Help reverting or fixing a 5.3.0 firmware update

[tastle]

First of all, I apologize if there is an obvious thread in here that explains what I should do. I'm a novice with this particular system.

I made a general post here, and got some good directions to come to this subforum. I've read through a lot of the posts here and tried some things, but I must be missing something.

To recant,

I bought a couple of Hikvision DS-2CD2732F-IS cameras. The firmware was V5.2.5 build 141201.

I got them all set up, everything was going great. Then I decided to update the firmware before installing them. I grabbed the latest firmware from the Hikvision site (IPC_R0_EN_STD_5.3.0_150513) and uploaded it to one of the cameras. Now it's not responsive. I see it has "light" but it doesn't have an IP address available anymore. I contacted the seller (bought direct from China on Ebay, high rep.) for some assistance.

At the moment:

• I have the camera connected directly to my PC and miraculously found a 12V DC adapter in my house.
• I have my IPv4 set to 192.0.0.128.
• I downloaded a 5.2.5 firmware from the mtd Brick Recovery Guide thread.

What I've tried:

• I tried telneting into the system (192.0.0.64), but no dice.
• I tried running tftpserv.exe with the 5.2.5 firmware in the same directory as the exe. But I just says it's running on 192.0.0.128 (my PCs IP).
• For a lark, I tried FTPing into it. No dice.

The information is scattered about and later I read that I don't have to worry about mtd5/6 unless I've messed with them (?). I also believe I read that you can't connect using telnet if you've tried to upgrade to 5.3.0 (ssh required).

I'm not sure what to do. Can someone explain the overall steps I should be following to fix my stupid mistake.

Thanks in advance,

Tim

 

[alastairstevenson]

Don't connect the camera direct to the PC, connect each to their own port on your router or switch. During normal startup, the camera enables and disables the Ethernet port, it can take a second or so for the PC to react to that.
Try the following:
Connect the camera and the PC to ports on your router / switch, with the camera powered off.
Start the TFTP server, check the IP address shows as 192.0.0.128 and the window title says 'Hikvision TFTP server'
At a PC command prompt, type the command 'ping -t 192.0.0.64'
Power on the camera and check the TFTP status and the ping response.

Normal activity would be 2 or 3 ping responses a few seconds after power on, with some status in the TFTP server something like 'client test TFTP server' 'client connect TFTP server' 'transmitting ...'
And if you are very lucky, eventually 'upgrade successful'.
The process can take several minutes.

If the camera does not upgrade successfully, and is in a boot loop, the 2 or 3 ping responses will repeat each 10 or 20 seconds or so.
If the firmware upgrade is rejected, and the camera is not in a boot loop, the ping responses are usually continuous, and on firmware earlier than 5.3.0 would allow telnet access at this point.

 

[tastle]

Okay, here's what I done so far:

1. Connected my device to a router (my switch is PoE, my router isn't). I've left the power off. (i.e., haven't plugged in the power adapter)
2. I've set my Ethernet Adapter IPv4 to 192.0.0.128, Gateway 255.255.255.0.
3. I've physically connected my laptop to the same router that the camera is connected to.
4. I've started the TFTP Server.
5. I ran the ping command.
6. I then plugged in the camera, roughly at the same time it said host unreachable below.

Pinging 192.0.0.64 with 32 bytes of data:
Reply from 192.0.0.128: Destination host unreachable.
Request timed out.
Request timed out.
Request timed out.
Reply from 192.0.0.128: Destination host unreachable.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.

And that's where I am. All I'm seeing is "Request timed out."

 

[whoslooking]

Are you using Hikvisions tftp tool?

 

[tastle]

It says it is. I downloaded it from the European download link after some extensive searching.

