Hello all! New to IP Cameras with a few questions (Specifically Imou Ranger SE 4MP)

P

palujust

n3wb
May 6, 2023
1
2
Toronto
Hello!

I recently purchased a WiFi IP camera and I'm trying to determine if it's possible to initialize it (i.e., connect to the wireless network) without relying on a mobile app. Perhaps I'm overly paranoid, but I'd like to avoid a situation where I cannot change the network SSID or password because the app has disappeared from the Play Store or my phone's version of Android is not supported, etc., etc. (For what it's worth I do find the app works reasonably well, especially compared to the Blink Camera systems I've used before).

information I have/have been able to determine so far:
  • Camera model: Imou Ranger SE 4MP (IPC-A43N)
  • Resetting the camera forces it to boot into AP/Ad-hoc mode and I can connect my phone/laptop to the access point. The camera gives itself the IP address of 192.168.0.108 at this point. (Note, conveniently this is the IP address that my camera gets after it does join my actual network)
  • nmap tells me that ports 80, 554, 8086, 37777 are open. I understand that 554 is for RTSP, 37777 is used for Dahua's protocol, and 80 is obviously for http. Not sure about 8086. (note: I actually ran this nmap after I completed the pairing process with my phone so not all of these ports may actually be available until after it connects to the wireless network)
  • My Android phone happens to be rooted so I was able to run an app called PCAPdroid during the setup process. I can see my phone (192.168.0.109) sending a bunch of packets to 192.168.0.108 on port 37777. I can also see one packet has a large payload with the text "AES-128" followed by a large base64 encoded string. I assume this is an encrypted copy of the network credentials. (I hope it's not just sending a key over the air??)
  • I cannot load in the browser. It tries to load but ends with no response. curl tells me "Empty reply from server"
  • I know this camera supports some subset of ONVIF and after looking for some URLs online, I found that a GET request to does actually respond although the XML says "Unknown Error"
  • I was able to get the RTSP stream to work in VLC
  • I was able to connect the camera to iSpy
  • I was able to connect the camera to Home Assistant (with mixed success, the streaming capabilities within the Home Assistant UI kinda suck)
  • I was able to connect the camera to the Dahua SmartPSS tool and removed the Imou watermark
  • I also downloaded the ConfigTool but I don't seem to see anything useful in it.

So I guess my longshot questions are:
  1. Does anyone know of a hidden endpoint URL for the configuration web page? The HTTP server is clearly running, it's just limiting what it responds to.
  2. Similar to above, is there an ONVIF method for setting the SSID and password? Could I invoke this endpoint while the camera is in AP mode?
  3. Is there a firmware upgrade/downgrade that might enable a configuration web page?
  4. Is there documentation available for the communications that are happening on port 37777? It seems like this is likely how the app is sending the network credentials to the camera. I have also noticed that the PTZ controls are much smoother in SmartPSS and the Imou Life app, so I'm wondering whether the Dahua protocol is just better than ONVIF here.


Thanks in advance for any info anyone can provide! FWIW I generally like this camera, but my concerns about whether I'll be able to initialize them without being tied to a mobile app are mainly just limiting whether I decide to buy more of them or look for other options.
 
  • Like
Reactions: mat200 and LeidenSpain
I think the http is just for the onvif soap api, you need to do a http post and not get to get anything useful.
You can try with curl or postman for example. Or better yet GitHub - FalkTannhaeuser/python-onvif-zeep: ONVIF Client Implementation in Python 2+3 (using https://github.com/mvantellingen/python-zeep instead of suds as SOAP client)

You should be able to control the ptz over onvif, at least it's possible with the ranger rc and rex cameras.

I've not investigated what's listening when the cameras are in AP mode but I guess some api (perhaps onvif?) That's listening for a command to set the network.
 
  • Like
Reactions: Tim Swift and mat200
palujust said:
Hello!

I recently purchased a WiFi IP camera and I'm trying to determine if it's possible to initialize it (i.e., connect to the wireless network) without relying on a mobile app. Perhaps I'm overly paranoid, but I'd like to avoid a situation where I cannot change the network SSID or password because the app has disappeared from the Play Store or my phone's version of Android is not supported, etc., etc. (For what it's worth I do find the app works reasonably well, especially compared to the Blink Camera systems I've used before).

