. Important: During the connection process, the BLE or existing communication link between the Commissioner and device may be interrupted (because the device switches to the new network). The Commissioner needs to rediscover and reconnect to the device through the new network.

ConnectNetworkResponse — Connection Result (0x07)

Network connection result returned by the device. If the connection fails, ErrorValue contains a platform-level error code to help troubleshoot issues.

FieldTypeDescription
NetworkingStatus NetworkCommissioningStatusEnum Connection result status code
DebugText String Optional debug information
ErrorValue int32 / Nullable Platform-level error code. For Wi-Fi: Status (802.11 defined), for Thread: OperationalError (Thread protocol defined)
What ErrorValue Actually Means

ErrorValue is not a Matter-defined error code, but a raw error code returned by the underlying platform (Wi-Fi chip driver or Thread protocol stack). Common values in Wi-Fi scenarios include: wrong password (authentication failure), signal too weak (timeout), DHCP failure, etc. Interpretation requires consulting the specific chip platform's documentation.

ReorderNetwork — Adjust Network Priority (0x08)

Adjust the priority order of stored networks. The device attempts connections from highest to lowest priority during restart or network switching. The device returns NetworkConfigResponse.

ParameterTypeRequiredDescription
NetworkID OctetString Yes Network ID to reposition
NetworkIndex uint8 Yes Target position index (0 = highest priority)
Breadcrumb uint64 No Commissioning progress marker
Usage Scenarios & Notes

When the device has stored multiple network credentials (MaxNetworks > 1), this command can adjust connection priority. Most consumer devices have MaxNetworks = 1, so this command is rarely used.

Attributes

NetworkCommissioning Cluster attributes describe the capabilities and current state of the network interface. Click an attribute ID in the summary table below to jump to its detailed description.

ID Name Type Group Description
0x00 MaxNetworks uint8 Network Capacity Maximum storable networks
0x01 Networks list<NetworkInfoStruct> Network Capacity List of configured networks
0x02 ScanMaxTimeSeconds uint8 Timing Parameters Maximum scan duration (seconds)
0x03 ConnectMaxTimeSeconds uint8 Timing Parameters Maximum connection duration (seconds)
0x04 InterfaceEnabled bool Interface Status Whether the network interface is enabled
0x05 LastNetworkingStatus enum8 / null Interface Status Result status of the last network operation
0x06 LastNetworkID octstr / null Interface Status Network ID involved in the last operation
0x07 LastConnectErrorValue int32 / null Interface Status Platform-level error code of the last connection failure
0x08 SupportedWiFiBands list<WiFiBandEnum> Wi-Fi Extensions List of supported Wi-Fi bands
0x09 SupportedThreadFeatures bitmap16 Thread Extensions Supported Thread features bitmap
0x0A ThreadVersion uint16 Thread Extensions Thread protocol version

Network Capacity (0x00-0x01)

Describes how many network credentials the device can store, and which networks are currently configured.

IDNameTypeDescription
0x00 MaxNetworks
Max Networks
uint8 Maximum number of network credentials the device can store. Most consumer devices support 1
0x01 Networks
Network List
list<NetworkInfoStruct> List of configured network credentials. Each entry contains a NetworkID (SSID for Wi-Fi or Extended PAN ID for Thread) and connection status

NetworkInfoStruct Structure

FieldTypeDescription
NetworkID OctetString (1-32 bytes) Network identifier. SSID for Wi-Fi, Extended PAN ID for Thread
Connected bool Whether the device is currently connected to this network
NetworkIdentifier OctetString Optional, network identity (Matter 1.3+)
ClientIdentifier OctetString Optional, client identifier (Matter 1.3+)
Developer Tip

The Networks list does not contain passwords — for security reasons, network credentials cannot be read back once written to the device. You can only see the network ID and connection status, not the original password.

Timing Parameters (0x02-0x03)

Define the maximum duration for scan and connect operations, helping the Commissioner set reasonable timeouts.

