What is the maximum ZigBee message payload length in secure and non-secure modes?
The attached doc explains header size and usage in various network layer. As a summary:
max APS message no security: 100 bytes (MAC payload (116) - NWK layer header (8) - APS layer header (8) = 100)
max APS message with network security: 82 bytes (MAC payload (116) – NWK layer header (8) – NWK security framing (18) – APS layer header (8) = 82)
Max APS message with network and APS security (end-to-end security with link key): 73 bytes (MAC payload (116) – NWK layer header (8) – NWK security framing (18) – APS security framing (9) = 73)
Note that source-routed unicasts will incur additional payload reduction based on the source route overhead, which is equal to 2n+2 bytes for a source route with "n" relays (n+1 total hops to the destination).
More information is provided by the attached zigbee-payload-calculator.xls.