 

[tastle]

If I don't hear anything back, I think my next step for tonight would be to follow the TFTP PDF I found. It says to do things like, "Disable your Windows Firewall" (I don't think this is an issue since it prompts on start and I allow it to communicate) and "disable your wireless connection", which I didn't do.

http://www.hikvision.com/UploadFile/File/201433116851896.pdf

 

[whoslooking]

make sure you turn off your wifi, it does not work correctly all the time if you don't. Make sure to use a switch or router for the interconnection between your PC and Camera don't use cross over cables either. and it's best to use a power supply rather than a POE device to do the tftp u.pdate

 

[alastairstevenson]

On the face of it - assuming your 2732 behaves like the other 2-series that we may be more familiar with - it looks like your camera's bootloader isn't executing. That's the part of the startup flash that enables the Ethernet interface with the 192.0.0.64 IP address and looks for the TFTP server on 192.0.0.128 and tests it for a Hikvision response if it finds it.
However - not that I've seen an example yet - as I managed to completely wipe the flash on the 2332 I was using to play with - I'm wondering when or if in the firmware upgrade path the camera may change to using the 192.168.1.64 default address that's mentioned in the 5.3.0 release notes.
That would certainly defeat attempts to use the old set of addresses for a TFTP recovery.
An easy test (but a long shot ...)would be to change your PC IP address to something in the 192.168.1.x range and ping 192.168.1.64 during camera power-on.

Have you used / are familiar with any network capture tools such as wireshark?
That would show if there is still any network traffic emanating from the camera at power on, and might provide some clues.
As would a serial console connection to the camera's RS232-TTL connector.

 

[torbjornjoh]

It works fine if you flash the 5.3.0 chinese, but I can't get english to work.. Same problem here, 3 ping replies, then nothing for a while, but works fine with chinese rom

 

[tastle]

Have you used / are familiar with any network capture tools such as wireshark?
That would show if there is still any network traffic emanating from the camera at power on, and might provide some clues.
As would a serial console connection to the camera's RS232-TTL connector.

I'm familiar with Wireshark. I'll see what I can do with your recommendation (pinging). I tried following the steps exactly in the PDF, but had zero success.

 

[tastle]

Okay, I'm seeing something, perhaps some kind of life.

• I switched my PC to 192.168.1.111
• I enabled Wireshark

Edit: Removed the ping because in my tired state, I realized I made a typo on the IP. :culpability:

Wireshark started showing this when I powered up the camera (first line is context, 2nd line is important):

8    12.000140000    AsustekC_94:e0:b3    Spanning-tree-(for-bridges)_00    STP    64    Conf. Root = 32768/0/c8:60:00:94:e0:b3  Cost = 0  Port = 0x8001 [ETHERNET FRAME CHECK SEQUENCE INCORRECT]
9    12.472658000    192.168.1.1    239.255.255.250    SSDP    305    NOTIFY * HTTP/1.1

8 SSDP messages are observed, which I believe is the protocol used by this camera to help it be found. Then I see this:

24    21.616270000    Hangzhou_2b:6c:02    Broadcast    ARP    60    Who has 192.0.0.128?  Tell 192.0.0.64

Which has a funny info message.

There is some more stuff, and more SSDPs again.

Any tips on what I should narrow on, or does that provide enough of a hint?

 

[tastle]

If I go back to 192.0.0.128, plug in the device, I see the following in Wireshark:

95    40.996150000    Hangzhou_2b:6c:02    Broadcast    ARP    60    Who has 192.0.0.128?  Tell 192.0.0.64
96    40.996226000    Dell_6d:54:22    Hangzhou_2b:6c:02    ARP    42    192.0.0.128 is at 5c:26:0a:6d:54:22

I filtered a session using where the ethernet source or destination was the camera:

No.     Time           Source                Destination           Protocol Length Info
     95 40.996150000   Hangzhou_2b:6c:02     Broadcast             ARP      60     Who has 192.0.0.128?  Tell 192.0.0.64

Frame 95: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No.     Time           Source                Destination           Protocol Length Info
     96 40.996226000   Dell_6d:54:22         Hangzhou_2b:6c:02     ARP      42     192.0.0.128 is at 5c:26:0a:6d:54:22

Frame 96: 42 bytes on wire (336 bits), 42 bytes captured (336 bits) on interface 0
Ethernet II, Src: Dell_6d:54:22 (5c:26:0a:6d:54:22), Dst: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02)
Address Resolution Protocol (reply)

