How To Setup Linksys Ip Camera On Comcast Router

I was recently given iii rather locked-down network cameras. Each photographic camera was pre-programmed to communicate with a specific website, and only adhere to a predefined wireless access betoken. Naturally, at that place was no supplied username or password.

I thought about how I might get admission. Using a human-in-the-heart attack to sniff the countersign, or trying to dump the firmware and examine that. Sadly, all the vulnerabilities previously reported no longer piece of work. Subsequently a little bit of thought, I went for decided low-tech solution; I hit the reset button! Aye, each camera had a recessed switch, accessible just with a paperclip, which reset the device to manufacturing plant settings after holding it down for x seconds.

Anyway, this is my voyage of discovery with the three cameras. They are:

All of them are manufactured by Taiwanese OEM Sercomm. Annoyingly, Sercomm don't have any customer services. They mostly resell the cameras to Linksys, Cisco, Xanboo.

SerComm don't offering whatsoever firmware, GPL downloads, or much data nigh the cameras - so information technology's all very much trial and mistake.

Defaults

Afterward resetting the cameras, they'll happily attach upward to whatsoever wired network via the Ethernet port. Visit the IP address assigned past DHCP and you lot'll get to the admin panel.
The default username is "ambassador" - there is no password set.
You can at present become and fiddle with all the settings.

High Resolution Mode

The cameras are meant to be able to record at 720p - yet the user interface doesn't seem to allow it.
Camera Settings
Luckily, the API allows us to force the resolution.

http://192.168.0.42/adm/set_group.cgi?group=H264&resolution=4

http://192.168.0.42/adm/set_group.cgi?group=JPEG&resolution=four

Await! What? API?!

Oh yes, all the cameras come with a variety of commands which can exist controlled past simple a HTTP GET asking.

Discovering The API

As I said previously, Sercomm provides no documentation. Luckily, their resellers practice!
EyeSpy247 have the admin manual for the RC8221.
Use-IP have the admin transmission for the OC821D.
I haven't yet plant a manual for the RC8230 - but it uses about of the same API commands. The only principal add-on is the ability to move the camera via its pan/tile functionality. After a bit of digging, I found a word on how to actuate this functionality.

Upwards:

http://192.168.0.42/pt/ptctrl.cgi?mv=U,10

Down:

http://192.168.0.42/pt/ptctrl.cgi?mv=D,10

Left:

http://192.168.0.42/pt/ptctrl.cgi?mv=L,11

Right:

http://192.168.0.42/pt/ptctrl.cgi?mv=R,11

The manuals give all sorts of instructions, how to view video streams, go photos, gear up and get various options. There are, sadly, some omissions.

Sending Sounds

One of the tasks I wanted to achieve was to brand the cameras play some of the turret sounds from the video game "Portal". This is proving tricky, despite the manual's promises to the contrary.

It should be possible to Postal service an sound file to the cameras, either in G.726, or Chiliad.711 (a-law or u-law). Despite creating the sound files correctly, and POSTing them to the cameras - they make not a peep!

curl -vv --data-binary @alaw8k.wav http://user:pass@192.168.0.42/img/g711a.cgi

curl -vv -X POST -d @alaw8k.wav http://user:pass@192.168.0.42/img/g711a.cgi --header "Content-Blazon:audio/x-wav"

I get a 200 OK, and the book is set on the camera. Nigh vexing!

If yous think you tin can help, please leave an answer on StackOverflow.

Arming - or lack thereof

With my other cameras, I can ship a control to arm or disarm. I don't demand the motion detection to send me emails every 2d of the day - only when I'k out of the business firm.

Looking at the source lawmaking of ane of the pages, information technology looks like it's possible to Postal service some data to /adm/file.cgi - just it'due south non clearly documented which parameters are required. Information technology will take me some time to work through the tangled nest of JavaScript.

Email

The cameras volition send video when they discover motion - although getting this to work isn't at all obvious.
SMTP Settings Screen-fs8
Firstly, the password is hard-coded to be a maximum of xvi characters. If your password is "StarTrekIntoDarkness1" y'all're out of luck.
Secondly, the "Test the Server" button doesn't actually piece of work. Information technology randomly gave me errors well-nigh non beingness able to reach the server. I struggled for hours until I discovered that the mistake letters were lying to me! If you enter the details correctly, and the camera has access to the Internet, it should just work.

That said, once enabled, information technology volition happily transport emails with large video attachments to you lot.

Video Audio

All the cameras have microphones, and all exercise audio triggering (sending an alert when racket levels rise). Withal none of the cameras would embed audio in with the video. When streaming over RTSP, it was possible to pick upwards audio from the microphone. Lowish quality, 8kHz, mono - just better than nothing.
Once again, if anyone knows how to get the alert videos to include audio, please let me know!

Motion Detection

Setting the motion detection area is very useful. You might want to ignore movement on the flooring if you accept a pet, or concentrate on a door handle. Sadly, with these cameras, you have to utilise IE6 or greater to gear up the detection surface area.
Internet Explorer 6 Required

You lot tin try and employ the API to set areas - but without beingness able to run into the area in question, information technology's an exercise in frustration.

For my needs, having full screen video detection is fine. I may have to infringe a Windows machine if that changes.

Open Source

Each camera has an embedded Open Source page at /adm/Licenses.txt which includes all the text of the relevant GPL etc.

All iii cameras have the following Open Source components:
Davicom Ethernet driver
Linux kernel ii.6.18
wireless_tools 26
busybox ane.16.0
dhcpcd 1.3.22-pl1
ez-ipupdate 3.0.11b7
iptables i.three.4
ppp 2.4.i
cron daemon
samba client iii.06
glibc 2.8
alsa-lib-i.0.16
wpa_supplicant 0.4.5
NTP
thttpd-2.25b

Interesting to notation that BusyBox is an unstable release version from 2010, thhtpd supports IPv6 even though the cameras don't appear to.
wpa_supplicant is ancient - that may explain why information technology can't cope with SSIDs with spaces in them. I presume it'southward the hardware which won't scan the 5GHz range.
The Linux kernel is from 2006 - that's mutual plenty in embedded systems, simply I practice wonder if it presents a security risk.

Security

The cameras offering an SSL connection. All the same, the certificate is self signed and uses MD5 with 1024 bits. Basically, a security signing which was advised confronting in 2010.
In that location's no way to replace the certificate without replacing the firmware. If you are willing to trust information technology, the connexion is secured via SSL.
Secure Connection
Bold you can ostend the certificate is correct, the encryption should be sufficient to stop anyone only the NSA peeking through your cameras.

That said, the RTSP channel isn't protected by SSL. You tin can requite a username/password, set time of day access, and restrict to specific IP addresses - but the video is transmitted in the clear.

For now, I'm keeping my cameras on my LAN with no external access to them.

What Next

At the moment, I've set the cameras upward, but I'k not actively monitoring them - information technology's but as well much work to switch each of them on when I leave for work.

So, if yous can help....