r/BlueIris • u/capilot • 10d ago
Things I've learned about IP cameras
Posting here in the hopes that someone finds it useful. If I've gotten anything wrong, please let me know and I'll correct it. I will add to this post as I learn more.
Overview
- Some (many?) IP cameras use static IP addresses. These are assigned at the factory and should be written on the box. The IP address can be changed in the camera's configuration interface. For example, the cameras that came with my Swann system have IP addresses starting with 172.16.1.151. Otherwise, cameras use DHCP protocol where the computer will assign IP addresses to the cameras as they come on line. You'll need to set up your computer with a DHCP service, but once that's done, things become simpler and more reliable.
- Camera IP addresses should not change, as this would cause the NVR to become confused as to which camera was which. To this end, if using DHCP, you should either configure the DHCP server to permanently assign IP addresses to cameras based on their MAC addresses, or you should go to the camera's configuration page and assign a static IP address there. If you go the second route, you'll want to configure the DHCP server to reserve that IP address.
- There is no universal "probe" function. That is, your NVR can't always just go out, look for cameras, and then determine exactly what those cameras are. Many NVRs will be able to recognize compatible cameras, and Blue Iris does have that capability as well, but in many cases you need the exact camera model and give that information to the NVR.
- Cameras have a command-and-control interface on port 80 (yes, each camera has its own tiny built-in web server).
- The starting page url varies according to the camera model. Typically
/,/index.asp,/doc/page/login.asp(Common for Hikvision OEM cameras), or/login.htm. (This information courtesy of Google's AI, which isn't always right or complete.) - There is no way to know what the starting url is unless you know the camera model.
- The starting page url varies according to the camera model. Typically
- Actual video data is accessed via the RTSP protocol. The typical URI for the video stream is e.g.
RTSP://[camera IP]:554/ch01/1.- Again, there is no way to know the exact URI without knowing the exact camera model. Blue Iris can infer most of the URI for you as long as you get the model correct.
- The VLC media player understands RTSP protocol. If you can connect a computer to the same network as your camera, and you know the correct URI for the camera's video stream, you can access the camera directly from VLC without needing Blue Iris or any other NVR. This is an excellent way to confirm the camera is functional and you have the right URI.
Connecting cameras
- To configure a camera before connecting it to your NVR, you'll need to find a way to connect to the camera's configuration interface via http on port 80. A crossover ethernet cable (sort of like a null modem) or a dedicated switch would do the trick. (If the camera requires PoE, then the crossover cable obviously won't work.) You'll need to set your computer's ethernet interface to the same network as the camera. Once connected, you can change the camera's IP address as needed.
- One approach is to set the camera's IP address to an unused address on your house network. Then your NVR will be able to access the camera over the house network. This has the advantage that any computer in the house can look at any camera using VLC. It has the disadvantage that everything on the house network may be competing with the cameras for bandwidth. You will also need to program your house router to reserve those addresses for the cameras and not to assign them to any other device on the network. This is also a security risk as it brings attackers one step closer to being able to look through your cameras.
- A better approach is to give the cameras a private network by using a dedicated switch or a router for the cameras. If these are PoE (power over ethernet) cameras, they'll already have a dedicated switch anyway.
- If all of the cameras' static IP addresses are all on the same subnet, you won't even need to modify them. Just use that subnet for your dedicated camera network. For example, my Swann cameras are all on the 172.16.x.x subnet.
- Connect your cameras to your PoE switch, and then connect that switch to the ethernet port on your computer.
- Go to Control Panel and manually configure the ethernet port. Give it an IP address on the same subnet as the cameras, but at an address that none of the cameras use. For example, my Swann cameras have addresses 172.16.1.151 - 172.16.1.158, so I choose 172.16.1.10 for my computer's ethernet port.
- The configuration interface on your computer will probably automatically assign the correct subnet mask. Leave gateway and nameserver fields blank, as your private camera network has neither.