No.     Time           Source                Destination           Protocol Length Info
     97 40.996606000   192.0.0.64            192.0.0.128           UDP      62     Source port: 9979  Destination port: 9978

Frame 97: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: Dell_6d:54:22 (5c:26:0a:6d:54:22)
Internet Protocol Version 4, Src: 192.0.0.64 (192.0.0.64), Dst: 192.0.0.128 (192.0.0.128)
User Datagram Protocol, Src Port: 9979 (9979), Dst Port: 9978 (9978)
Data (20 bytes)

0000  53 57 4b 48 00 00 00 00 00 00 00 00 00 00 00 00   SWKH............
0010  00 00 00 00                                       ....

No.     Time           Source                Destination           Protocol Length Info
    103 49.232741000   ::                    ff02::16              ICMPv6   90     Multicast Listener Report Message v2

Frame 103: 90 bytes on wire (720 bits), 90 bytes captured (720 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_16 (33:33:00:00:00:16)
Internet Protocol Version 6, Src: :: (::), Dst: ff02::16 (ff02::16)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    104 49.852840000   ::                    ff02::1:ff2b:6c02     ICMPv6   78     Neighbor Solicitation for fe80::c62f:90ff:fe2b:6c02

Frame 104: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_ff:2b:6c:02 (33:33:ff:2b:6c:02)
Internet Protocol Version 6, Src: :: (::), Dst: ff02::1:ff2b:6c02 (ff02::1:ff2b:6c02)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    105 50.852900000   fe80::c62f:90ff:fe2b:6c02 ff02::2               ICMPv6   70     Router Solicitation from c4:2f:90:2b:6c:02

Frame 105: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_02 (33:33:00:00:00:02)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::2 (ff02::2)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    108 54.862758000   fe80::c62f:90ff:fe2b:6c02 ff02::2               ICMPv6   70     Router Solicitation from c4:2f:90:2b:6c:02

Frame 108: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_02 (33:33:00:00:00:02)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::2 (ff02::2)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    111 58.372708000   fe80::c62f:90ff:fe2b:6c02 ff02::16              ICMPv6   90     Multicast Listener Report Message v2

Frame 111: 90 bytes on wire (720 bits), 90 bytes captured (720 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_16 (33:33:00:00:00:16)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::16 (ff02::16)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    112 58.872738000   fe80::c62f:90ff:fe2b:6c02 ff02::2               ICMPv6   70     Router Solicitation from c4:2f:90:2b:6c:02

Frame 112: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_02 (33:33:00:00:00:02)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::2 (ff02::2)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    164 92.009967000   Hangzhou_2b:6c:02     Broadcast             ARP      60     Who has 192.0.0.128?  Tell 192.0.0.64

Frame 164: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No.     Time           Source                Destination           Protocol Length Info
    165 92.010044000   Dell_6d:54:22         Hangzhou_2b:6c:02     ARP      42     192.0.0.128 is at 5c:26:0a:6d:54:22

Frame 165: 42 bytes on wire (336 bits), 42 bytes captured (336 bits) on interface 0
Ethernet II, Src: Dell_6d:54:22 (5c:26:0a:6d:54:22), Dst: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02)
Address Resolution Protocol (reply)

No.     Time           Source                Destination           Protocol Length Info
    166 92.010520000   192.0.0.64            192.0.0.128           UDP      62     Source port: 9979  Destination port: 9978

Frame 166: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: Dell_6d:54:22 (5c:26:0a:6d:54:22)
Internet Protocol Version 4, Src: 192.0.0.64 (192.0.0.64), Dst: 192.0.0.128 (192.0.0.128)
User Datagram Protocol, Src Port: 9979 (9979), Dst Port: 9978 (9978)
Data (20 bytes)

0000  53 57 4b 48 00 00 00 00 00 00 00 00 00 00 00 00   SWKH............
0010  00 00 00 00                                       ....

