New DS-2CD2332i camara, unable to connect but replies to port scan and pings

Joined
Jul 24, 2016
Messages
4
Reaction score
0
Hello, picked up what looks to be a brand new, US model camera off ebay in the white/red packaging. Powered via POE I can ping device and NMAP shows all the following ports are open

Scanning 192.0.0.64 [1000 ports]

Discovered open port 80/tcp on 192.0.0.64
Discovered open port 443/tcp on 192.0.0.64
Discovered open port 23/tcp on 192.0.0.64
Discovered open port 8000/tcp on 192.0.0.64
Discovered open port 7001/tcp on 192.0.0.64
Discovered open port 9010/tcp on 192.0.0.64
Discovered open port 8200/tcp on 192.0.0.64

Discovered open port 49152/tcp on 192.0.0.64

PORT STATE SERVICE VERSION

23/tcp open telnet BusyBox telnetd

80/tcp open http ScanSafe http-server-header: ScanSafe http-title: Cannot find server

443/tcp open https http-title: Site doesn't have a title.

7001/tcp open afs3-callback?

8000/tcp open http-alt?

8200/tcp open trivnet1?

9010/tcp open sdr?

49152/tcp open upnp Portable SDK for UPnP devices 1.6.17 (Linux 2.6.38.8; UPnP 1.0)

I cannot connect to the camera via HTTP, HTTPS, tftp etc but I can telnet to it.

Ideas?
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,984
Reaction score
6,805
Location
Scotland
It's maybe been bricked by an incorrect firmware update.
What IP address is your PC using? DOes it have a single NIC?
See what SADP thinks of the camera, in particular if it shows as 'Active' and what the firmware version is. SADP will find the camera even on a different subnet.
http://www.hikvisioneurope.com/portal/index.php?dir=Software/00 Software Tool Package/01 SADP Tools/new/V3.0.0.2/
See what ONVIF Device Manager thinks of it - sourceforge.net
If you can log in via telnet (old default passwords are 12345 123456789abc) try dmesg or cat /proc/kmsg and see if any clues in those logs.
ODM will also ideally need an ID (admin) and password.
 
Joined
Jul 24, 2016
Messages
4
Reaction score
0
SADP doesn't see the camera at all. MY PC is set to 192.0.0.10 and is on the same switch as the camera and it has a single Nic.

I'll give ONVIF device manager a shot and check the logs.

Thanks!
 
Joined
Jul 24, 2016
Messages
4
Reaction score
0
Here is the output from dmesg (looks the same as cat /proc/kmsg). Looks pretty clean, not sure what I'm looking for though.

