That's what's needed for the cgi protocol. For RPC, you can view the http requests in Chrome. Some people have started work reverse engineering the RPC protocol:
I bit over my head at the moment. I noticed that once you click on the camera in the webUI, NVR will keep this port open (18+ hours for now) but only for that IP address. My goal is to figure out a way to foul it via curl/wget one day.