No.     Time           Source                Destination           Protocol Length Info
    171 100.246071000  ::                    ff02::16              ICMPv6   90     Multicast Listener Report Message v2

Frame 171: 90 bytes on wire (720 bits), 90 bytes captured (720 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_16 (33:33:00:00:00:16)
Internet Protocol Version 6, Src: :: (::), Dst: ff02::16 (ff02::16)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    172 100.856035000  ::                    ff02::1:ff2b:6c02     ICMPv6   78     Neighbor Solicitation for fe80::c62f:90ff:fe2b:6c02

Frame 172: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_ff:2b:6c:02 (33:33:ff:2b:6c:02)
Internet Protocol Version 6, Src: :: (::), Dst: ff02::1:ff2b:6c02 (ff02::1:ff2b:6c02)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    174 101.855993000  fe80::c62f:90ff:fe2b:6c02 ff02::2               ICMPv6   70     Router Solicitation from c4:2f:90:2b:6c:02

Frame 174: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_02 (33:33:00:00:00:02)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::2 (ff02::2)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    177 105.865995000  fe80::c62f:90ff:fe2b:6c02 ff02::2               ICMPv6   70     Router Solicitation from c4:2f:90:2b:6c:02

Frame 177: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_02 (33:33:00:00:00:02)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::2 (ff02::2)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    179 108.225869000  fe80::c62f:90ff:fe2b:6c02 ff02::16              ICMPv6   90     Multicast Listener Report Message v2

Frame 179: 90 bytes on wire (720 bits), 90 bytes captured (720 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_16 (33:33:00:00:00:16)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::16 (ff02::16)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    182 109.874955000  fe80::c62f:90ff:fe2b:6c02 ff02::2               ICMPv6   70     Router Solicitation from c4:2f:90:2b:6c:02

Frame 182: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_02 (33:33:00:00:00:02)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::2 (ff02::2)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    200 143.159186000  Hangzhou_2b:6c:02     Broadcast             ARP      60     Who has 192.0.0.128?  Tell 192.0.0.64

Frame 200: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No.     Time           Source                Destination           Protocol Length Info
    201 143.159218000  Dell_6d:54:22         Hangzhou_2b:6c:02     ARP      42     192.0.0.128 is at 5c:26:0a:6d:54:22

Frame 201: 42 bytes on wire (336 bits), 42 bytes captured (336 bits) on interface 0
Ethernet II, Src: Dell_6d:54:22 (5c:26:0a:6d:54:22), Dst: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02)
Address Resolution Protocol (reply)

No.     Time           Source                Destination           Protocol Length Info
    202 143.159404000  192.0.0.64            192.0.0.128           UDP      62     Source port: 9979  Destination port: 9978

Frame 202: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: Dell_6d:54:22 (5c:26:0a:6d:54:22)
Internet Protocol Version 4, Src: 192.0.0.64 (192.0.0.64), Dst: 192.0.0.128 (192.0.0.128)
User Datagram Protocol, Src Port: 9979 (9979), Dst Port: 9978 (9978)
Data (20 bytes)

0000  53 57 4b 48 00 00 00 00 00 00 00 00 00 00 00 00   SWKH............
0010  00 00 00 00                                       ....

No.     Time           Source                Destination           Protocol Length Info
    230 151.375300000  ::                    ff02::16              ICMPv6   90     Multicast Listener Report Message v2

Frame 230: 90 bytes on wire (720 bits), 90 bytes captured (720 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_16 (33:33:00:00:00:16)
Internet Protocol Version 6, Src: :: (::), Dst: ff02::16 (ff02::16)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    231 151.805304000  ::                    ff02::1:ff2b:6c02     ICMPv6   78     Neighbor Solicitation for fe80::c62f:90ff:fe2b:6c02

Frame 231: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_ff:2b:6c:02 (33:33:ff:2b:6c:02)
Internet Protocol Version 6, Src: :: (::), Dst: ff02::1:ff2b:6c02 (ff02::1:ff2b:6c02)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    232 152.805340000  fe80::c62f:90ff:fe2b:6c02 ff02::2               ICMPv6   70     Router Solicitation from c4:2f:90:2b:6c:02

Frame 232: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_02 (33:33:00:00:00:02)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::2 (ff02::2)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    235 156.815207000  fe80::c62f:90ff:fe2b:6c02 ff02::2               ICMPv6   70     Router Solicitation from c4:2f:90:2b:6c:02