information I have/have been able to determine so far:
  • Camera model: Imou Ranger SE 4MP (IPC-A43N)
  • Resetting the camera forces it to boot into AP/Ad-hoc mode and I can connect my phone/laptop to the access point. The camera gives itself the IP address of 192.168.0.108 at this point. (Note, conveniently this is the IP address that my camera gets after it does join my actual network)
  • nmap tells me that ports 80, 554, 8086, 37777 are open. I understand that 554 is for RTSP, 37777 is used for Dahua's protocol, and 80 is obviously for http. Not sure about 8086. (note: I actually ran this nmap after I completed the pairing process with my phone so not all of these ports may actually be available until after it connects to the wireless network)
  • My Android phone happens to be rooted so I was able to run an app called PCAPdroid during the setup process. I can see my phone (192.168.0.109) sending a bunch of packets to 192.168.0.108 on port 37777. I can also see one packet has a large payload with the text "AES-128" followed by a large base64 encoded string. I assume this is an encrypted copy of the network credentials. (I hope it's not just sending a key over the air??)
  • I cannot load in the browser. It tries to load but ends with no response. curl tells me "Empty reply from server"
  • I know this camera supports some subset of ONVIF and after looking for some URLs online, I found that a GET request to does actually respond although the XML says "Unknown Error"
  • I was able to get the RTSP stream to work in VLC
  • I was able to connect the camera to iSpy
  • I was able to connect the camera to Home Assistant (with mixed success, the streaming capabilities within the Home Assistant UI kinda suck)
  • I was able to connect the camera to the Dahua SmartPSS tool and removed the Imou watermark
  • I also downloaded the ConfigTool but I don't seem to see anything useful in it.

So I guess my longshot questions are:
  1. Does anyone know of a hidden endpoint URL for the configuration web page? The HTTP server is clearly running, it's just limiting what it responds to.
  2. Similar to above, is there an ONVIF method for setting the SSID and password? Could I invoke this endpoint while the camera is in AP mode?
  3. Is there a firmware upgrade/downgrade that might enable a configuration web page?
  4. Is there documentation available for the communications that are happening on port 37777? It seems like this is likely how the app is sending the network credentials to the camera. I have also noticed that the PTZ controls are much smoother in SmartPSS and the Imou Life app, so I'm wondering whether the Dahua protocol is just better than ONVIF here.


Thanks in advance for any info anyone can provide! FWIW I generally like this camera, but my concerns about whether I'll be able to initialize them without being tied to a mobile app are mainly just limiting whether I decide to buy more of them or look for other options.
Click to expand...
Hi,

Sorry for bringing up this topic after so long.
I've been trying to connect to the camera via RTSP with VLC for several days, but I can't.
What path did you use?
 
  • Like
Reactions: mat200
LeidenSpain said:
Hi,

Sorry for bringing up this topic after so long.
I've been trying to connect to the camera via RTSP with VLC for several days, but I can't.
What path did you use?
Click to expand...
Try this below: Of course, use 2 "/" after "rstp:", as forum software won't allow 2 to be displayed consecutively. Also, sub in your IP, username and password:

Code: 
rtsp:/username:password@192.168.0.108:554/cam/realmonitor?channel=1&subtype=0&unicast=true&proto=Onvif
 
  • Like
Reactions: mat200 and LeidenSpain
TonyR said:
Try this below: Of course, use 2 "/" after "rstp:", as forum software won't allow 2 to be displayed consecutively. Also, sub in your IP, username and password:

Code: 
rtsp:/username:password@192.168.0.108:554/cam/realmonitor?channel=1&subtype=0&unicast=true&proto=Onvif
Click to expand...
Thank you,

It's the one I've been using since the beginning (well, and then many different ones to try) but nothing. it does not work.
The password is surely correct because I have connected through SmartPSS without problems. and user admin

Code: 
Your input can't be opened:
VLC is unable to open the MRL 'rtsp:/admin:PASSWORD@192.168.XXX.XXX:554/cam/realmonitor?channel=1&subtype=0&unicast=true&proto=Onvif'. Check the log for details.
 
  • Like
Reactions: mat200
If the camera is truly ONVIF compliant then download, install and run ODM, log in, select "Live Video" in middle column and the RTSP URL should be revealed at lower right of screen.

Those are private IP's no need to redact. Is the camera and the PC on the same LAN, same subnet?
 
  • Like
Reactions: mat200 and LeidenSpain
TonyR said:
If the camera is truly ONVIF compliant then download, install and run ODM, log in, select "Live Video" in middle column and the RTSP URL should be revealed at lower right of screen.

Those are private IP's no need to redact. Is the camera and the PC on the same LAN, same subnet?
Click to expand...
OK,

I have managed to connect (it even shows me the camera preview), but the video keeps giving me an error.
1718488297123.png

Ah, the PTZ works
 
  • Like
Reactions: mat200
LeidenSpain said:
OK,

I have managed to connect (it even shows me the camera preview), but the video keeps giving me an error.
View attachment 196561

Ah, the PTZ works
Click to expand...

