LaView cameras aren't trying TFTP

[ExplodingLemur]

I have some LaView LV-PBK80804C cameras running firmware V5.5.3 build 171121 that I think are Hikvision DS-2CD2085FWD-I (see this thread). I've grabbed several Hikvision G1 firmware images and have been trying to get them to load via this Python script but the cameras aren't attempting to reach out to a Hikvision server during boot. I'm seeing zero ARP requests for 192.0.0.128, 192.168.1.128, or anything at all actually until well after the boot process is underway. First it sends out some IPv6 router solicitations, then DHCP requests, then it starts spewing uPnP and multicast advertisements. The only ARP requests I see at that point are for link-local address autoconfiguration (to make sure it hasn't grabbed an IP that something else is already using).
There is no option in the camera web UI to enable SSH, Telnet, or an FTP server. I have some of these installed already so I'm hoping to find a method that allows me to flash these over to Hikvision firmware without requiring serial console access. They won't accept any of the firmware images via the web interface, they all result in a firmware mismatch error.
I've attached a zipped PCAP here from camera power-on. The camera and computer are connected to an isolated switch, no other devices. Computer firewall is disabled.
Has anyone seen this behavior from a LaView/Hikvision camera? Any idea how to get it to do its TFTP recovery thing?
Thanks!

 

[bsocko]

If you still need help with this, I can help you out. I have several LV-PBK80804C running the latest Hik G1 firmware.

 

[ExplodingLemur]

If you still need help with this, I can help you out. I have several LV-PBK80804C running the latest Hik G1 firmware.

That would be great, I haven't been able to figure it out yet.

 

[bsocko]

The first thing I found out about TFTPing to any Hik camera is this. If you have the cameras plugged into a poe switch and the pc is on a smart switch it filters the initial WHO 192.0.0.128 ARP request. I have only gotten it to work by plugging a computer directly into the same poe switch as the camera.

Its been a while since I did these cameras but I remember some of the La View cameras look for the TFP server at 192.168.100.128 or something weird like that, not the standard 192.0.0.128. You need to use Wireshark to watch for the camera initial WHO request when it boots. That is the TFTP server address you will use.

If its requesting the normal 192.0.0.128 you can use the tftp updater found on this forum. If its not, you are going to have to use Scott Lambs Python 2.7 script and change the TFTP server ip.

Plug your PC and only one camera directly into the POE switch and monitor it with Wireshark and let me know what the IP it is looking for the TFTP server at and we will go from there.

 

[ExplodingLemur]

I have the camera and a PC plugged into the same isolated unmanaged switch. I'm using a PoE injector to power the camera. As I described in the original post here, the camera is making zero attempts to seek out a TFTP server. The pcap attached above shows that.

 

[bsocko]

I have the camera and a PC plugged into the same isolated unmanaged switch. I'm using a PoE injector to power the camera. As I described in the original post here, the camera is making zero attempts to seek out a TFTP server. The pcap attached above shows that.

Sorry, I missed the pcap you attached. When you are attempting to capture are you using the webui for a reboot or a hard power reboot of the camera. I find I always have to do a hard power off for a few seconds then back on. If I use the WebUI it doesnt sent the WHO request for the TFTP server.

We will get to the bottom of this.

 

[ExplodingLemur]

When you are attempting to capture are you using the webui for a reboot or a hard power reboot of the camera.

I'm power-cycling the camera.

 

[bsocko]

I'm power-cycling the camera.

Do you have a hik nvr you can plug the camera and computer in? I still feel the switch has something to do with it. I had and continue to have the same issue when doing TFTP updates. Do you have any other cameras of this model to try or is it only a single one?

 

[ExplodingLemur]

Do you have a hik nvr you can plug the camera and computer in? I still feel the switch has something to do with it. I had and continue to have the same issue when doing TFTP updates. Do you have any other cameras of this model to try or is it only a single one?

I don't have a Hikvision NVR. The rest of my cameras are up on the house connected to a managed Aruba switch. I was using this one on the unmanaged switch to experiment with. But I think you're right about the switch being the issue. I just logged into the Aruba and toggled PoE on one of the camera ports while watching for Ethernet broadcasts on that VLAN and sure enough saw this ARP request come across:

03:12:37.584373 ARP, Request who-has 192.168.1.128 (ff:ff:ff:ff:ff:ff) tell 192.168.1.64, length 46

I'll throw the Hikvision TFTP script on this host and see if I can get the camera to pull from it.

 

[ExplodingLemur]

Huh, well, that worked! Too bad it wiped the prior configs entirely Note to self, cheapass consumer unmanaged switches are not useful for this purpose.

