How to analyze by capturing packets when suspecting device reboot?

• After the device restarts, there will be a Basic: Report Attributes, where the 0xFFE4 attribute value is 0x01, indicating that the device has restarted.

• After the device restarts, a device that is connected to the network will first send several Link Status messages to establish a neighbor table, and at the same time, the device's NWK Frame Counter will increase by more than 1024. It can be confirmed whether a restart has occurred by intensively sending Link Status messages and observing jumps in the NWK Frame Counter.