IDNameTypeDescription
0x02 ScanMaxTimeSeconds
Scan Timeout
uint8 Maximum time for the device to complete a network scan (seconds). The Commissioner should wait at least this long before declaring a timeout
0x03 ConnectMaxTimeSeconds
Connection Timeout
uint8 Maximum time for the device to complete a network connection (seconds). Includes DHCP IP acquisition time
Timeout Configuration Tips

In practice, the App-side timeout should be set to ScanMaxTimeSeconds + reasonable margin (e.g., +5 seconds). Wi-Fi device scanning typically completes within 10-30 seconds, Thread devices may be faster. Connection timeout is generally 30-120 seconds, depending on network conditions and DHCP response speed.

Interface Status (0x04-0x07)

The network interface's enabled state and last operation result are core information for troubleshooting commissioning issues.

IDNameTypeDescription
0x04 InterfaceEnabled
Interface Enabled
bool Whether the network interface is enabled. When false, the device will not connect to any network, and scan/connect commands may be rejected
0x05 LastNetworkingStatus
Last Operation Status
NetworkCommissioningStatusEnum / null Result status of the last network operation. null means no network operation has been performed yet
0x06 LastNetworkID
Last Operated Network
OctetString / null Network ID involved in the last network operation. Combined with LastNetworkingStatus, it helps identify which network had issues
0x07 LastConnectErrorValue
Last Connection Error Code
int32 / null Platform-level error code from the last failed ConnectNetwork. null means no error or no connection has been attempted yet
Troubleshooting Commissioning Failures

When commissioning fails, prioritize reading these three "Last*" attributes: LastNetworkingStatus tells you the general cause (wrong password? network not found?), LastNetworkID confirms which network, and LastConnectErrorValue provides the underlying specific error code. Using all three together enables rapid diagnosis of most commissioning issues.

Wi-Fi Extensions (0x08)

Wi-Fi related attributes added in Matter 1.3, present only when the Feature Map includes WI.

IDNameTypeDescription
0x08 SupportedWiFiBands
Supported Wi-Fi Bands
list<WiFiBandEnum> List of Wi-Fi bands supported by the device (e.g., 2.4GHz, 5GHz)

Thread Extensions (0x09-0x0A)

Thread related attributes added in Matter 1.3, present only when the Feature Map includes TH.

IDNameTypeDescription
0x09 SupportedThreadFeatures
Thread Feature Support
bitmap16 Bitmap of Thread protocol features supported by the device
0x0A ThreadVersion
Thread Version
uint16 Thread protocol version number supported by the device

Enums & Structs

NetworkCommissioningStatusEnum

All network operation command responses include this status code to indicate the operation result. This is the first field to check when troubleshooting commissioning issues.

0
Success Operation successful
1
OutOfRange Value out of valid range
2
BoundsExceeded Network storage limit reached (MaxNetworks)
3
NetworkIDNotFound Specified network ID not found in the stored list
4
DuplicateNetworkID Duplicate network ID (same ID already exists)
5
NetworkNotFound Target network not found during scan or connect (not on air)
6
RegulatoryError Cannot use this network due to regulatory restrictions (e.g., band not compliant in the current country/region)
7
AuthFailure Authentication failure (typically wrong Wi-Fi password)
8
UnsupportedSecurity Unsupported security protocol of the target network (e.g., device does not support WPA3)
9
OtherConnectionFailure Other connection failure (does not fall into any of the above categories)
10
IPV6Failed IPv6 address acquisition failed
11
IPBindFailed IP address binding failed
12
UnknownError Unknown error
Common Errors Quick Reference

Wrong password → 7 (AuthFailure); Wrong network name or router is off → 5 (NetworkNotFound); Network storage full → 2 (BoundsExceeded); Device doesn't support 5GHz → the network won't appear in scan results; forcing a connection may yield 8 (UnsupportedSecurity) or 9 (OtherConnectionFailure).

WiFiBandEnum

Identifies the Wi-Fi operating band, used in scan results and the SupportedWiFiBands attribute.

