with what ivms encode the authentication tcp packet

[korin1]

hi,
i have been trying to read the packets from the app i am using (ivms/guardian expert hd/ basicly all app that connect to hikvision dvr\nvr)
when reading the packets sent from my phone to my dvr it shows 4 packets (nonesense data).

first packet sent from my phone to dvr , encoded data
second packet sent from the dvr to my phone encoded data (look like base64 but make no sense)
third packet sent from my phone to dvr , encoded data
forth packet sent from dvr to my phone , partial encode with the name of my camera (model).

i would like in the end be able to decode these strings. do debug the packets thats going through my phone.
thanks

 

[korin1]

hi, this is what i ment

blue packets = sent from my android phone to the dvr
red packets = sent from dvr to my phone

i dont have any idea what encode is that, but i have look for couple of days now, with no success
i am 100% sure that the authentication is being done within this 4 first packets. but i dont know how to decode it so i can read it as clear text.
i assume first packet is acknowledge with digest username and password ip port (packet is long)
2,3 packets no idea
4, packet is the camera ID/model and his serial.

 

[alexvas]

Hi,

There are multiple protocols supported by Hikivsion DVRs.
The app uses RTSP protocol to connect to DVRs. Not any proprietary protocol.

 

[korin1]

Hi,

There are multiple protocols supported by Hikivsion DVRs.
The app uses RTSP protocol to connect to DVRs. Not any proprietary protocol.

iVMS and Guarding Expert HD does not, sorry for not mentioning but iam not talking about RTSP protocol on port 554 by default.
i am speaking about the default port of 8000 in hikvision devices.

when using the application there is no packets from/to port 80 or 554
port 8000 is most of the time referred to SDK port or Server port
https://i.imgur.com/qfLP7Hj.png
https://i.imgur.com/sSHOQR7.png
Hikvision Port Forwarding and Networking Details

some hikvision model, i think its firmware base so old firmware version will send some stuff in port rtsp. but they all goes to the same process. first these 4-5 packets of authentication .

by the way i am using packet capture.
Packet Capture - Android Apps on Google Play

this is what rtsp looks like

i have record the packets

this is the first packet sent from my phone. note that port 4000 is equivalent to 8000, (was changed in the dvr)

and this is how the first packet looks like

 

[alexvas]

You are asking about proprietary Hikvision protocol which tinyCam does not support. No idea how that works. tinyCam works with RTSP only for Hikvision.

 

[korin1]

gotcha thanks you anyway, maybe one else knows about it