# dmesg
[ 0.000000] Linux version 2.6.38.8 (root@HIK-RD-CI-Frontend) (gcc version 4.6.1 (Sourcery CodeBench Lite 2011.09-70) )
[ 0.000000] #33 PREEMPT Fri Oct 24 10:46:55 CST 2014
[ 0.000000] CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f
[ 0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
[ 0.000000] Machine: Coconut
[ 0.000000] Memory policy: ECC disabled, Data cache writeback
[ 0.000000] Ambarella: AHB = 0x60000000[0xf0000000],0x01000000 0
[ 0.000000] Ambarella: APB = 0x70000000[0xf1000000],0x01000000 0
[ 0.000000] Ambarella: PPM = 0xc0000000[0xe0000000],0x00200000 9
[ 0.000000] Ambarella: BSB = 0xc8c00000[0xe8c00000],0x00400000 9
[ 0.000000] Ambarella: DSP = 0xc9000000[0xe9000000],0x07000000 9
[ 0.000000] Ambarella: HAL = 0xc00a0000[0xfee00000],0x0000e708 9
[ 0.000000] On node 0 totalpages: 25344
[ 0.000000] free_area_init_node: node 0, pgdat c04dd028, node_mem_map c0503000
[ 0.000000] Normal zone: 198 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 25146 pages, LIFO batch:7
[ 0.000000] bootmem_init: high_memory = 0xc8a00000
[ 0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[ 0.000000] pcpu-alloc: [0] 0
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 25146
[ 0.000000] Kernel command line: console=ttyS0 initrd=0xc0a00000,0x400000 rw root=/dev/ram dbg=0 KRN_PRT=pri RMD_PRT=
pri reserved=0xc6500000,0x100000,99 video=amb0fb:720x480,720x480,1,0
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Memory: 99MB = 99MB total
[ 0.000000] Memory: 91192k/91192k available, 10184k reserved, 0K highmem
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xfff00000 - 0xfffe0000 ( 896 kB)
[ 0.000000] DMA : 0xfe600000 - 0xfee00000 ( 8 MB)
[ 0.000000] vmalloc : 0xc9000000 - 0xe0000000 ( 368 MB)
[ 0.000000] lowmem : 0xc0000000 - 0xc8a00000 ( 138 MB)
[ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB)
[ 0.000000] .init : 0xc0008000 - 0xc002d000 ( 148 kB)
[ 0.000000] .text : 0xc002d000 - 0xc04aa000 (4596 kB)
[ 0.000000] .data : 0xc04aa000 - 0xc04dd6e0 ( 206 kB)
[ 0.000000] Preemptable hierarchical RCU implementation.
[ 0.000000] RCU-based detection of stalled CPUs is disabled.
[ 0.000000] Verbose stalled-CPUs detection is disabled.
[ 0.000000] NR_IRQS:224
[ 0.000000] sched_clock: 32 bits at 72MHz, resolution 13ns, wraps every 59652ms
[ 0.000000] sched_clock: wrong multiply/shift: 1864135111>>27 vs calculated 3728270222>>28
[ 0.000000] sched_clock: fix multiply/shift to avoid scheduler hiccups
[ 0.000000] Console: colour dummy device 80x30
[ 0.000000] console [ttyS0] enabled
[ 0.000600] Calibrating delay loop... 525.92 BogoMIPS (lpj=2629632)
[ 0.260145] pid_max: default: 32768 minimum: 301
[ 0.260576] Mount-cache hash table entries: 512
[ 0.261369] CPU: Testing write buffer coherency: ok
[ 0.268105] NET: Registered protocol family 16
[ 0.279091] Ambarella Coconut:
[ 0.279127] chip id: 5100
[ 0.279141] board type: 3
[ 0.279155] board revision: 10
[ 0.279168] chip name: a5m
[ 0.279181] HAL version: 176869
[ 0.279197] reference clock: 24000000
[ 0.279214] system configuration: 0x177804ea
[ 0.279232] boot type: 0x00000002
[ 0.279247] hif type: 0x00000000
[ 0.307473] bio: create slab <bio-0> at 0
[ 0.310046] ambarella-spi ambarella-spi.0: ambarella SPI Controller 0 created
[ 0.321201] ambarella-i2c ambarella-i2c.0: Ambarella Media Processor I2C adapter[i2c-0] probed!
[ 0.322771] ambarella-i2c ambarella-i2c.1: Ambarella Media Processor I2C adapter[i2c-1] probed!
[ 0.324234] i2c i2c-0: Added multiplexed i2c bus 2
[ 0.324278] ambarella-i2cmux ambarella-i2cmux.0: mux on ambarella-i2c adapter
[ 0.327238] Advanced Linux Sound Architecture Driver Version 1.0.23.
[ 0.331523] cfg80211: Calling CRDA to update world regulatory domain
[ 0.333195] Switching to clocksource ambarella-cs-timer
[ 0.340203] Switched to NOHz mode on CPU #0
[ 0.397542] NET: Registered protocol family 2
