NVR requires open ports for NTP function

C

ChorleyCake

n3wb
Aug 2, 2016
6
0
Long time reader first post. Firstly thankyou to all, a great forum, I've learned all I can just reading but now I'm stumped.

I own an NVR from UK company called X-Vision (X2R32EN). I suspect it is a DigiMerge based product as the hardware version is DM-203. Googling around I found an analogue DigiMerge product, and the software is although non functioning looks of the same design.

Now the problem for me is the NTP function is using a connection to AWS service (or China based server) on ports 8000-8002. This also allows the remote app service to work (alarm notification) which I don't use outside of my network (the app alarm notification hardly works and requires these ports open even within my own network). I run an OpenWrt router behind my ISP's router and IPC/NVR are on their own VLAN which is entirely blocked to the WAN except of course 8000-8002 specifically to my NVR. Upnp is also disabled (router and NVR) and I have no ddns(NVR). ISP router also has forwards on 8000-8002.

My NVR's choices for NTP are time.windows.com, time.nist.gov or pool.ntp.org. Non of which are actually connected to as observed on OpenWrt. What is connected is amazonaws on 8001. And when I activate my app (bare in mind all within my network, no ddns etc) I get multiple connections. Two more connections are more amazonaws on 8001 but worryingly are the...other connections. Always changing, some times China and atm 5-144-128-173.static.hostiran.name, two on 8001 an one on 8002. Whois finds nothing on these. Usually the Chinese ones can be whois-ed.

Xvision (via yk3 the parent company I think) have no solutions for me, every so often I phone them and ask again but I don't think they want to help.

I have a Raspberry Pi NTP server which I would use for the X2R32EN. I want to shut this 8000-8002 nonsense down without the clocks going batshit crazy and have a completely WAN blocked VLAN.

Any ideas folks?


Sent from my D6503 using Tapatalk
 
Run your own DNS service and hijack time.windows.com/time.nist.gov/pool.ntp.org and point em at your local NTP Server.
 
Thank nayr, I sort of had that idea (without the actual details).
There is no connection made directly to time.windows.com, time.nist.gov or pool.ntp.org though. It is all through these servers (amazonaws etc). I suspect the NVR NTP choices are just an illusion of choice.

Sent from my D6503 using Tapatalk
 
those hosts are pools with IP address and they change constantly and can return various results for many reasons, like where you are; most are cloud based now..

for example, my laptop here connected to work VPN:
Code: 
# host time.nist.gov
time.nist.gov is an alias for ntp1.glb.nist.gov.
ntp1.glb.nist.gov has address 216.228.192.69
ntp1.glb.nist.gov has IPv6 address 2610:20:6f15:15::27

and here is my home automation server using my home-business connection:
Code: 
$ host time.nist.gov
time.nist.gov is an alias for ntp1.glb.nist.gov.
ntp1.glb.nist.gov has address 216.229.0.179
ntp1.glb.nist.gov has IPv6 address 2610:20:6f15:15::27

Your ISP could also be hijacking those DNS them selves
 
I am familiar fairly familiar with ntp, it was my first project with Raspberry Pi about 3 years ago, and indeed there are 4 ntp connections to the RPi, on the usual port 123. As this nvr uses ports 8000-8002 for various functions, alarm, ntp, and whatever...and I am not even sure it is using ntp as in an actual ntpd service (some proprietary cloud based function perhaps).
I had the idea of mirroring the NVR port in my switch and use wireshark somehow but I really don't know what to look for.

Sent from my D6503 using Tapatalk
 
sounds like you should offload that NVR and go w/something a bit more suited to your needs..
 
Perhaps,, just bought a car though so a no go atm.
Just mirrored the port and wireshark-ed it, some Telnet activity going on there but nothing jumped out at me, it's scraping the limits of my understanding to be fair. Anyway thanks for the replies, I think with all the will in the world it is what it is and that is that!

Sent from my D6503 using Tapatalk
 
You must log in or register to reply here.
Top Bottom