0
2G4 2.4 GHz band (802.11b/g/n)
1
3G65 3.65 GHz band
2
5G 5 GHz band (802.11a/n/ac)
3
6G 6 GHz band (802.11ax / Wi-Fi 6E)
4
60G 60 GHz band (802.11ad / WiGig)
5
1G Sub-1 GHz band (802.11ah / Wi-Fi HaLow)

WiFiSecurityBitmap

Security type bitmap for Wi-Fi networks. A network can support multiple security protocols simultaneously (multiple bits set to 1).

Bit 0
Unencrypted Open network, no encryption
Bit 1
WEP WEP encryption (no longer secure, being phased out)
Bit 2
WPA-PERSONAL WPA Personal (PSK)
Bit 3
WPA2-PERSONAL WPA2 Personal (PSK), currently the most common
Bit 4
WPA3-PERSONAL WPA3 Personal (SAE), more secure new standard
Bitmap Reading Example

A scan result with security = 12 (binary 01100) means the network supports both WPA2-PERSONAL (Bit 3) and WPA-PERSONAL (Bit 2). A value of 4 (binary 00100) means only WPA-PERSONAL is supported.

WiFiInterfaceScanResultStruct

Detailed information for each network in Wi-Fi scan results.

FieldTypeDescription
Security WiFiSecurityBitmap Security type bitmap
SSID OctetString (0-32 bytes) Network name
BSSID OctetString (6 bytes) Access point MAC address
Channel uint16 Wi-Fi channel number
WiFiBand WiFiBandEnum Operating band (2.4G / 5G, etc.)
RSSI int8 Signal strength (dBm), higher values mean better signal (typically -30 excellent, -70 fair, -90 poor)

ThreadInterfaceScanResultStruct

Detailed information for each network in Thread scan results.

FieldTypeDescription
PanId uint16 Personal Area Network ID (PAN identifier)
ExtendedPanId uint64 Extended PAN ID (globally unique network identifier)
NetworkName String (1-16 characters) Thread Network name
Channel uint16 Thread channel number
Version uint8 Thread protocol version
ExtendedAddress OctetString (8 bytes) Device extended MAC address (IEEE EUI-64)
RSSI int8 Signal strength (dBm)
LQI uint8 Link Quality Indicator (link quality metric, 0-255, higher is better)

Standard Example

Attribute Data Example

The following is typical attribute data for a commissioned Wi-Fi device:

{
  // --- Network Capacity ---
  "0x00": 1,             // MaxNetworks = 1 (max 1 network credential)
  "0x01": [{             // Networks = List of configured networks
    "networkID": "TXlIb21lV2lGaQ==",  // Base64-encoded SSID
    "connected": true                   // Currently connected
  }],

  // --- Scan & Connection Timeout ---
  "0x02": 30,            // ScanMaxTimeSeconds = 30 seconds
  "0x03": 60,            // ConnectMaxTimeSeconds = 60 seconds

  // --- Interface Status ---
  "0x04": true,          // InterfaceEnabled = true (network interface enabled)

  // --- Last Operation Result ---
  "0x05": 0,             // LastNetworkingStatus = Success
  "0x06": "TXlIb21lV2lGaQ==",  // LastNetworkID (network ID of last operation)
  "0x07": null           // LastConnectErrorValue = null (no error)
}

Scan Networks Flow Example

Commissioner initiates a Wi-Fi scan and retrieves results:

// Commissioner → Device: Scan Wi-Fi networks
{
  "invokeRequests": [{
    "commandPath": {
      "endpointId": 0,
      "clusterId": "0x0031",
      "commandId": "0x00"        // ScanNetworks
    },
    "commandFields": {
      "ssid": null,              // null = scan all networks
      "breadcrumb": 1            // Commissioning progress marker
    }
  }]
}

// Device → Commissioner: Return scan results
{
  "networkingStatus": 0,         // Success
  "wiFiScanResults": [
    {
      "security": 4,             // WPA2-Personal
      "ssid": "MyHomeWiFi",
      "bssid": "AA:BB:CC:DD:EE:FF",
      "channel": 6,
      "wiFiBand": 0,             // 2.4GHz
      "rssi": -45
    },
    {
      "security": 8,             // WPA3-Personal
      "ssid": "Office5G",
      "bssid": "11:22:33:44:55:66",
      "channel": 36,
      "wiFiBand": 1,             // 5GHz
      "rssi": -62
    }
  ]
}