[ 0.397909] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.398826] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[ 0.399036] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.399182] TCP: Hash tables configured (established 4096 bind 4096)
[ 0.399203] TCP reno registered
[ 0.399232] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.399279] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.399922] NET: Registered protocol family 1
[ 0.400847] RPC: Registered udp transport module.
[ 0.400885] RPC: Registered tcp transport module.
[ 0.400905] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.401421] Trying to unpack rootfs image as initramfs...
[ 0.404045] rootfs image is not initramfs (no cpio magic); looks like an initrd
[ 0.438821] Freeing initrd memory: 4096K
[ 0.441844] [ kernel version: svn-97978 ]
[ 0.441949] mmc0 power register success!
[ 0.441992] mmc1 power register success!
[ 0.442131] reboot times :1
[ 0.465078] msgmni has been set to 186
[ 0.473821] alg: No test for stdrng (krng)
[ 0.473983] io scheduler noop registered
[ 0.474014] io scheduler deadline registered
[ 0.474195] io scheduler cfq registered (default)
[ 0.477955] ambarella-fb ambarella-fb.0: probe p[720x480] v[720x576] c[1] b[0] l[736] @ [0xc5980000:0x00068000]!
[ 0.479819] ambarella-uart.0: ttyS0 at MMIO 0x70005000 (irq = 9) is a ambuart
[ 0.516559] brd: module loaded
[ 0.531036] loop: module loaded
[ 0.534624] NAND device: Manufacturer ID: 0xef, Chip ID: 0xf1 (Winbond NAND 128MiB 3,3V 8-bit)
[ 0.534673] ambarella_nand_config_flash: 0x02e00140, 0x02c00140
[ 0.535103] Bad block table found at page 65472, version 0x01
[ 0.535645] Bad block table found at page 65408, version 0x01
[ 0.541780] ambarella-nand ambarella-nand: ambarella_nand_probe: Partition infomation found!
[ 0.541846] Creating 18 MTD partitions on "ambnand":
[ 0.541883] 0x000000000000-0x000000020000 : "bst"
[ 0.546128] 0x000000020000-0x000000120000 : "ptb"
[ 0.549919] 0x000000120000-0x000000220000 : "bld"
[ 0.553996] 0x000000220000-0x000000320000 : "hal"
[ 0.557888] 0x000000320000-0x000000420000 : "ano_ptb"
[ 0.561827] 0x000000420000-0x0000004a0000 : "env"
[ 0.566122] 0x0000004a0000-0x000000520000 : "param"
[ 0.570146] 0x000000520000-0x000000620000 : "dpt"
[ 0.574500] 0x000000620000-0x000001020000 : "rcvy"
[ 0.578710] 0x000001020000-0x000001820000 : "krn_pri"
[ 0.582633] 0x000001820000-0x000002020000 : "krn_sec"
[ 0.586884] 0x000002020000-0x000002420000 : "rmd_pri"
[ 0.590873] 0x000002420000-0x000002820000 : "rmd_sec"
[ 0.595217] 0x000002820000-0x000004020000 : "app_pri"
[ 0.599368] 0x000004020000-0x000005820000 : "app_sec"
[ 0.603832] 0x000005820000-0x000005c20000 : "cfg_pri"
[ 0.607986] 0x000005c20000-0x000006020000 : "cfg_sec"
[ 0.612294] 0x000006020000-0x000007020000 : "dbg"
[ 0.623884] PPP generic driver version 2.4.2
[ 0.625306] PPP Deflate Compression module registered
[ 0.625349] PPP BSD Compression module registered
[ 0.818600] Ambarella MII Bus: probed
[ 0.820266] ambarella-eth ambarella-eth.0: MAC Address[48:11:b2:22:be:b6].
[ 0.821011] console [netcon0] enabled
[ 0.821039] netconsole: network logging started
[ 0.822716] mousedev: PS/2 mouse device common for all mice
[ 0.823937] input: AmbInput as /devices/virtual/input/input0
[ 0.824978] ambarella_gpio_irq_set_wake: irq[75] = girq[11] = 1
[ 0.825022] ambarella-input ambarella-input: AmbInput probed!
[ 0.826044] ambarella-adc ambarella-adc: ADC Host Controller [polling mode] probed!
[ 0.827746] ambarella-rtc ambarella-rtc: rtc core: registered ambarella-rtc as rtc0
[ 0.828349] i2c /dev entries driver
[ 0.833240] ambarella-wdt ambarella-wdt: Ambarella Media Processor Watch Dog Timer[ambarella-wdt].
[ 0.840148] ALSA device list:
[ 0.840181] No soundcards found.
[ 0.840364] Netfilter messages via NETLINK v0.30.