Frame 235: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_02 (33:33:00:00:00:02)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::2 (ff02::2)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    238 160.825059000  fe80::c62f:90ff:fe2b:6c02 ff02::2               ICMPv6   70     Router Solicitation from c4:2f:90:2b:6c:02

Frame 238: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_02 (33:33:00:00:00:02)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::2 (ff02::2)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    240 161.275152000  fe80::c62f:90ff:fe2b:6c02 ff02::16              ICMPv6   90     Multicast Listener Report Message v2

Frame 240: 90 bytes on wire (720 bits), 90 bytes captured (720 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_16 (33:33:00:00:00:16)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::16 (ff02::16)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    258 194.120339000  Hangzhou_2b:6c:02     Broadcast             ARP      60     Who has 192.0.0.128?  Tell 192.0.0.64

Frame 258: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (request)

No.     Time           Source                Destination           Protocol Length Info
    259 194.120411000  Dell_6d:54:22         Hangzhou_2b:6c:02     ARP      42     192.0.0.128 is at 5c:26:0a:6d:54:22

Frame 259: 42 bytes on wire (336 bits), 42 bytes captured (336 bits) on interface 0
Ethernet II, Src: Dell_6d:54:22 (5c:26:0a:6d:54:22), Dst: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02)
Address Resolution Protocol (reply)

No.     Time           Source                Destination           Protocol Length Info
    260 194.120736000  192.0.0.64            192.0.0.128           UDP      62     Source port: 9979  Destination port: 9978

Frame 260: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: Dell_6d:54:22 (5c:26:0a:6d:54:22)
Internet Protocol Version 4, Src: 192.0.0.64 (192.0.0.64), Dst: 192.0.0.128 (192.0.0.128)
User Datagram Protocol, Src Port: 9979 (9979), Dst Port: 9978 (9978)
Data (20 bytes)

0000  53 57 4b 48 00 00 00 00 00 00 00 00 00 00 00 00   SWKH............
0010  00 00 00 00                                       ....

No.     Time           Source                Destination           Protocol Length Info
    265 202.346387000  ::                    ff02::16              ICMPv6   90     Multicast Listener Report Message v2

Frame 265: 90 bytes on wire (720 bits), 90 bytes captured (720 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_16 (33:33:00:00:00:16)
Internet Protocol Version 6, Src: :: (::), Dst: ff02::16 (ff02::16)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    266 202.716290000  ::                    ff02::1:ff2b:6c02     ICMPv6   78     Neighbor Solicitation for fe80::c62f:90ff:fe2b:6c02

Frame 266: 78 bytes on wire (624 bits), 78 bytes captured (624 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_ff:2b:6c:02 (33:33:ff:2b:6c:02)
Internet Protocol Version 6, Src: :: (::), Dst: ff02::1:ff2b:6c02 (ff02::1:ff2b:6c02)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    268 203.716365000  fe80::c62f:90ff:fe2b:6c02 ff02::2               ICMPv6   70     Router Solicitation from c4:2f:90:2b:6c:02

Frame 268: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_02 (33:33:00:00:00:02)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::2 (ff02::2)
Internet Control Message Protocol v6

No.     Time           Source                Destination           Protocol Length Info
    288 207.726274000  fe80::c62f:90ff:fe2b:6c02 ff02::2               ICMPv6   70     Router Solicitation from c4:2f:90:2b:6c:02

Frame 288: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Hangzhou_2b:6c:02 (c4:2f:90:2b:6c:02), Dst: IPv6mcast_02 (33:33:00:00:00:02)
Internet Protocol Version 6, Src: fe80::c62f:90ff:fe2b:6c02 (fe80::c62f:90ff:fe2b:6c02), Dst: ff02::2 (ff02::2)
Internet Control Message Protocol v6

but I'm not getting much out of this.

Edit: Actually as I sit and watch wireshark log communication involving the camera, it looks like it's "looping". I also noticed the lights around the camera are on for a while, then they go off for a while, repeating.