Try a port scan on the camera and see if you have the proper ports opened up.

update: Original Poster ( so anyone else should also check which ports are active )
"
  • nmap tells me that ports 80, 554, 8086, 37777 are open. I understand that 554 is for RTSP, 37777 is used for Dahua's protocol, and 80 is obviously for http. Not sure about 8086. (note: I actually ran this nmap after I completed the pairing process with my phone so not all of these ports may actually be available until after it connects to the wireless network)
"
 
Last edited:
  • Like
Reactions: LeidenSpain
mat200 said:
Try a port scan on the camera and see if you have the proper ports opened up.
Click to expand...

I used the command indicated in this post:

IMOU Ranger Pro - RTSP Problems [SOLVED]

Hello guys :) As already read, I own several IMOU Ranger Pro. I would like to watch them via RTSP stream. I know the Windows App works well, but I would like to embed the stream in OBS. I know the IP of the cameras but not more. In the app I log in with the IMOU account data. I have tried it...
ipcamtalk.com ipcamtalk.com

Code: 
nmap --script rtsp-url-brute -p 554 192.168.3.206
Starting Nmap 7.95 ( https://nmap.org ) at 2024-06-16 09:22 CEST
Nmap scan report for Camara-Comedor.lan (192.168.3.206)
Host is up (0.031s latency).

PORT    STATE SERVICE
554/tcp open  rtsp
| rtsp-url-brute:
|   errors:
|     rtsp:/Camara-Comedor.lan/
|     rtsp:/Camara-Comedor.lan/1/stream1
|     rtsp:/Camara-Comedor.lan/0
|     rtsp:/Camara-Comedor.lan/11
|     rtsp:/Camara-Comedor.lan/0/video1
|     rtsp:/Camara-Comedor.lan/1
|     rtsp:/Camara-Comedor.lan/1.AMP
|     rtsp:/Camara-Comedor.lan/1/1:1/main
|     rtsp:/Camara-Comedor.lan/1/cif
|_    rtsp:/Camara-Comedor.lan/12

Nmap done: 1 IP address (1 host up) scanned in 0.39 seconds
 
  • Like
Reactions: mat200
sorry, this is de nmap to all the ports

Code: 
nmap --script rtsp-url-brute 192.168.3.206
Starting Nmap 7.95 ( https://nmap.org ) at 2024-06-16 09:37 CEST
Nmap scan report for Camara-Comedor.lan (192.168.3.206)
Host is up (0.020s latency).
Not shown: 996 closed tcp ports (conn-refused)
PORT     STATE SERVICE
80/tcp   open  http
443/tcp  open  https
554/tcp  open  rtsp
| rtsp-url-brute:
|   errors:
|     rtsp:/Camara-Comedor.lan/
|     rtsp:/Camara-Comedor.lan/0
|     rtsp:/Camara-Comedor.lan/12
|     rtsp:/Camara-Comedor.lan/0/video1
|     rtsp:/Camara-Comedor.lan/1/stream1
|     rtsp:/Camara-Comedor.lan/1
|     rtsp:/Camara-Comedor.lan/1.AMP
|     rtsp:/Camara-Comedor.lan/1/1:1/main
|     rtsp:/Camara-Comedor.lan/1/cif
|_    rtsp:/Camara-Comedor.lan/11
8086/tcp open  d-s-n

Nmap done: 1 IP address (1 host up) scanned in 0.60 seconds
 
  • Like
Reactions: mat200
Have you ever performed a hard reset of the camera?
 
  • Like
Reactions: mat200
LeidenSpain said:
The same :idk:
Click to expand...


"I've been trying to connect to the camera via RTSP with VLC for several days, but I can't.
What path did you use? " - LeidenSpain .. or Leidern's Pain today .. getting VLC on this camera

It's a good question,

did you also check this thread ? :

IMOU Ranger Pro - RTSP Problems [SOLVED]

Hello guys :) As already read, I own several IMOU Ranger Pro. I would like to watch them via RTSP stream. I know the Windows App works well, but I would like to embed the stream in OBS. I know the IP of the cameras but not more. In the app I log in with the IMOU account data. I have tried it...
ipcamtalk.com ipcamtalk.com

Seems like you're super close ..


Fletty said:
OK i found the solution! The passwort is in fontsize 1 at the bottom of the camera. This info i found in the internet... The username ist "admin". The working address is:

rtsp:/admin:MYPASSWORD@192.168.0.105/cam/realmonitor?channel=1&subtype=0

Btw. i got help from: Connect to Imou cameras
Click to expand...

Perhaps wireshare or similar to see if video packets are being sent ??