[ 0.840580] nf_conntrack version 0.5.0 (1488 buckets, 5952 max)
[ 0.841256] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 0.841433] TCP cubic registered
[ 0.841867] NET: Registered protocol family 10
[ 0.844850] Mobile IPv6
[ 0.844984] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 0.845248] IPv6 over IPv4 tunneling driver
[ 0.849084] NET: Registered protocol family 17
[ 0.849920] sctp: Hash tables configured (established 4096 bind 8192)
[ 0.850277] sctp: sctp_init_sock(sk: c58ceb20)
[ 0.850400] lib80211: common routines for IEEE802.11 drivers
[ 0.850432] lib80211_crypt: registered algorithm 'NULL'
[ 0.854747] ambarella-rtc ambarella-rtc: setting system clock to 2016-02-23 04:43:14 UTC (1456202594)
[ 0.855579] RAMDISK: gzip image found at block 0
[ 1.673008] EXT2-fs (ram0): warning: maximal mount count reached, running e2fsck is recommended
[ 1.673200] VFS: Mounted root (ext2 filesystem) on device 1:0.
[ 1.673537] Freeing init memory: 148K
[ 3.704738] UBI: attaching mtd13 to ubi1
[ 3.704779] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 3.704803] UBI: logical eraseblock size: 129024 bytes
[ 3.704822] UBI: smallest flash I/O unit: 2048
[ 3.704839] UBI: sub-page size: 512
[ 3.704858] UBI: VID header offset: 512 (aligned 512)
[ 3.704878] UBI: data offset: 2048
[ 3.763927] UBI: max. sequence number: 152
[ 3.783433] UBI: attached mtd13 to ubi1
[ 3.783465] UBI: MTD device name: "app_pri"
[ 3.783486] UBI: MTD device size: 24 MiB
[ 3.783505] UBI: number of good PEBs: 192
[ 3.783522] UBI: number of bad PEBs: 0
[ 3.783539] UBI: number of corrupted PEBs: 0
[ 3.783555] UBI: max. allowed volumes: 128
[ 3.783572] UBI: wear-leveling threshold: 4096
[ 3.783588] UBI: number of internal volumes: 1
[ 3.783604] UBI: number of user volumes: 1
[ 3.783620] UBI: available PEBs: 0
[ 3.783636] UBI: total number of reserved PEBs: 192
[ 3.783654] UBI: number of PEBs reserved for bad PEB handling: 2
[ 3.783675] UBI: max/mean erase counter: 3/1
[ 3.783691] UBI: image sequence number: 1210278212
[ 3.791682] UBI: background thread "ubi_bgt1d" started, PID 627
[ 3.873404] UBIFS: recovery needed
[ 3.907038] UBIFS: recovery completed
[ 3.907086] UBIFS: mounted UBI device 1, volume 0, name "app_pri"
[ 3.907114] UBIFS: file system size: 22837248 bytes (22302 KiB, 21 MiB, 177 LEBs)
[ 3.907143] UBIFS: journal size: 1161216 bytes (1134 KiB, 1 MiB, 9 LEBs)
[ 3.907168] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 3.907187] UBIFS: default compressor: lzo
[ 3.907205] UBIFS: reserved for root: 1078659 bytes (1053 KiB)
[ 6.500369] UBI: attaching mtd15 to ubi3
[ 6.500411] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 6.500436] UBI: logical eraseblock size: 129024 bytes
[ 6.500455] UBI: smallest flash I/O unit: 2048
[ 6.500472] UBI: sub-page size: 512
[ 6.500491] UBI: VID header offset: 512 (aligned 512)
[ 6.500510] UBI: data offset: 2048
[ 6.509526] UBI: max. sequence number: 71
[ 6.533065] UBI: attached mtd15 to ubi3
[ 6.533099] UBI: MTD device name: "cfg_pri"
[ 6.533121] UBI: MTD device size: 4 MiB
[ 6.533140] UBI: number of good PEBs: 32
[ 6.533158] UBI: number of bad PEBs: 0
[ 6.533173] UBI: number of corrupted PEBs: 0
[ 6.533190] UBI: max. allowed volumes: 128
[ 6.533206] UBI: wear-leveling threshold: 4096
[ 6.533223] UBI: number of internal volumes: 1
[ 6.533368] UBI: number of user volumes: 1
[ 6.533396] UBI: available PEBs: 0
[ 6.533414] UBI: total number of reserved PEBs: 32
[ 6.533432] UBI: number of PEBs reserved for bad PEB handling: 2
[ 6.533453] UBI: max/mean erase counter: 6/5
[ 6.533469] UBI: image sequence number: 733879330
[ 6.541462] UBI: background thread "ubi_bgt3d" started, PID 637
[ 6.616532] UBIFS: recovery needed
[ 6.656766] UBIFS: recovery completed
[ 6.656812] UBIFS: mounted UBI device 3, volume 0, name "cfg_pri"
[ 6.656840] UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
