Finding Camera Stream Paths

This page is for collecting methods and approaches for obtaining camera stream paths. The best results will be with cameras tested by users in the Hardware Compatibility List. Next best results with cameras that detail the path in user manuals, and or are Onvif compliant. Proprietary cameras, and undocumented cameras are more difficult and may require some work if you can't locate the information in a web search.

Overview

Typical methods of obtaining the cameras paths are

• User Manual/Website
• Onvif probe
• Search online resources and forums
• Get access to the camera shell
• Sniff network packets with TCPDump or Wireshark

Methods

User Manual

Reputable name brand cameras (Axis, Arecont Vision, Foscam, many others) will offer stream paths in the user manual or website. If you bought an unbranded cheap camera or one of the proprietary cameras sold in retail stores then you must move onto the other options.

Onvif

Starting with Zoneminder 1.30.4 there is an onvif probe option in the camera configuration. You can also use other Onvif probe programs.

Web Search Online

Ispyconnect has a large database of URLs available for cameras. The ZM wiki has some. Use a search engine. You may also come across a telnet or ssh password, which can be used to gain access to the camera OS.

Camera Shell

Many cameras run GNU/Linux. If you can get access to the files on the camera, through telnet, or through exploiting a vulnerability in the camera, then you can look around for paths. You may be able to send files from the camera to your local machine using FTP. Cameras often have busybox, or similar utils. Running the command "strings" on camera binaries may come up with something.

Wireshark

Watch the packets coming from the camera when accessing the video stream, and determine where the stream is located if possible. Some cameras require custom authentication, so if your camera is proprietary, then things are more difficult. This is the danger of purchasing cameras that don't have onvif compatibility.

Hardware Reading

Dumping the flash with hardware would be a last resort. I have not gone this far, and wouldn't recommend it for the layman. If you have access to a microcontroller or SBC such as a Raspberry Pi or Beaglebone you might be able to configure it similar to this method used by the libreboot project perhaps, if it is SPI compatible.

External Links

• iSpy Connect cameras guide
• iSpy Database
• Official ZM Documentation on this subject