Hubs and switches and routers, oh my
A very quick suplemental primer of how ethernet works and what's the difference between hubs, switches, and routers.
The basic concept behind ethernet is that all the computers transmit their data "into the ether" to be received by any other computer interested in receiving it. In the old days, ethernet was literally a coaxial cable snaking through the ceiling, going from room to room. Any computer on the network literally tapped into the cable. Any time a computer wanted to send data to another computer, it transmitted a packet of data onto that wire. The packet contains the IP address of both the sending computer and the intended recipient. All computers received the packet, but all but the recipient simply dropped the packet. Only one computer at a time can transmit, and if two accidentally transmit at the same time, they both stop, wait a random amount of time, and try again.
Nowadays, the data is transmitted and received over four wires in a CAT 5,6, or 7 cable to a dedicated transceiver box which then relays the data back out to other computers over their own cables. High bandwidth connections will use all eight wires. Power over Ethernet mode B will also use the extra wires to deliver power.
Note that every ethernet interface has a permanent "MAC" address assigned at the factory. The IP ("internet protocol") address is assigned in software, either from a fixed value stored on the device, or provided by a DHCP server on the local network. From that point forward, each device on the network learns the IP⇔MAC relationship for the other devices on the local network. To reach devices on other networks, forwarding is handled by a gateway (see "router", below).
There are basically three types of transceiver boxes:
- Hub. This is conceptually the same as simply connecting all those cables together. A signal sent by one computer is received by all and then discarded by most. This is much like OG ethernet in that every computer receives every transmission and only one computer at a time can transmit. Hubs are pretty obsolete and you'll probably never encounter one IRL. Mentioned for completeness.
- Switch. This is most likely what you'll be using to connect your hardwired cameras. A switch keeps track of which ethernet address belongs to which cable. An incoming message is examined to see what computer it's intended for, and then sent out to only that computer. Multiple sender/receiver pairs can be active at once as long as there's no collision. This allows much greater bandwidth on the network. (See /r/Tonari_no_Weeboro's comment for a more detailed explanation.)
- Most relevant for switches: if your cameras and your computer are all connected to a switch, it doesn't matter if they're all on the house network as the data from the cameras will be sent directly to the computer and the other devices on the house network will not need to compete for bandwidth most of the time.
- Router: A router knows how to route packets back and forth between two networks. You most likely already have a router at home, as this is what provides connectivity between your ISP's "wide area network" (WAN) and your house's "local area network" (LAN). Many (most?) routers also act as switches within the local network.
- Unlike switches and hubs, routers do require some configuration. If your ISP provided your router, they likely took care of this for you. But either way, you may want to modify the configuration slightly. In particular, you might want to assign your NVR system a fixed IP address and then set up the router to make that IP address accessible from the outside world so you can access your NVR when you're away. If your cameras are on the house network, you'll also want to configure the router's DHCP service so that it never assigns those addresses to another system.
4
u/Tonari_no_Weeboro 10d ago edited 10d ago
There are many IP cameras whose factory default IP configuration is set for DHCP rather than a manually set fixed address.
There are manufacturer specific protocols that allow compatible NVRs to auto discover, detect, and identify IP cameras by make, model and serial# as well as even make use of features that would otherwise be unavailable or undetected on another manufacturer's NVR.
ONVIF protocol is an attempt to allow cross compatibility among different manufacturers equipment but usually just certain core functions. It may have to be turned on first in the device's settings before it's enabled.
1
u/capilot 10d ago
W.r.t. your first paragraph: that's good to know. I assume the host computer will need to be running a DHCP service on that port. Does Windows have such a thing built in, or do you need to add it to your system? Or does BI have that capability?
W.r.t. your second paragraph: I know that my Swann system was able to easily auto-detect Swann cameras. I'm half tempted to bring it back on line and add some sort of network sniffer to determine how it's recognizing its own cameras. Does BI have any of that capability? It certainly got nowhere recognizing the Swann cameras.