[ 6.656867] UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
[ 6.656891] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 6.656910] UBIFS: default compressor: lzo
[ 6.656928] UBIFS: reserved for root: 103599 bytes (101 KiB)
[ 6.753146] UBI: attaching mtd16 to ubi4
[ 6.753190] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 6.753213] UBI: logical eraseblock size: 129024 bytes
[ 6.753232] UBI: smallest flash I/O unit: 2048
[ 6.753369] UBI: sub-page size: 512
[ 6.753400] UBI: VID header offset: 512 (aligned 512)
[ 6.753422] UBI: data offset: 2048
[ 6.762263] UBI: max. sequence number: 75
[ 6.783445] UBI: attached mtd16 to ubi4
[ 6.783479] UBI: MTD device name: "cfg_sec"
[ 6.783501] UBI: MTD device size: 4 MiB
[ 6.783518] UBI: number of good PEBs: 32
[ 6.783534] UBI: number of bad PEBs: 0
[ 6.783550] UBI: number of corrupted PEBs: 0
[ 6.783566] UBI: max. allowed volumes: 128
[ 6.783582] UBI: wear-leveling threshold: 4096
[ 6.783599] UBI: number of internal volumes: 1
[ 6.783614] UBI: number of user volumes: 1
[ 6.783630] UBI: available PEBs: 0
[ 6.783646] UBI: total number of reserved PEBs: 32
[ 6.783664] UBI: number of PEBs reserved for bad PEB handling: 2
[ 6.783685] UBI: max/mean erase counter: 6/5
[ 6.783701] UBI: image sequence number: 720562252
[ 6.791810] UBI: background thread "ubi_bgt4d" started, PID 648
[ 6.871220] UBIFS: recovery needed
[ 6.925278] UBIFS: recovery completed
[ 6.925326] UBIFS: mounted UBI device 4, volume 0, name "cfg_sec"
[ 6.925357] UBIFS: file system size: 2193408 bytes (2142 KiB, 2 MiB, 17 LEBs)
[ 6.925385] UBIFS: journal size: 1032193 bytes (1008 KiB, 0 MiB, 6 LEBs)
[ 6.925410] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 6.925429] UBIFS: default compressor: lzo
[ 6.925447] UBIFS: reserved for root: 103599 bytes (101 KiB)
[ 8.109257] net eth0: Could not find default PHY in 9.
[ 8.109299] net eth0: Try PHY[9] whose id is 0x00008201!
[ 8.110524] ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 10.103729] PHY: 0:09 - Link is Up - 100/Full
[ 10.103945] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[ 16.187077] dsp: module license 'Proprietary' taints kernel.
[ 16.187117] Disabling lock debugging due to kernel taint
[ 16.265976] img: aaa_fifo2_base malloc c2940000
[ 16.685698] >>>>>> DSP LOG ADDR START PHY 0xc0080000
[ 16.685732] Init software HR timer for DSP communication
[ 16.715439] cdev_init rs485_fops ...
[ 16.715491] adding uart1, minor = 0
[ 16.719043] Successfully insmod uart232 module!
[ 16.860415] amba_debug_init 248:248.
[ 20.913321] eth0: no IPv6 routers present
[ 32.805292] AMBARELLA SoC Audio DUMMY Codec
[ 32.806817] asoc: AMBARELLA_DUMMY_CODEC <-> ambarella-i2s.0 mapping ok
[ 33.670833] MT9T002 sensor ID is 0x2604
[ 33.721054] CMEMK module: built on Aug 23 2012 at 17:05:43
[ 33.721101] Reference Linux version 2.6.38
[ 33.721120] File /mnt/data_bsp/data_yuhuanhuan/raptor/a5s_svn2/kernel/hik_drivers/cmem/src/module/cmemk.c
[ 33.728791] cmemk initialized
[ 44.517645] iav error: Failed to wait for completion!

 
Joined
Jul 24, 2016
Messages
4
Reaction score
0
Connected from another system... problem resolved. Apparently my work PC is blocking something crucial.

Thanks for the reply!
 

alastairstevenson

Staff member
Joined
Oct 28, 2014
Messages
15,984
Reaction score
6,805
Location
Scotland
Yes, that log doesn't show anything fatal.
SADP is a good tool, as is ODM.
Looks like you're good to go!

But be aware, it has an older version of firmware that still allows good access.
Check out the reported firmware version in the web GUI, and group of 4 letters (maybe CCWR) in the serial number, and what firmware version is written on the label, see if they match.
If not - the firmware is not the original, and may be 'hacked to English' That's OK, as long as you don't change it.
 
Top