R6 Camera upgraded to 5.5, now ONVIF problems

[rprade]

I have 14 DS-2CD2142-FWD-I cameras. I am using Vivotek VAST as my recording software. I am still using VAST because we still really like the software. VAST is licensed for 3rd party cameras and all of these cameras were working fine for a year.

I do not use these cameras with port forwarding, yet I had 3 of them stop working. They would reject the login credentials, yet were still at their static IP addresses. Power cycling did nothing, only a factory reset would restore their function. When one of the cameras did it a second time I began to suspect the exploit published last year. These cameras were mostly on 5.3 firmware, but a couple were on 5.4.

Unfortunately I did not read the stories in this forum prior to upgrading to 5.5. When I did it broke ONVIF with VAST. I did enable ONVIF and add a admin user, but the cameras still will not work. I can use a single stream URL and they work fine, just not as ONVIF. I would really like to get back to multi stream support so that iOS clients will load at a lower resolution.

Another odd thing is that If I attempt to add one of these cameras using ONVIF, it kills the rest of the cameras working with VAST.

I have tried a number of recommendations to roll the cameras back to 5.4.5, but nothing has worked. The one that was supposed to work using TFTP and a modified 5.4.5 firmware to look like 5.5. TFTP never sees the cameras.

Is there any way to get these R6 cameras back to earlier firmware?

 

[alastairstevenson]

Is there any way to get these R6 cameras back to earlier firmware?

Hikvision IPC Firmware 5.5.0 - released 24 Sept 2017

 

[alastairstevenson]

TFTP never sees the cameras.

A common cause for that is your Windows firewall blocking the probes for the tftp updater, assuming that the IP address is correctly set as 192.0.0.128

 

[rprade]

A common cause for that is your Windows firewall blocking the probes for the tftp updater, assuming that the IP address is correctly set as 192.0.0.128

The firewall was disabled on the computer when I tried. Is it possible that the 12 year old tool will not run on Windows 10 X64? The link you posted above is for R0 cameras. Should it work on R6 models?

 

[alastairstevenson]

The link you posted above is for R0 cameras. Should it work on R6 models?

The attachment was for R6. R0 cameras doen't have 5.5.0 available.

Is it possible that the 12 year old tool will not run on Windows 10 X64?

It's certainly more problematic on Win10, but it does work.

 

[rprade]

The attachment was for R6. R0 cameras doen't have 5.5.0 available.

It's certainly more problematic on Win10, but it does work.

My bad, I went to the link in your signature instead of the one in the post.

I will spin up an XP VM and try it again.

 

[rprade]

No luck with XP either. I even reset the camera to default and tried, then activated and tried. TFTP never sees the camera. I was running TFTP with the "fake" 5.5 from the post.

As a final test, I connected an XP computer to a POE switch. There were no other devices connected. I configured the IP to 192.0.0.128 and launched TFTP. The fake 5.5 was in the directory with the TFTP program. The firewall was disabled. I connected a reset to factory defaults and activated camera and it was never discovered. I reset the camera again and tried without activating, same thing.

EDIT: Tried again with Windows 7 and with 2 different cameras. TFTP clearly is not being seen by the cameras.

Is there anything I am missing to get the TFTP application to see the camera? Has anyone been able to downgrade from 5.5 170725 on an R6 camera?

 

[alastairstevenson]

Is there anything I am missing to get the TFTP application to see the camera?

It sounds like you've tried various options without success, and the common factor seems to be the camera.
Normally, on power-up, the camera configures it's LAN interface to the IP address as defined in the bootloader environment variable 'ipaddr' This is nominally 192.0.0.64
Then a UDP packet is sent to the IP address as defined in environment variable 'serverip' This is nominally 192.0.0.128
The tftp updater sends a response packet as a positive handshake and the update dialogue begins.
The firmware file must be named digicap.dav

These environment variables can be different.
I have a vague recollection where a forum member found that the tftp updater was operating on 192.168.1.128

If you feel inclined to experiment further, you could capture the network traffic as seen by the PC for the first few seconds after the camera is powered on, to see what traffic, if any, emanates from the camera.

As a long shot, in case you have a cranky version of the tftp updater, attached is a copy of the one I've used with no problems, even in a Windows 7 VM.

 

[rprade]

Thanks. I will try your copy.

So that I understand...

When these cameras are reset, they default to 192.168.1.64. Am I to understand that it doesn’t matter what IP the camera is occupying, it will handshake with TFTP at the IP assigned to the PC? Does it matter what IP is assigned to the camera? Does it matter whether the camera is activated or not?

 

[alastairstevenson]

Am I to understand that it doesn’t matter what IP the camera is occupying, it will handshake with TFTP at the IP assigned to the PC?

Yes, that is correct. The IP address of 192.0.0.64 that the bootloader uses to probe for the tftp updater on 192.0.0.128 is separate from the IP address that Linux uses from the user configuration file after full bootup.

Does it matter what IP is assigned to the camera?

That in the usual web GUI configuration, no it does not.

Does it matter whether the camera is activated or not?

No, it's the bootloader that has the tftp recovery capability, independent of what's going on with the main system after bootup.

