IPCam calling home...

[DaveFromPeg]

I have this IPCam I picked up on Amazon years ago..
It is sold under different names (currently "Shenter") and is an inexpensive 10x zoom PTZ and actually has a very good resolution for the price point (under $120)

Recently though after adding a "Pihole" to my local camera subnet, I see the camera is sending out packets to a website who knows where.
I am currently having the Pihole drop this traffic but it's clogging up the logs and actually quite a bit of traffic.
I have scoured the config looking for any setting that could be related but unsuccessful.
Wondering if anyone is familiar with these web addresses?
Thanks

another website it is sending to is.... device.syslog.ulucu.com

 

[Mike A.]

Get used to it. You'll see a ton of stuff reaching out if you've just installed PiHole or something similar. You can try turning off everything related in the cam but many still will try.

Block it as you are and at your router. If you don't want to see the log entries you can exclude those sites. Also might try setting the gateway on the camera to its own IP address or a nonsense gateway address. Still will be trying but you won't have it clogging up the logs.

 

[DaveFromPeg]

Get used to it. You'll see a ton of stuff reaching out if you've just installed PiHole or something similar. You can try turning off everything related in the cam but many still will try.

Block it as you are and at your router. If you don't want to see the log entries you can exclude those sites. Also might try setting the gateway on the camera to its own IP address or a nonsense gateway address. Still will be trying but you won't have it clogging up the logs.

Change the gateway.. thats a great idea, thanks

 

[AlwaysSomething]

Just a heads up... I have a similar problem with some Amcrest Cameras. Changing the DNS works until the camera reboots (I get a lot of power outages). After reboots it reverts. Just wanted to let you know if you see them come back up you remember what you did. I forgot so had to write it down in my notes. Real PITA.

Someday I want to follow the threads on how to hack/create custom firmware and see if I can't just permanently stop it.

EDIT: Removed the comment about Gateway reverting because I don't have that written down so can't say for sure. DNS I know for sure for my cameras.

 

[The Automation Guy]

This is why we always suggest that people block their cameras from accessing the internet. Of course that doesn't stop the camera from trying to connect and create this traffic on your local network. I'm unaware of a method to prevent the camera from trying to connect, but as already suggested in the thread, there may be some ways to prevent this traffic from being logged if you don't want to see it.

 

[TonyR]

Just a heads up... I have a similar problem with some Amcrest Cameras. Changing the gateway or DNS works until the camera reboots (I get a lot of power outages). After reboots it reverts. Just wanted to let you know if you see them come back up you remember what you did. I forgot so had to write it down in my notes. Real PITA.

Someday I want to follow the threads on how to hack/create custom firmware and see if I can't just permanently stop it.

You're saying the camera is configured to have a static IP, subnet mask, gateway and DNS and when it's rebooted all or some of those change or revert?
All of them or just the G/W and DNS?

 

[DaveFromPeg]

This is why we always suggest that people block their cameras from accessing the internet. Of course that doesn't stop the camera from trying to connect and create this traffic on your local network. I'm unaware of a method to prevent the camera from trying to connect, but as already suggested in the thread, there may be some ways to prevent this traffic from being logged if you don't want to see it.

Someone suggested that I try changing the default gateway on the camera and it made sense because blueiris is on the same local subnet so the camera shouldn't need a default gateway once setup in blueiris... which it was..
But now it has lost connection and there is no "reset" button anywhere on the camera. I even removed the top cap on the camera and can see at least one board on there but no reset.
SADP isn't finding this cheap knockoff although it used to showup on the sadp tool.. at a loss now

 

[TonyR]

Someone suggested that I try changing the default gateway on the camera and it made sense because blueiris is on the same local subnet so the camera shouldn't need a default gateway once setup in blueiris... which it was..
But now it has lost connection and there is no "reset" button anywhere on the camera. I even removed the top cap on the camera and can see at least one board on there but no reset.
SADP isn't finding this cheap knockoff although it used to showup on the sadp tool.. at a loss now

It has a place for a microSD card according to the image....no reset button under a door to that card? Or at the end of the cam's pigtail?

 

[AlwaysSomething]

You're saying the camera is configured to have a static IP, subnet mask, gateway and DNS and when it's rebooted all or some of those change or revert?
All of them or just the G/W and DNS?

Not ALL of the configs but the DNS for sure. It won't let me set the IP to itself so I set the DNS to 0.0.0.0 or 127.0.0.1 (I think one camera won't let me use 0.0.0.0 either) and if the camera reboots it reverts back to its default which I think is 8.8.8.8. I think I tried the gateways as well, but I don't have that written down so I can't say that one for sure. I'll edit my post since I don't have that one written down. Anyway, I just change the DNS now whenever I notice I have a problem or can remember after a power failure. I have the camera blocked from the internet and it sends multiple DNS requests a second because of that.

Spoiler: More details if interested

There was no performance issue so I didn't notice it until I moved the cameras to new locations and needed to use WIFI temporarily (these cameras have ethernet and WIFI). I'd have to check but I think they are 3 different models that do it too (2 are indoor PTZ models and 1 is an outdoor model).