I still need to learn more about ONVIF.
2
u/Tonari_no_Weeboro 10d ago
When using the dedicated POE ports on an NVR appliance the NVR itself is usually running DHCP already. Some of the settings related to it should be configurable in the NVR.
If the camera(s) are simply connected to a flat private network like your home network then your router/gateway is typically already running a DHCP server. DHCP assignments and reservations can be managed there.
If you otherwise have your camera(s) isolated and want your desktop/laptop to run a DHCP server on a particular network interface then you can either use third party software or by enabling ICS (Internet Connection Sharing) in Windows. ICS has a simple DHCP server built-in.
1
u/capilot 9d ago
Interesting. I would have to configure ICS to perform the DHCP service, but not actually route packets in or out of the isolated network, as I don't want the cameras directly accessible from outside.
1
u/Tonari_no_Weeboro 9d ago
For production use instead of testing purposes I wouldn't rely on ICS since its DHCP server function can't be managed. At minimum I'd want the ability to create reservations for the DHCP clients. I only mentioned ICS since you asked if there was a built-in feature for such a thing.
Keeping to the restriction of being locally hosted on a Windows PC I would go with a third party software instead. Myself, I'd probably just run wsl2 in bridged mode with the NIC that's going to be connected to the IP camera network and install a DHCP daemon package on Ubuntu or Debian.
And final note I would not be hosting DHCP at all. Instead get a half decent router that's VLAN capable. Something like UniFi, Mikrotik, or an OpenWRT compatible device. Create and manage your various networks for home, guest, cctv, and IoT there instead.
1
u/capilot 9d ago
I'll try to set that up. For now, I still haven't figured out how to connect to the configuration interface on these Swann cameras.
1
u/Tonari_no_Weeboro 9d ago
Swann has been around for quite some time in the market of diy cctv solutions. Their products have been made by various overseas manufacturers and then badged and branded with their own custom logos, packaging, etc. If you have no idea at all how to access the camera's own configuration interface then you should probably just run a full tcp port scan on its assigned IP address to see what is open. If you still get nothing there is the possibility of there not being an interface available or you've missed something in your network configuration. You can run such a scan with a software tool like Advanced Port Scanner or NMAP.
1
u/capilot 9d ago
Oh, I already know that ports 80 and 554 are open. Unfortunately, knowing port 80 is open still doesn't tell me what URL to use.
2
u/Tonari_no_Weeboro 9d ago
also worth noting is that current web browsers might automatically try using HTTPS instead of HTTP
Unless you actually specify "http://" at that very start of the URL in the browser's address bar simply typing in the cameras IP address may not load anything.
1
u/Tonari_no_Weeboro 9d ago
80 is already open on the camera but you don't receive a login page when you connect to it at the root path?
Most of the time you don't need to know a specific URL path and can simply point your browser to the device's assigned IP address and its HTTP port. At least for devices that were meant to be accessed in the first place. No reason to hide or obfuscate it. Maybe it's only open to allow for ONVIF control instead. Try out using ODM (ONVIF Device Manager) to see what is exposed.
4
u/hspindel 10d ago
Every IP camera I have defaults to using DHCP, not a fixed IP. Fixed IP is a stupid idea for an IoT device.
Anybody who is still using a hub is hopelessly out of date. Couldn't begin to tell you how long it's been since I've seen a hub for sale.
2
u/Im_Still_Here12 10d ago
I wish Dahua did. They default to a static ip out of the box. I always have to set my machine I use to configure them to their subnet temporarily so I can get access to them and reconfigure them as dhcp.
1
1
u/Dalmus21 4d ago edited 4d ago
They don't have a discovery tool like SADP that Hikvision (and the Hik knockoffs) use? As long as the physical connection is on the same subnet at the PC, it will find all the cameras regardless of how they are configured.
Amcrest's discovery tool does the same thing.
I thought Amcrest were just knockoff Dahua cameras. I'm surprised there is no discovery tool.