 

[rprade]

With a single Windows 7 computer, running the TFTP you attached above, with the "fake" 5.5 digicap.dav in the same folder as the program. Connected to a Ubiquiti 8-port POE switch and plugging the DS-2CD2142-FWD-I into the same switch, the program never sees the camera. There is nothing else connected to the switch other than the computer and the camera. The camera is known to be good, but running on 5.5.

I guess I need to assume that the 5.5 I loaded stopped this from working.

 

[kbonnel]

With a single Windows 7 computer, running the TFTP you attached above, with the "fake" 5.5 digicap.dav in the same folder as the program. Connected to a Ubiquiti 8-port POE switch and plugging the DS-2CD2142-FWD-I into the same switch, the program never sees the camera. There is nothing else connected to the switch other than the computer and the camera. The camera is known to be good, but running on 5.5.

I guess I need to assume that the 5.5 I loaded stopped this from working.

I am running into the same issue, though I know the camera is setting up the 192.0.0.64 IP during boot, as I can ping it from my windows 10 machine that has the tftp server running on it. You can test it by going through the normal process, and then open a command prompt and type ping 192.0.0.64 and either keep repeating the command after it finishes (5 pings I believe) or use the proper flag to keep it going indefinitely. Start the ping process once you plug in the camera, and if the camera does configure it's adapter to the 192.0.0.64 address, it will start responding to pings.

Mine responds to pings, but the tftp process never starts.

 

[alastairstevenson]

I guess I need to assume that the 5.5 I loaded stopped this from working.

I no longer have an R6 camera to test this 5.5.0 behaviour on - but if it was so, I would not be surprised. Hikvision do have a track record of removing original facilities that have proven useful for 'improvements'.
Do you have the facility to capture LAN traffic over the few seconds covering the camera power-on?
That might confirm one way or the other - could be interpreted on the forum here if you are not sure how to.

 

[rprade]

I am not deeply IP savvy, but I would be happy to try. Assuming it would reguire Wireshark or similar, I will try to educate myself enough to see if I can capture something.

Alternately since I am facing an expensive proposition if I am stuck on 5.5, I would certainly be willing to ship a spare camera if someone wants to experiment. If I can’t roll back, I am going to have to go with different cameras (expensive) or different software (also expensive).

Ultimately it is my fault for updating the firmware without researching, but it is unfortunate that Hikvision has the policies in place that prevent undoing an update if it causes unforeseen complications. I have not (in my recollection) ever had a situation where an update couldn’t be undone.

 

[kbonnel]

Ok, so I did a wireshark of my adapter, and the camera was looking for 192.168.1.128 IP not 192.0.0.128. I change my adapter to 192.168.1.128 and booted up the camera. It started the tftp process. I will have to check that it works 100%, but the tftp part happened.

 

[rprade]

Ok, so I did a wireshark of my adapter, and the camera was looking for 192.168.1.128 IP not 192.0.0.128. I change my adapter to 192.168.1.128 and booted up the camera. It started the tftp process. I will have to check that it works 100%, but the tftp part happened.

I tried that IP this morning and TFTP never saw the camera. I have not tried Wireshark yet.

I am anxious to hear if you were able to roll an R6 back from 5.5.

 

[alastairstevenson]

I change my adapter to 192.168.1.128 and booted up the camera. It started the tftp process.

Interesting.

 

[kbonnel]

I tried that IP this morning and TFTP never saw the camera. I have not tried Wireshark yet.

I am anxious to hear if you were able to roll an R6 back from 5.5.

It seems like it worked. Sorry it took me a little bit to get back too you, as I was trying to access the camera via the 192.168.1.64 address as I thought it would use that after the flash. But, it kept the dhcp setting I had before, and it was using the same IP it was using when I had 5.5.0 on it.

My camera is the Hykamic 4MP camera, which is a Hikvision 2CD2442FWD-IW camera. I used the R6 5.4.5 firmeware that is in the 5.5.0 thread that detailed the process.

If you want to see something specific from my camera, just let me know.

 

[kbonnel]

Just for fun, and in reality more of a verification, I am going to try and do a fresh "real" 5.4.5 firmware install on top of the "fake" 5.4.5 firmware via the browser. I would do it via the IVMS4200 client, but because I forgot to disable the camera from BI, I had too many failed attempts from the BI ip address, so I have to wait 20 minutes to login again. I can at least get too the camera from another IP.

I did have to reactivate the camera and setup a new admin password.

 

[rprade]

It seems like it worked. Sorry it took me a little bit to get back too you, as I was trying to access the camera via the 192.168.1.64 address as I thought it would use that after the flash. But, it kept the dhcp setting I had before, and it was using the same IP it was using when I had 5.5.0 on it.

My camera is the Hykamic 4MP camera, which is a Hikvision 2CD2442FWD-IW camera. I used the R6 5.4.5 firmeware that is in the 5.5.0 thread that detailed the process.

If you want to see something specific from my camera, just let me know.

I have 2 2CD2442FWD cameras, but I have been trying with 2CD2142FWD cameras which should be the same. I will try one of my 2442s.