I only notice it when they used WIFI because Unifi was a "Wifi Experience" it was went down to poor when I added the cameras. At least with Unifi I could track the performance down to the client level. At the client level I saw the Amcrest cameras (in WIFI) had high retries. I didn't notice any drops or anything so was curious and spent days searching for answers but couldn't find anything (FYI -At the time I didn't know how to capture network packets).

I moved the cameras to a TP Link/Omada network to see if it was a Unifi problem or the cameras or both (using the tools I had). Unfortunately, Omada doesn't show the retries down to the client level (only at the AP level). However, once I moved the cameras to the Omada AP the retry count went up exponentially for the AP. Worked with Amcrest but gave up as they had me going in circles and these were past warranty so couldn't return them.

Fast forward...I had to look at the actual traffic one day for something else (and now I learned about WireShark) and then I saw the multiple DNS attempt every second. That's when I set it to 0.0.0.0 and the retries dropped away.

Fast forward again to having to troubleshoot something else again and I saw the high retries again. Checked the DNS entries and they reverted. Troubleshot that and sure enough it reverts when ever the camera rebooted. I have the latest firmwares for all of them too.

Sorry, I typed a lot but maybe it will help someone else troubleshoot someday.

 

[TonyR]

Not ALL of the configs but the DNS for sure. It won't let me set the IP to itself so I set the DNS to 0.0.0.0 or 127.0.0.1 (I think one camera won't let me use 0.0.0.0 either) and if the camera reboots it reverts back to its default which I think is 8.8.8.8. I think I tried the gateways as well, but I don't have that written down so I can't say that one for sure. I'll edit my post since I don't have that one written down. Anyway, I just change the DNS now whenever I notice I have a problem or can remember after a power failure. I have the camera blocked from the internet and it sends multiple DNS requests a second because of that.

FWIW, I set my Amcrest IP2M-841's gateway and DNS to an unassigned IP in the same subnet but outside router's DHCP pool; for example, cam is 192.168.200.205, actual gateway is 192.168.200.1 and I set the cam's G/W and DNS to 192.168.200.254.

 

[DaveFromPeg]

Further to this.. the manufacturer sent me a search tool which he advised would allow me to reset and gain access to this camera.. BUT connected to the same switch on the same local LAN and pinging the actual camera at the same time, this tool found nothing.
So try as I may to gain access or find a reset button I'm unsuccessful but what really pee's me off is that I can access the login page and I know the credentials are correct but it denies access and comes back with...


So I'm not understanding why changing the gateway and/or dns address suddenly creates this "network anomaly"

 

[DaveFromPeg]

It has a place for a microSD card according to the image....no reset button under a door to that card? Or at the end of the cam's pigtail?

Sorry I'm seeing any slot for a micro SD on this cam... apparently there may be a reset button right next to the SDcard slot?

 

[TonyR]

Sorry I'm seeing any slot for a micro SD on this cam... apparently there may be a reset button right next to the SDcard slot?

If it's an outdoor-rated cam the SD card slot (if there is one) is generally found behind a "weatherproof" door and if there's a reset button at all it's usually under that same door.

 

[IAmATeaf]

Further to this.. the manufacturer sent me a search tool which he advised would allow me to reset and gain access to this camera.. BUT connected to the same switch on the same local LAN and pinging the actual camera at the same time, this tool found nothing.
So try as I may to gain access or find a reset button I'm unsuccessful but what really pee's me off is that I can access the login page and I know the credentials are correct but it denies access and comes back with...
View attachment 194559

So I'm not understanding why changing the gateway and/or dns address suddenly creates this "network anomaly"

Maybe it’s trying to authenticate across the internet? When you try and log in can you see any data being dropped?

 

[DaveFromPeg]

Maybe it’s trying to authenticate across the internet? When you try and log in can you see any data being dropped?

No I don't think so.. was thinking of putting wireshark on that and seeing exactly what those packets are sending. But I'm still not getting access The top cover does easilyh come off with a single screw and there is an SD Card slot there but no reset unfortunately

 

[DaveFromPeg]

So according to the manufacturer of the ptz cam (RSTRG) they say the camera is toast.
Kind of ridiculous that changing the default gateway or dns server address can brick an ipcam

Anyway I saw this ipcam from Genbolt that has fairly good reviews on Amazon...
Almost identical to the one I'm having issues with and for the price you can't beat it.



The one thats toast was up for almost 9 years and the winters up here in Canada could be -40 F/C for weeks on end

I'm not one to spend too much money on ipcams. They are basically throw aways to me
We'll see how it goes

 

[AlwaysSomething]

I'm surprised the vendor told you it was toast but couldn't tell you where the reset button was...

I just happen to have one of my Amcrest cameras open since I'm changing the SD card. The button is not next to the SD card slot on this camera and is not easily identified and small. Here is a picture to help. You push it in from the side. If you look closely you can see the button to the right of the white housing. I put the thumb drive for size comparison but if you look at the bottom of the picture you will also see the SD card in the slot as well for size comparison.



I'd say put the camera and a PC on a dumb switch/hub with no router (unmanaged) and see if you can access it that way. Sometimes managed ("smart") equipment makes things complicated.

If shipping wasn't expensive I'd say send it to me if you are going to throw it out. One man's garbage is another man's treasure.