Add Wi-Fi Network Example

Write Wi-Fi credentials to the device:

// Add Wi-Fi network credentials
{
  "invokeRequests": [{
    "commandPath": {
      "endpointId": 0,
      "clusterId": "0x0031",
      "commandId": "0x02"        // AddOrUpdateWiFiNetwork
    },
    "commandFields": {
      "ssid": "TXlIb21lV2lGaQ==",  // Base64 of "MyHomeWiFi"
      "credentials": "cGFzc3dvcmQ=", // Base64 of password
      "breadcrumb": 2
    }
  }]
}

// Device replies with NetworkConfigResponse
{
  "networkingStatus": 0,         // Success
  "networkIndex": 0              // Stored at index 0
}
Developer Tip

Both SSID and password are OctetString (byte arrays) in the Matter protocol, typically transmitted using Base64 encoding. The "TXlIb21lV2lGaQ==" in the example above decodes to "MyHomeWiFi".

Common Scenarios

Scenario 1: Complete Wi-Fi Device Commissioning Flow
  1. Commissioner establishes a PASE secure channel with the device via BLE
  2. Read FeatureMap to confirm it is a Wi-Fi device (Bit 0 = 1)
  3. Read ScanMaxTimeSeconds (0x02) to get scan timeout
  4. Send ScanNetworks (0x00) with SSID = null to scan all networks
  5. Receive ScanNetworksResponse (0x01) and display Wi-Fi list to the user
  6. User selects a network and enters the password
  7. Send AddOrUpdateWiFiNetwork (0x02) to write SSID + password
  8. Receive NetworkConfigResponse (0x05) and confirm NetworkingStatus = 0 (Success)
  9. Send ConnectNetwork (0x06) to instruct the device to connect
  10. Device connects to Wi-Fi and returns result via ConnectNetworkResponse (0x07)
  11. Commissioner rediscovers the device through the Wi-Fi network and continues with subsequent commissioning steps (NOC certificate installation, etc.)
Scenario 2: Thread Device Commissioning
  1. Commissioner establishes a PASE secure channel with the device via BLE
  2. Read FeatureMap to confirm it is a Thread device (Bit 1 = 1)
  3. Commissioner obtains the Operational Dataset from the Thread Border Router
  4. Send AddOrUpdateThreadNetwork (0x03) to write the Dataset
  5. Send ConnectNetwork (0x06) to instruct the device to join the Thread network
  6. After the device joins the Thread network, the Commissioner continues commissioning through the Thread network

Note: Thread commissioning typically does not require scanning first, as the Dataset already contains all parameters for the target network.

Scenario 3: Commissioning Failure Troubleshooting
  1. Read LastNetworkingStatus (0x05) to check the error type
  2. Read LastNetworkID (0x06) to confirm which network
  3. Read LastConnectErrorValue (0x07) to get the platform-level error code

Common issue reference:

  • Status = 7 (AuthFailure): Wrong password, ask the user to re-enter
  • Status = 5 (NetworkNotFound): Network not in range, check if the router is on and if the signal is too weak
  • Status = 10 (IPV6Failed): Router may not support IPv6, check router settings
  • Status = 8 (UnsupportedSecurity): Device does not support the target network's encryption, check SupportedWiFiBands and scan results
Scenario 4: Switching Wi-Fi Networks
  1. Read Networks (0x01) to view currently stored networks
  2. Read MaxNetworks (0x00); if only 1 can be stored, delete the old network first
  3. Send RemoveNetwork (0x04) to remove old credentials
  4. Follow the Scenario 1 flow to add and connect to the new network

Note: Removing the currently connected network will cause the device to disconnect. If MaxNetworks > 1, you can add the new network first and then remove the old one to minimize downtime.