Zigbee cluster commands (broadcast)

In order to issue a factory reset command to a zigbee device, the developer services seems to require a mac. e.g. 00:17:88:01:09:8d:00:20

Are some commands (probably) sent as a broadcast?:

Broadcast Address Destination Group
0xFFFF All devices in PAN
0xFFFE Reserved
0xFFFD All devices with receiver On permanently
0xFFFC All routers and coordinator
0xFFFB Low power routers only
0xFFF8-0xFFFA Reserved

It does not seem possible to issue commands to short ieee. The zig stack gives a traceback.

Has anyone done wireshark sniffing with a ConBee2? (Don’t even know if that is possible).