Using a zniffer to find physical devices 'lost' in wall? (or other ways to find a 'working' device that isn't excluding/including well)

[MrNoTip 2]

I am progressively excluding my HC2 devices and migrating them to HC3, but I have a bunch that seem to not be responding to triple clicks...this was for exclusion initially, but then on re-inclusion after I managed to exclude after the 20th try for one dimmer.

 

I think there are/could be multiple causes here:

• Dodgy switch wiring (there was one light that was finicky even on a directly wired setup and it took ages to even unpair)
• Devices not where I think they are  - behind switchplate - I've already found a few by moving the HC3 closer to the ceiling or pulling a downlight out and seeing a Fibaro device come trailing behind it
• Connected to S2 instead of S1 by lazy sparkies (possible, unverified)
• Devices behind brick external walls/internal insulation, and now part of a much populated HC2 network

 

I plan to wait for a dry/cooler day (aussie summer) to trapse my HC3 around the house to likely candidate points, but it would be easier if I could rely on extenders, a secondary controller (Aeotec Gen 7 with Silicon Labs PC controller*), or even just find the devices myself withmy Aeotec Gen 5 stick, running as a sniffer might be a better approach.

 

 

My questions are:

• Would a sniffer on a USB stick (small, internal antenna) be of any use to try to triangulate the device's location? (I was thinking to monitor the RSSI or something)
• If so, does an excluded/factory fresh device send any z wave signals when interacted with via S1 switches? (I have at least one that is now excluded but still in an unknown location with an unresponsive triple click)
• Do exclusions get passed and processed network wide? Or only in direct range of controller? The 'remove' function lacks an NWI flag. I have added some extenders in the general areas I am having issues, without much change. 
• Can exclusions and inclusions get passedand processed by a secondary controller? If so, do you need to run the process on the secondary (in my case through Silicon labs PC Controller),or start the exclusion on the HC3 and trust the secondary will mediate?
• Would powering down my HC2, Zniffer, Secondary controller make it easier for the HC3 to find devices through a normal include?

*Not sure if relevant, but:

• All of these 'can't exclude' devices are functioning fine on the HC2 network, though I know each one I exclude changes and limits the mess on that network.
• I am running Engine v 3 on the HC3.
• None of the diminishing HC2 networking are security connected, but pretty much all of the HC3 network has been included as S0 or S1.
• The 700 series controller is behaving a bit odd as a secondary for the HC3 compared to the HC2. It's definitely getting included, finding devices etc, but any mapping and node tracing functions seem to get null results or error out. (the standard APIs also get nulls when tracing last route on the HC3 - I need to use the new engine API to get those details....but I didn't think the silicon labs devices would know/care about that?