Kaetemi

It seems the cameras can be accessed directly through RTSP. There's zero security, the box acts like a switch with its own DHCP server on the PoE side. Check your CCTV box settings to see which network the box assigns to the cameras. This should be 192.168.138.0/24. Add an IP address to your system within the same subnet. The CCTV box can be pinged at 192.168.138.99. The cameras will have IP addresses 192.168.138.100 to 199. Connect using this URL format to access the HD stream: rtsp://192.168.138.105:554/11, and the SD stream: rtsp://192.168.138.105:554/12

On my new box, port 30100 is open, though. No idea what it's for. EDIT: Interesting. It does seem to create local LAN UDP traffic to port 33484 on the box. Large amounts while playing video. A 32 byte packet every second while idle. EDIT2: The UDP traffic seems to be initiated by the box. Also, I'm seeing UDP broadcast traffic from the cameras that are connected to the box's ethernet ports leaking into the LAN. I wonder if the box will route the traffic somehow. This after the box broadcasts 51a80000000000000000000000000000 from port 18153 to 18152. The camera message comes from port 18152 to port 18153. EDIT3: If you add routing to 192.168.138.0/24 to the IP address of the CCTV box, it also responds at address 192.168.138.99. No difference in which ports are open, though. It does not seem to route the cameras. EDIT4: Set your own IP address in the 138 range (below 99), the cameras appear to be reachable directly. The CCTV box acts like a regular switch between the LAN and PoE ports. Camera has open ports 23, 554, 8000, and 8080. Port 554 on the camera: RTSP/1.0 400 Bad Request Cache-Control: no-cache Server: Hisilicon Ipcam Port 23 on the camera: (none) login: Password: Login incorrect

I did this for a different Zosi revision that still had the port 5000 open. (This is the port that the iVSS tool connects to.) https://github.com/kaetemi/sdk_for_zr04rn Newer boxes seem to have all the ports closed, even though it still lists the port 5000 service in the configuration. My bet is that they just closed the ports, and now establish an outgoing connection to their cloud services, to create a tunnel, which just connects to the same port 5000 service that way. EDIT: Seems not.