Every LonTalk packet carries both a source and a destination address, and both live in the same header. There is no separate layer-2 addressing underneath — the standard folds routing and naming into one address field. Get the structure of that field straight and most of the network’s limits, quirks, and failure modes stop being mysterious.
This is a working reference for ISO/IEC 14908-1 addressing. Field widths, the five formats on the wire, what each one is for, and what breaks when the addressing is wrong.
Table of Contents
Five components
Domain — 0, 1, 3, or 6 bytes
The outermost boundary. A domain is a virtual network, and communication never crosses one. Source and destination of any packet must sit in the same domain, and the stack has no equivalent of an internet protocol between domains. If you need traffic to cross, you need an application-level gateway. There is no other route.
Six bytes gives worldwide uniqueness. Inside one building, shorter is fine. A zero-length domain also exists and matters — it is what commissioning tools use before a device knows anything.
The domain is also the unit of administration. Subnet and group numbers are assigned by whoever owns the domain, and they mean nothing outside it.
Subnet — 8 bits, 1 to 255
Zero is reserved and means “unknown”. A subnet holds up to 127 nodes with no routing inside it.
The word is misleading if you come from IT. A subnet here is a routing abstraction, not a wire. A channel is the physical unit of bandwidth. You can map several subnets onto one channel, and a channel made of several segments joined by physical layer repeaters is still one channel.
Node — 7 bits, 1 to 127
All-zeros is unused. A physical device can belong to at most two subnets, and those two must be in different domains — it gets a separate node number in each.
Two implementation details that catch people reading captures. On the destination side, address matching compares the whole byte even though only seven bits carry the node number. On the source side, the eighth bit of that byte is a selector — it distinguishes sub-variants of an address format, and format #2 is the only one that uses it. Same byte position, two different jobs depending on which end of the pair you are looking at.
Group — 8 bits, up to 256 per domain
Groups are how one-to-many delivery works, and they are what network variable connections are built on. A node can hold zero to fifteen group addresses. Within a group, members are numbered by a 6-bit field, range 0 to 63.
Unique_Node_ID — 48 bits
Set at manufacture, unique worldwide, never changes. The standard is careful to call this a name rather than an address, because it does not change when the device moves. You will see it called the Neuron ID in vendor documentation.
It can only ever be a destination. A device never sources a packet from its Unique_Node_ID.
Where the device count comes from
The arithmetic falls straight out of the field widths:
| Width | Usable range | Count | |
|---|---|---|---|
| Subnets per domain | 8 bits | 1–255 | 255 |
| Nodes per subnet | 7 bits | 1–127 | 127 |
| Nodes per domain | 32 385 | ||
| Groups per domain | 8 bits | 0–255 | 256 |
| Members per group | 6 bits | 0–63 | 64 |
| Group addresses per node | 0–15 | 15 |
255 × 127 = 32 385, which the standard rounds to about 2¹⁵.
That number is almost never your constraint. A twisted-pair segment tops out at 128 link-powered or 64 locally powered devices long before you approach it, and channel bandwidth bites before that. If you genuinely need more than 32 385, you use multiple domains and gateway between them — which is a system design decision, not a configuration one.
The five formats on the wire
Source and destination are packed into one of five combinations. The NPDU header carries the protocol version, the enclosed PDU type, which of these formats is in use, and the domain length. Then comes the address field, source subnet first.
Format #0 — broadcast
(domain, source subnet/node, destination subnet)
Destination subnet 0 reaches every subnet in the domain. Any value from 1 to 255 reaches only that subnet.
That single field is the difference between a domain-wide flood and a contained broadcast, and it is worth checking first when a broadcast is or is not crossing a router the way you expected.
Format #1 — multicast
(domain, source subnet/node, destination group)
Source is still a subnet/node pair. Destination is the group alone. Used for messages and reminders to a group.
Format #2a — unicast
(domain, source subnet/node, destination subnet/node)
The workhorse. Messages, reminders, and acknowledgements between two known devices.
Format #2b — group acknowledgement
(domain, source subnet/node, destination subnet/node, group, member)
Source and destination fields are laid out identically to #2a so routers can handle both the same way. The group and member numbers of the acknowledging device are appended after.
Format #3 — addressed by serial number
(domain, source subnet/node, destination subnet, Unique_Node_ID)
This is how you talk to a device that has no address yet. Where the destination subnet is unknown, set it to zero and the packet propagates through the network.
You get the Unique_Node_ID one of two ways: a network management query, or a manual service request initiated at the device itself — the service pin.
Address recognition
What a device accepts depends on what state it is in.