Perhaps some check box needs to be clicked on the camera's admin page ??
 
mat200 said:
"I've been trying to connect to the camera via RTSP with VLC for several days, but I can't.
What path did you use? " - LeidenSpain .. or Leidern's Pain today .. getting VLC on this camera

It's a good question,

did you also check this thread ? :

IMOU Ranger Pro - RTSP Problems [SOLVED]

Hello guys :) As already read, I own several IMOU Ranger Pro. I would like to watch them via RTSP stream. I know the Windows App works well, but I would like to embed the stream in OBS. I know the IP of the cameras but not more. In the app I log in with the IMOU account data. I have tried it...
ipcamtalk.com ipcamtalk.com

Seems like you're super close ..




Perhaps wireshare or similar to see if video packets are being sent ??

Perhaps some check box needs to be clicked on the camera's admin page ??
Click to expand...
Yes, I have searched for a lot of information in many places:

IMOU Ranger Pro - RTSP Problems [SOLVED]

Hello guys :) As already read, I own several IMOU Ranger Pro. I would like to watch them via RTSP stream. I know the Windows App works well, but I would like to embed the stream in OBS. I know the IP of the cameras but not more. In the app I log in with the IMOU account data. I have tried it...
ipcamtalk.com ipcamtalk.com

Blue Iris + Imou Ranger 2- Setting up RTSP Sub stream.

Hi there, Just recently I installed an IMOU Ranger 2 at my office. Using the following RTSP URL: Note = rtsp:/ meant to have two "/" forward lashes, but somehow the BI forum automatically deprecate 1 forward lash. 1) How to create a sub RSTP stream using the format...
ipcamtalk.com ipcamtalk.com

Imou Ranger 2: Access via ONVIF

I have a Hikvision DS-7608NXI-K2/8P NVR and I want to add it in the admin interface so that I can record and have the camera in the same app.
ipcamtalk.com ipcamtalk.com

I am doing all the tests with the admin user and the sticker password,
just like I do with my other IMOUs (Range 2 4MP-B and Bullet 2E).
Only have problems with the Range SE 4MP
 
  • Like
Reactions: mat200
LeidenSpain said:
Yes, I have searched for a lot of information in many places:

IMOU Ranger Pro - RTSP Problems [SOLVED]

Hello guys :) As already read, I own several IMOU Ranger Pro. I would like to watch them via RTSP stream. I know the Windows App works well, but I would like to embed the stream in OBS. I know the IP of the cameras but not more. In the app I log in with the IMOU account data. I have tried it...
ipcamtalk.com ipcamtalk.com

Blue Iris + Imou Ranger 2- Setting up RTSP Sub stream.

Hi there, Just recently I installed an IMOU Ranger 2 at my office. Using the following RTSP URL: Note = rtsp:/ meant to have two "/" forward lashes, but somehow the BI forum automatically deprecate 1 forward lash. 1) How to create a sub RSTP stream using the format...
ipcamtalk.com ipcamtalk.com

Imou Ranger 2: Access via ONVIF

I have a Hikvision DS-7608NXI-K2/8P NVR and I want to add it in the admin interface so that I can record and have the camera in the same app.
ipcamtalk.com ipcamtalk.com

I am doing all the tests with the admin user and the sticker password,
just like I do with my other IMOUs (Range 2 4MP-B and Bullet 2E).
Only have problems with the Range SE 4MP
Click to expand...

Thanks @LeidenSpain

I am looking forward to seeing what the solution is .. you have me scratching my head now on this one.
 
mat200 said:
Thanks @LeidenSpain

I am looking forward to seeing what the solution is .. you have me scratching my head now on this one.
Click to expand...

I don't know if it was due to the reboot, but using this method now works (I swear I tried it before)
rtsp:/admin:PASSWORD@192.168.XXX.XXX:554/cam/realmonitor?channel=1&subtype=0

Thank you very much for all the help and patience

P.S.: clearly the information from Connect to Imou IP Cameras is incorrect for this camera
 
  • Like
Reactions: mat200
Sorry, the problema was now on VLC (in the last conections links, it's forgot the last 0).

Then, the solution: to use the RTSP the url is this:
rtsp:/admin:password@192.168.xxx.xxx:554/cam/realmonitor?channel=1&subtype=0
 
  • Like
Reactions: mat200 and TonyR
So the URL below works:
Code: 
rtsp:/username:password@192.168.XXX.XXX:554/cam/realmonitor?channel=1&subtype=0

Since the hard reset I'm curious to know how ODM works.:idk:
 
  • Like
Reactions: mat200
You must log in or register to reply here.
Top Bottom