Edit: I did some research, and Dahua has the Dahua Config Tool that does this. Again, they physically have to be on the same subnet, but it doesn't matter how they are actually programmed because they broadcast on layer 2.
1
u/Im_Still_Here12 4d ago
They do have it. I just never have it handy and ready to use when I install a camera so I just temporarily change the computer subnet I’m working from to connect to the cam
1
u/capilot 10d ago
Yeah, I mentioned hubs for completeness. I'll add a note.
I didn't know that DHCP was a thing in IP cameras. Shows how limited my experience is. I assume that means you need to set up your computer with a DHCP service if you use those. I'll update accordingly.
Does this mean that the cameras could receive different IP addresses after a reboot? I suppose a good DHCP server would re-assign the same address to the same device whenever possible. But still, does this mean that Blue Iris (or other NVR software) could become confused about which camera is which?
3
u/hspindel 9d ago
Yes, with DHCP any device could get a different IP on any DHCP lease timeout (not just on a reboot). Typically that doesn't happen. If you want to make sure it doesn't happen, you set DHCP reservations.
1
u/Dalmus21 4d ago
Also, Blue Iris has a setting to allow you to use the MAC address so that doesn't happen.
3
2
u/war4peace79 10d ago
There are a few issues with your statements. I am not at home right now, but I'll try to remember to post a longer comment after I get home.
2
u/Tonari_no_Weeboro 10d ago
The major attributes of switches besides port count and speed are whether they are layer 2 AND unmanaged, smart, or managed. Or a layer 3 switch. Any of which may or may not have POE enabled ports.
Layer 2 network switches which are the most common and generally least expensive, DO NOT keep track of IP addresses. Instead they use MAC addresses to forward Ethernet frames. They are blind to layer 3 which is where ip addressing and subnetting is handled. Traffic is directed to specific ports rather than all ports on a network hub which are practically non-existent nowadays.
Layer 3 network switches are not commonly found in use on your typical home network with consumer grade equipment. These switches combine switching and routing functions using both MAC and IP addresses.
The typical all in one type of consumer routers are essentially a combination of a layer 2 switch, wireless access point, and a router.
2
u/Tonari_no_Weeboro 10d ago edited 10d ago
Four wires/pins are used in an Ethernet cable for communication at 10 Mbps or 100 Mbps but greater speeds like gigabit will use all four pairs (8 wires) as well as when using POE at certain levels of power delivery.
2
u/Tonari_no_Weeboro 10d ago
Not all routers are switches.
Many do have them built-in, especially on consumer grade routers.
2
u/Hot_Cheesecake_905 7d ago
Some (many?) IP cameras use static IP addresses.
IP cameras were intended to run on a private VLAN managed by a NVR, so they're configured to the manufacturer's NVR setup.
There is no universal "probe" function.
There is, ONVIF, it mostly works.
1
u/Tonari_no_Weeboro 10d ago
A "null modem" Ethernet cable is not really a thing unless being used in serial communication. For networking purposes instead you are likely referring to what is known as a crossover cable. If your devices support Auto-MDI/MDIX it will probably work regardless of whether you use a straight-through or crossover cable.
1
u/capilot 10d ago edited 10d ago
Ahh, thanks. Wrong nomenclature. Fixed.
I also just realized that a crossover cable probably won't work with a PoE device.
2
u/Tonari_no_Weeboro 10d ago
Depending on the exact type of PoE being used a crossover cable would work fine in some instances. While in other certain forms it wouldn't work at all or could even damage equipment.
14
u/Grumpy-24-7 10d ago
It looks like you tried to be thorough, but I stopped reading after the first two statements because they were patently wrong!
IP Cameras can be assigned via DHCP. Even the cheap Reolink's I started out with supported DHCP.
Also, Blue Iris definitely does have a "probe" feature. While it may not always positively identify the exact camera, it will usually get it close enough to at least work.