Unconfigured. Only two things get through: broadcasts, and anything carrying its own Unique_Node_ID. Everything else is discarded. This is why an uncommissioned device is invisible to normal traffic and only reachable by serial number.
Configured. Its Unique_Node_ID still works — that path never closes — plus messages that match its domain. Matching the domain means both the length and the value have to match, not just the value. Then the message has to be a broadcast to a matching subnet (or domain-wide), a group message where one of the device’s group addresses matches, or a unicast where subnet and node both match.
Two behaviours worth knowing:
A device discards any packet whose source subnet/node matches its own matching domain. That kills a whole class of loop and reflection problem silently.
Any packet with an unsupported protocol version is discarded outright.
The flexible domain. When a device is not configured and not hard-offline, it receives on whatever domain the message arrived on, and remembers it for the reply. Responses go back on that domain with subnet/node set to 0x00/0x80.
That mechanism has one consequence that belongs in your security notes: messages received on the flexible domain are never authenticated. No exceptions.
How routers use the address
Routing is a separate function from address recognition. A router has its own addresses too and can be managed like any other device. It is a logical entity — one physical box can hold more than one router.
Four modes, set by network management message:
| Mode | Behaviour |
|---|---|
| Repeater | Forwards everything |
| Bridge | Forwards everything on its domains |
| Learning | Builds its subnet table by watching source addresses |
| Configured | Routing tables set explicitly |
Each side of the router runs its own tables and makes its own decisions for packets arriving on that side. There are three forwarding tables — one for unicast by destination subnet, one for multicast by destination group, one for broadcast by destination subnet — and each entry resolves to forward or discard.
The learning router limitation is the one that bites. A learning router discovers subnet locations by watching the source addresses of packets it routes. It costs nothing in traffic. But it cannot learn where a group lives, because group membership is not visible in a source address. So learning routers always forward group messages to the other side — every one, in both directions.
On a network built around network variable bindings, that means most of your traffic is being flooded rather than routed. If a segment is congested and there are learning routers in the path, that is where to look. Configured routers can be given group topology explicitly and will actually filter.
Learning routers also require a loop-free topology. Where the physical topology can loop, you need configured routers to impose a logical tree on top, or packets circulate indefinitely.
What goes wrong
Domain length mismatch. Two devices with the same domain value but different domain lengths do not match. They will sit on the same wire ignoring each other completely. Check the length, not just the value.
Source subnet of 0. This means the device does not know its own subnet number — the normal state before commissioning. If you see it after commissioning, configuration did not take.
A device answers diagnostics but ignores its data. Almost always a state problem rather than an addressing problem. Only a configured device passes messages up to its application. A checksum error over network configuration memory is enough to send a device back to unconfigured on its own, taking its authentication keys with it.
Group message storms. See the learning router note above.
Devices reachable only by Neuron ID. They are unconfigured. Either they were never commissioned, or something dropped them back.
Leaving a domain, and a security note
A device can be removed from a domain in two ways. The Leave Domain command sets the domain length to 0xFF, zeroes subnet and node, clears the authentication key, and resets the device to unconfigured. There is also a domain-update path that produces the same 0xFF result without the reset side effects.
Both clear the authentication key. That is deliberate — a device leaving a domain should not carry its credentials out with it.
The standard attaches a blunt warning to the domain-update command that is worth repeating, because it affects how you plan commissioning: the encryption key is propagated in the clear. Use it only where you can guarantee physical network security, or where security is handled some other way. Commissioning a LonWorks network is not a secure operation, and no version of the protocol makes it one.
FAQ
What is the difference between a subnet and a channel?
A channel is physical — a piece of wire with a defined bandwidth, possibly built from several segments joined by repeaters. A subnet is logical, used for routing, and capped at 127 devices. Several subnets can share one channel.
Can a device be in two domains?
Yes, at most two. It gets a separate subnet/node address in each. Two subnets for one physical device must be in different domains.
What is the Neuron ID and where do I find it?
It is the 48-bit Unique_Node_ID set at manufacture. Read it with a network management query, or press the service pin on the device to trigger a manual service request.
Why can’t my two LonWorks networks talk to each other?
If they are separate domains, they cannot, by design. There is no inter-domain routing in the protocol. You need an application-level gateway.
How many devices can be in a group?
64 members, addressed by a 6-bit field. That cap applies to services that need acknowledgements. Unacknowledged-repeated service has no such limit — a group using it can be as large as the domain.
Do I need configured routers or will learning routers do?
Learning routers are simpler and need no commissioning, but they flood every group message across every port. On a network built on network variable bindings, that is most of your traffic. Use configured routers where you need group filtering or where the topology can loop.