Exported as CVS, since it looks prettier:

"No.","Time","Source","Destination","Protocol","Length","Info"
"4931","2166.325284000","Hangzhou_2b:6c:02","Broadcast","ARP","60","Who has 192.0.0.128?  Tell 192.0.0.64"
"4932","2166.325349000","Dell_6d:54:22","Hangzhou_2b:6c:02","ARP","42","192.0.0.128 is at 5c:26:0a:6d:54:22"
"4933","2166.325740000","192.0.0.64","192.0.0.128","UDP","62","Source port: 9979  Destination port: 9978"
"4958","2174.571907000","::","ff02::16","ICMPv6","90","Multicast Listener Report Message v2"
"4959","2175.111698000","::","ff02::1:ff2b:6c02","ICMPv6","78","Neighbor Solicitation for fe80::c62f:90ff:fe2b:6c02"
"4962","2176.111857000","fe80::c62f:90ff:fe2b:6c02","ff02::2","ICMPv6","70","Router Solicitation from c4:2f:90:2b:6c:02"
"4973","2180.121715000","fe80::c62f:90ff:fe2b:6c02","ff02::2","ICMPv6","70","Router Solicitation from c4:2f:90:2b:6c:02"
"4974","2180.521873000","fe80::c62f:90ff:fe2b:6c02","ff02::16","ICMPv6","90","Multicast Listener Report Message v2"
"4983","2184.131799000","fe80::c62f:90ff:fe2b:6c02","ff02::2","ICMPv6","70","Router Solicitation from c4:2f:90:2b:6c:02"
"5038","2217.435093000","Hangzhou_2b:6c:02","Broadcast","ARP","60","Who has 192.0.0.128?  Tell 192.0.0.64"
"5039","2217.435173000","Dell_6d:54:22","Hangzhou_2b:6c:02","ARP","42","192.0.0.128 is at 5c:26:0a:6d:54:22"
"5040","2217.435575000","192.0.0.64","192.0.0.128","UDP","62","Source port: 9979  Destination port: 9978"
"5056","2225.681264000","::","ff02::16","ICMPv6","90","Multicast Listener Report Message v2"
"5059","2226.521287000","::","ff02::1:ff2b:6c02","ICMPv6","78","Neighbor Solicitation for fe80::c62f:90ff:fe2b:6c02"
"5060","2227.521384000","fe80::c62f:90ff:fe2b:6c02","ff02::2","ICMPv6","70","Router Solicitation from c4:2f:90:2b:6c:02"
"5070","2230.241238000","fe80::c62f:90ff:fe2b:6c02","ff02::16","ICMPv6","90","Multicast Listener Report Message v2"
"5077","2231.530482000","fe80::c62f:90ff:fe2b:6c02","ff02::2","ICMPv6","70","Router Solicitation from c4:2f:90:2b:6c:02"
"5087","2235.540535000","fe80::c62f:90ff:fe2b:6c02","ff02::2","ICMPv6","70","Router Solicitation from c4:2f:90:2b:6c:02"
"5147","2268.414140000","Hangzhou_2b:6c:02","Broadcast","ARP","60","Who has 192.0.0.128?  Tell 192.0.0.64"
"5148","2268.414216000","Dell_6d:54:22","Hangzhou_2b:6c:02","ARP","42","192.0.0.128 is at 5c:26:0a:6d:54:22"
"5149","2268.414680000","192.0.0.64","192.0.0.128","UDP","62","Source port: 9979  Destination port: 9978"
"5170","2276.660319000","::","ff02::16","ICMPv6","90","Multicast Listener Report Message v2"
"5171","2277.420251000","::","ff02::1:ff2b:6c02","ICMPv6","78","Neighbor Solicitation for fe80::c62f:90ff:fe2b:6c02"
"5174","2278.420340000","fe80::c62f:90ff:fe2b:6c02","ff02::2","ICMPv6","70","Router Solicitation from c4:2f:90:2b:6c:02"
"5176","2280.130337000","fe80::c62f:90ff:fe2b:6c02","ff02::16","ICMPv6","90","Multicast Listener Report Message v2"
"5187","2282.430093000","fe80::c62f:90ff:fe2b:6c02","ff02::2","ICMPv6","70","Router Solicitation from c4:2f:90:2b:6c:02"
"5192","2286.440268000","fe80::c62f:90ff:fe2b:6c02","ff02::2","ICMPv6","70","Router Solicitation from c4:2f:90:2b:6c:02"

