Foscam C1 disconnecting

[alexdelove]

Hi Folks,

I have had Foscam cams for years. Just bought two new C1's and both of them appear to be dropping off the network after a while.
Both are connected wired straight to the router. Both have valid IP addresses, no issues there. Connecting to them via their web interface or via BlueIris initially works like a charm. While viewing 720P video, after a while picture just goes black via web interface or BI shows No Signal. Then video returns back after a while..then dissapears again. From time to time I see "connecting..." appear when no video is present.

Is there something special about C1's setting or performance I should be aware of?

It's running latest firmware. Factory Reset didn't fix the issue with either of the cams.

Thanks,
Alex...

 

[alexdelove]

If anyone cares what the issue is/was... C1 seems to be "calling home" every few minutes or so by contacting what I think is Cloud Services server somewhere in China. Checking the router log I saw repeated "calls" to external IP addresses. This takes place with all options disabled in Setup (FTP, Email, DMS, etc).

Setting up the router to deny all external access to Internet solved the disconnects and C1 cams have been running smoothly ever since.

Disturbing, to be honest.

 

[t84a]

Good find. Foscam gets no love on this forum. I have about 20 Foscam cameras around the country and have bad pretty good luck.

 

[Lily_L]

Did you figure out what contents in the repeated "calls"? C1 supports "image uploads to FTP" per its key feature description.
Thanks!

 

[alexdelove]

I have all options disabled, DDNS, UPnP, Mail, FTP, any detections, saving images, etc. They supposed to do nothing other than my video server accessing them from behind the router/firewall. Both have latest firmware from a month ago, ver 2.52.2.16

Both C1 are trying to get to these IP's and ports:

DST=74.125.31.99 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=64767 DF PROTO=TCP SPT=49005 DPT=80
DST=50.19.254.134 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=16370 DF PROTO=TCP SPT=47850 DPT=443
DST=61.188.37.216 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=22174 DF PROTO=TCP SPT=55079 DPT=8000

First one is Google in CA, USA
Second is Amazon in VA, USA
Last is China Telecom in Chengdu, Sichuan, China

I found this recent conversation on foscam forum. Seems I am not unique in seeing these comms and Foscam said it has to be with P2P, even if it disabled!! Read it:
http://foscam.us/forum/foscam-dialing-out-to-suspect-hosts-t17699-40.html

So, while they're trying to connect for whatever but effect was they were disconnecting video feed me, until I set up my router/firewall to block ALL external internet traffic from them, including of course the above listed connections.

 

[Andrew Becherer]

This is one, among several reasons, I am putting my cameras on a separate VLAN. No reason any of my cameras should ever be talking to anything directly over the Internet (since I use BlueIris as an intermediary).

 

[Fuzz]

When I got my cameras (awful generic chinese ones - I'm on this forum because I'm researching upgrades) I first audited them by connecting them to a PC configured for internet sharing and used wireshark to see what they tried to do. My experience was similar to yours: they connected to google (maybe to detect if internet connectivity is available), yahoo (trying to dial into the last century?) and china.

I didn't want to muck around with router settings for every camera but setting each camera's DNS entry to 127.0.0.1 (loopback IP) stopped these problems for me. I should point out that this only prevents the camera from accessing addresses by hostname, not by IP, if you want to prevent your camera accessing anything outside your lan then setting it's gateway address to an unused IP within your lan subnet would probably do it (needs to be within LAN subnet because UI will probably stop you if it's outside subnet, and if it doesn't it might break all connectivity completely).

I really don't trust any of these devices with direct connectivity to internet which is why my external access to them is via an ssh tunnel using pubkey authentication (ssh server is a Beagle Bone Black that I keep running 24/7 on the same battery backup as cams and router).