This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

detect stream url from ipcamera

0

I have an old chinese ip camera connected in my LAN, with its software and plugin for browsers. I have a PC with 192.168.1.8, the ip camera has an ip 192.168.1.111 I can see the video from its software and when connected in the browser, like: http://192.168.1.111/html/index.html from which I must click "Local" to receive the video stream. alt text

I want to use another third party program that needs the lan URL of the cam's video to connect. In the manual there's nothing and the vendor has closed his site... So I'm trying with wireshark to sniff the url. I tried to capture from a FF tab before opening the home link "http://192.168.1.111/html/index.html" with this filter: ip.addr==192.168.1.111 and here is the results: https://www.cloudshark.org/captures/5ee1157195ea My test autenthication is: user:prova pass:video

I haven't seen any direct url of the stream in the data, that seems only HTTP and TCP (no RTSP or other)... Could you help me detect it? If you need more info or different wireshark data, ask me what you need.

Thank you very much.

asked 09 Sep '15, 08:22

Vincenzo%20Ferreri's gravatar image

Vincenzo Fer...
11114
accept rate: 0%

edited 09 Sep '15, 08:24


One Answer:

0

Your data might be in tcp.stream eq 33 as it is the largest stream of packets according to the Statistics > Conversations > TCP > sort on bytes info. The client seems to target the server with some XML that contains an authentication string and a channel to ask for? Then the server answers with more XML specs on how to transfer the stream. <?xml version="1.0" encoding="gb2312" ?> seems to point at 'chinese characters in the xml , maybe hard to read...

answered 10 Sep '15, 01:44

Marc's gravatar image

Marc
147101316
accept rate: 27%

So, is it impossible to connect to this camera from a third party prog?

(10 Sep '15, 13:06) Vincenzo Fer...

Hi Vincenzo, i don't think it is impossible .. but depends on many factors, is your 3rd party prog configurable to talk like a browser when addressing the cam? Time spent vs the money of a different one etc.

(11 Sep '15, 00:08) Marc

Well, I see the most progs need an url of video stream to connect... they doesn't act like a browser, maybe they use http commands for PTZ motors... For the "chinese characters" found in the above TCP stream, do you think it's possible to decode to normal text, so I can recover this URL stream? If that's not possible, I'll give up...

(11 Sep '15, 02:05) Vincenzo Fer...