 

[alastairstevenson]

Good captures, well done.
What we see in frames 97, 166 etc is the normal bootup activity of the camera on 192.0.0.64 'testing' the TFTP server at 192.0.0.128 with the UDP packet holding the Hikvision 'magic number' of 'SWKH'.
That's good, and that's normal.
What we don't see though, is your TFTP server acknowledging the probe from the camera, with a response including the same magic number, so it goes round the loop again and repeats.
I think, though I don't recall for sure, that the TFTP server gives no response if there is not a digicap.dav file in its directory.

So the focus is on the TFTP server.
It must be the Hikvision-specific version that says 'Hikvision TFTP server' in the title bar.
And it must not be blocked by the PC firewall.
And the digicap.dav file must be in the same folder as the TFTP server executable.

A download of the right tool can be had in the @whoslooking interesting and useful post here: http://www.ipcamtalk.com/showthread.php/4036-Custom-Firmware-Downgrader-5-3-0-Chinese-to-5-2-5-English

 

[tastle]

Hmmm. I downloaded the TFTP from Hikvision. The one you shared seems to be identical to the one I have (except log, pdf, txt instructions). I got it from here.

I had followed the instructions in the PDF and this is my layout:

And here you can see my firewall settings for my private network connections have been disabled:

Did I miss something? I have my computer's WIFI disconnected too. I'll try using the bundle you linked to later tonight, even though they look like binary equivalents. The .dav size is different.

The dav size is different from what I found verses what you gave me. Does it matter? I don't want to accidentally use the wrong one and make things worse. By the way, the seller is trying to send me the firmware that they had used, which is nice. But unfortunately, either they forgot to attach it or something pulled it out of the email before it arrived. Is it possible to dump the firmware from a working camera to use it as part of the restore process for the one I "screwed up"? Or is the one in the link bundle the one I should use?

 

[alastairstevenson]

Your setup looks OK - though you could also turn Windows firewall fully off for guest/public in case the traffic is being mistaken for not originating from a private network. You have changed the IP address away from your regular private network. Usually the first instance of such a block would generate a prompt.
You can check the result of any exception under Windows Firewall | Advanced settings | Inbound rules and see what's in for tftpserv.exe in the location that it is running from.

Presumably both the camera and PC are wired to ports on the same switch or router. But communication seems OK because the PC responds to the ARP request and the camera sends the UDP packet to the correct IP address and port.
But the TFTP server stays quiet.
Do you have another PC to try this with?
The digicap.dav size varies amongst firmware versions and other things such as language support.

 

[tastle]

Update:

1. I disabled both parts of the firewall, and even shut down the Windows Firewall Service.
2. The seller provided me with a copy of the firmware they used. It's the same size (exactly to the same byte), but differencing using WinMerge shows that they binaries contain different content. (So which should I use?)
3. My PC's network adapter IPv4 is set to 192.0.0.168, subnet 255.255.255.0
4. I disabled my WiFi
5. Started the TFTP (new one, which was the same as my previous)
6. Powered on the camera by plugging in the adapter.
7. Watched wireshark annnd...

I don't see anything different. It's behaving the same.

I don't have another computer to try this on at the moment. My other one is Debian, and these are windows tools.

What am I missing?

 

[whoslooking]

If you have not tried this, copy the tftp to the root of your c: drive and run it from there, I still sometimes have issues running correctly from other locations.

 

[alastairstevenson]

Well, I'm puzzled. What you've described should work. But clearly it doesn't.

 

[whoslooking]

The only thing left could be the tftp program maybe corrupt, delete it and download another copy.

 

[tastle]

If you have not tried this, copy the tftp to the root of your c: drive and run it from there, I still sometimes have issues running correctly from other locations.

I'm running it from C:\TFTP-Auto-Update\ if that's what you mean? Or do you really mean put it on the C:\ root?