Thanks for pushing me in the right direction!

 

[bsocko]

Huh, well, that worked! Too bad it wiped the prior configs entirely Note to self, cheapass consumer unmanaged switches are not useful for this purpose.

Thanks for pushing me in the right direction!

I am glad we got to a solution together.

So no problem I take it using the Scott Lamb python tftp and changing the server IP to 192.168.1.128?

I did forget to mention that anytime you do a tftp update it factory resets the device even if you save the config before hand, once the Hik firmware it loaded it will give you a mismatch error if you try to restore it.

Win some , lose some I guess.

 

[ExplodingLemur]

Yep, got two cameras updated with that Python script and configured so far. I used the first newly flashed one to create a config file to use for the rest.

 

[wmd1942]

I have the same Laview LV-PBK80804C with the exactly same firmware version V5.5.3 build 171121. However, I can't get Scott Lamb script to flash Hikvision firmware. The camera is connected to one of POE ports of an unmanaged POE switch and the PC (running Kali Linux) is connected to the switch's link port. Nothing else is connected to the setup. After the camera is powered on, I don't see ARP requests for 192.0.0.128 or 192.168.1.128. After a while (when its boot process is underway), I saw the multiple ARP requests for 169.254.88.111:

$ sudo tcpdump -i eth0 -vv -e -nn ether proto 0x0806
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
01:43:37.404328 14:2f:fd:0f:cc:b0 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 169.254.88.111 tell 169.254.88.111, length 46

Any help is greatly appreciated.

 

[Webfont]

Try to enable promiscuous mode on the nic.
ifconfig eth0 promisc

You might not need it since you're not mirroring the traffic but just in case it's filtering it try it out.

 

[wmd1942]

I tried it (enable promiscuous mode on the nic) but no difference is observed. I don't believe the setup has any issue as the ARP request (DHCP) from the camera was indeed received later. To prove this, I had another Windows PC that hardwired to another port of the same switch with static address 192.168.1.200. When I ping the Linux PC (192.168.1.128) from Windows PC (192.168.1.200). The ARP request shows up immediately:

$ sudo tcpdump -i eth0 -vv -e -nn ether proto 0x0806
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
19:12:47.436211 54:ee:75:10:cc:xx > 68:f7:28:e4:f2:xx, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.128 tell 192.168.1.200, length 46
19:12:47.436220 68:f7:28:e4:f2:xx > 54:ee:75:10:cc:xx, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Reply 192.168.1.128 is-at 68:f7:28:e4:f2:xx, length 28
19:12:47.666909 68:f7:28:e4:f2:xx > 54:ee:75:10:cc:xx, ethertype ARP (0x0806), length 42: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.200 tell 192.168.1.128, length 28
19:12:47.668226 54:ee:75:10:cc:xx > 68:f7:28:e4:f2:xx, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Reply 192.168.1.200 is-at 54:ee:75:10:cc:xx, length 46

 

[wmd1942]

I checked OP's attached pcap and found out the contents are virtually identical to mine: No ARP requests for 192.168.1.128 or 192.0.0.128 at the beginning. The only observed ARP requests are 169.254.xxx.xxx later. I'm attaching mine to this post. I went back to read OP's later posts but not completely clear how "the switch being the issue".

 

[wmd1942]

Update: I got it working. It turned out the culprit was the switch. OP told me that the only thing he did was to use a managed Aruba switch (instead of using an unmanaged switch). I don't have a managed POE switch but improvised a crossover cable with 48V injected to the camera (as it does not have a pigtail power cord). So my Linux PC was directly connected to the camera. After the camera was powered, I finally saw the ARP request for 192.0.0.128. With TFTP script, I successfully updated my camera's firmware.

 

[bsocko]

Update: I got it working. It turned out the culprit was the switch. OP told me that the only thing he did was to use a managed Aruba switch (instead of using an unmanaged switch). I don't have a managed POE switch but improvised a crossover cable with 48V injected to the camera (as it does not have a pigtail power cord). So my Linux PC was directly connected to the camera. After the camera was powered, I finally saw the ARP request for 192.0.0.128. With TFTP script, I successfully updated my camera's firmware.

I am glad you got it fixed before I could answer. This is now the fourth time we have confirmed that certain switches are doing something funky with the ARP request.

For anyone reading this if you are having the same issue its likely your switch between the TFTP server.

 

[ExplodingLemur]

This has caused issues for friends with Raspberry Pis and PXE booting too.

 

[wmd1942]

Here is the wiring diagram of the crossover cable I made: