YooSee SD-M5 doorbell: 1080p, PoE, RTSP, Onvif, only $66

[johnnyletrois]

Mine arrived yesterday. Two weeks from eBay order to delivery in Washington. Not bad.

Setup was easy using the iOS app as was pairing with the usb powered chime. Haven’t played around too much but did get the RTSP stream working in VLC. Also connected fine to my QNAP NAS running QVR Pro using the generic onvif setting.

Haven’t been able to set it up as a generic IP camera in HomeAssistant yet because I don’t know the still image url. Will try to hunt that down when I have time.

What I really want to sniff out is the button press so I can trigger an automation in HomeAssistant. Maybe there’s a url endpoint. Otherwise I’ll try to tap into the chime or maybe I’ll get a 433mhz sniffer but I’d prefer not to.

Tried getting the still image url using the following command but no response:

<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:trt="http://www.onvif.org/ver10/media/wsdl" xmlns:tt="http://www.onvif.org/ver10/schema"> <soap:Body> <trt:GetSnapshotUri > <trtrofileToken>IPCProfilesToken0</trtrofileToken> </trt:GetSnapshotUri> </soap:Body> </soap:Envelope>


I did find out there is a substream at /onvif2

 

[Fd80]

I just received a Sonof RF Bridge and flashed it with Tasmota to try and see if I could receive any 433Mhz codes on button presses but was unsuccessful - nothing came up on the console. Not sure if rflink is any better

 

[SecuritySeeker]

You stated this doorbell will not work with a PoE switch that does 802.3af . I'm not sure if that comment is in relation to power negotiation or a software profile requirement.

That comment was in relation to power negotiation. An 802.3af compliant switch (or your Lorex NVR) is not going to provide power to a non-compliant device such as the YooSee doorbell. This is what happens when a PSE such as a switch tries to determine if there's a device connected that requires PoE power:

If it does not get the correct 'response' it will never enter the Classification (determine power needs) or Operational Phase so no power will be provided. It basically starts with a short low-voltage 'probe' in order to not cause damage to non-PoE devices.

At first I was thinking adding a Ubiquiti PoE Adapter ahead of the doorbell would address the issue of power negotiation but now I'm not so sure... or if this is even the correct adapter.
https://www.amazon.com/Ubiquiti-Net...01N9MJL91/ref=cm_cr_arp_d_product_top?ie=UTF8

Yes, that will work. The Ubiquiti 'Instant AF' basically turns the passive PoE device into an 802.3af device from the point of view of the switch (or NVR). You can put it at either end of the cable. Note that there is also an outdoor version of that Ubiquiti adapter.

 

[Elton Noway]

That comment was in relation to power negotiation. An 802.3af compliant switch (or your Lorex NVR) is not going to provide power to a non-compliant device such as the YooSee doorbell. This is what happens when a PSE such as a switch tries to determine if there's a device connected that requires PoE power:

[image - PSE's Signal during PoE Process - snipped]

If it does not get the correct 'response' it will never enter the Classification (determine power needs) or Operational Phase so no power will be provided. It basically starts with a short low-voltage 'probe' in order to not cause damage to non-PoE devices.

Yes, that will work. The Ubiquiti 'Instant AF' basically turns the passive PoE device into an 802.3af device from the point of view of the switch (or NVR). You can put it at either end of the cable. Note that there is also an outdoor version of that Ubiquiti adapter.

Awesome. THANK YOU THANK YOU! Your clarification and definitive response was just the response I was looking for. Much appreciated.

 

[johnnyletrois]

I tried using Wireshark to monitor doorbell traffic on my network but I think I need a tutorial. The only time I could see anything filtering by the doorbell IP was when I pinged the doorbell or opened the RTSP stream on my laptop. Couldn’t see anything on pressing the doorbell button.

 

[SecuritySeeker]

Question for those of you who purchased the Ubiquiti Instant 802.3af Adapter (I got the INS‑3AF‑I‑G indoor gigabit model with the cordless cilindrical enclosure):

Does your unit have a slight rattle to it?

I received mine today and I can hear a rattle inside, as if the entire PCB can move around a little bit. It doesn't sound like a defect but I do prefer my electronic gadgets rattle-free. Unfortunately the enclosure seems welded shut so there's no way to check what's causing the rattling.

If all units exhibit this rattling it's okay but if not I might want to get mine exchanged.

 

[cameraman27]

I'm currently running a hacked up Dahua Doorstation VTO as I made a thread here about it: Dahua VTO2111D-WP Information and Hacking

What I want to know is....

Does 2-way audio work WITHIN the blueIris app audio button?
Can this doorbell trigger a zwave/smart home open/close relay somehow?
Can the iOS app audio/video still work if the camera is completely removed from the internet on a segregated VLAN with no internet access (but local access)?

 

[Elton Noway]

Question for those of you who purchased the Ubiquiti Instant 802.3af Adapter (I got the INS‑3AF‑I‑G indoor gigabit model with the cordless cilindrical enclosure):

Does your unit have a slight rattle to it?

I received mine today and I can hear a rattle inside, as if the entire PCB can move around a little bit. It doesn't sound like a defect but I do prefer my electronic gadgets rattle-free. Unfortunately the enclosure seems welded shut so there's no way to check what's causing the rattling.

If all units exhibit this rattling it's okay but if not I might want to get mine exchanged.

Hi @SecuritySeeker ... mine was delivered 3 days ago. Hate to let you down but mine is rock solid and doesn't rattle at all no matter how hard I shake it. It's so solid if I didn't know better I'd think the case was empty. Like you I'm also pretty particular about my electronic gadgets so I'd probably consider returning it as well not know what might be rattling around (e.g., something conductive that could short the unit out).

Just FYI: Not sure what avenues you have available to you in the Netherlands but I purchased mine via Amazon.com here in the US. For anyone considering purchasing one of these via Amazon US... be aware Amazon currently has 47 third party sellers selling this very item at different price points with each seller having his or hers own store front and specific return policies. Personally to eliminate as many headaches as possible, I always try to make sure the item I order is Sold and Shipped by Amazon and if that isn't an option I make sure the item is at least Fulfilled by Amazon in case there is an issue. Of the 47 sellers currently offering this item only 5 of them have Amazon process the fulfillment.

Amazon.com: Buying Choices: Ubiquiti INS-3AF-I-G Indoor Gigabit Adapter

 

[whoami ™]

Question for those of you who purchased the Ubiquiti Instant 802.3af Adapter (I got the INS‑3AF‑I‑G indoor gigabit model with the cordless cilindrical enclosure):

Does your unit have a slight rattle to it?

I received mine today and I can hear a rattle inside, as if the entire PCB can move around a little bit. It doesn't sound like a defect but I do prefer my electronic gadgets rattle-free. Unfortunately the enclosure seems welded shut so there's no way to check what's causing the rattling.

If all units exhibit this rattling it's okay but if not I might want to get mine exchanged.

Mine DOES NOT have any thing rattling inside.

 

[whoami ™]

Here's some WireShark capture of the handshake

DESCRIBE rtsp:/192.168.0.30/onvif1 RTSP/1.0
CSeq: 1
Accept: application/sdp
User-Agent: BlueIris
RTSP/1.0 401 Unauthorized
CSeq: 1
WWW-Authenticate: Digest realm="HIipCamera",nonce="b38a251b067d30b123af0280ee1de843"
DESCRIBE rtsp:/192.168.0.30/onvif1 RTSP/1.0
CSeq: 2
Accept: application/sdp
User-Agent: BlueIris
Authorization: Digest username="admin", realm="HIipCamera", nonce="b38a251b067d30b123af0280ee1de843", uri="rtsp:/192.168.0.30/onvif1", response="1d076d70e28ac0fafe70b6ac8a1eb992"

RTSP/1.0 200 OK
CSeq: 2
Content-Type: application/sdp
Content-Length: 421
v=0
o=- 1421069297525233 1 IN IP4 192.168.0.30
s=H.264 Video, RtspServer_0.0.0.2
t=0 0
a=tool:RtspServer_0.0.0.2
a=type:broadcast
a=control:*
a=range:npt=0-
m=video 0 RTP/AVP 96
c=IN IP4 0.0.0.0
b=AS:500
a=rtpmap:96 H264/90000
a=fmtp:96 packetization-mode=1;profile-level-id=42001F;sprop-parameter-sets=Z0IAH5WoFAFuQA==,aM48gA==
a=control:track1
m=audio 0 RTP/AVP 8
a=control:track2
a=rtpmap:8 PCMA/8000
SETUP rtsp:/192.168.0.30/onvif1/track1 RTSP/1.0
CSeq: 3
Transport: RTP/AVP/TCP;unicast;interleaved=0-1
User-Agent: BlueIris
Authorization: Digest username="admin",realm="HIipCamera",nonce="b38a251b067d30b123af0280ee1de843",uri="rtsp:/192.168.0.30/onvif1/track1",response="9258692f6b42d2d414dd8828556edda1"

RTSP/1.0 200 OK
CSeq: 3
Transport: RTP/AVP;unicast;destination=192.168.0.100;source=192.168.0.30;interleaved=0-1
Session: 4da16eae;timeout=60
PLAY rtsp:/192.168.0.30/onvif1 RTSP/1.0
CSeq: 4
Session: 4da16eae
Range: npt=0.000-
User-Agent: BlueIris
Authorization: Digest username="admin",realm="HIipCamera",nonce="b38a251b067d30b123af0280ee1de843",uri="rtsp:/192.168.0.30/onvif1",response="59bfcd83f3941eb15129df3ab7e0cd78"

RTSP/1.0 200 OK
CSeq: 4
Range: npt=0.000-
Session: 4da16eae
RTP-Info: url=rtsp:192.168.0.30:554/onvif1/track1;seq=52613;rtptime=930434310

 

[whoami ™]

I also got this doorbell cam streaming on my Honeywell Tuxedo WiFi keypad.

the path to get it streaming on this is just onvif2

not /onvif2 (no path separator)

onvif2 path is for the low res stream.

 

[Elton Noway]

Sorry to bump my own posts but wanted to provide some answers to a few questions I've presented in the last month or so. Disclaimer… I’m not running BlueIris I just have a 8 Channel Lorex Security System kit. FYI: With all the computers I’ve built, my multiple networks, NAS etc, building a system with BlueIris would be a no brainer but my life is crazy busy right now. Found a Lorex system at Costco, new sealed box marked down multiple times as clearance item (last one) 8channel eight 4K cameras $499 I couldn’t pass it up. Installed no issues, so far all is good.

(snip)… It would be great to if the doorbell button that gets pressed is a mechanical button (e.g. spring loaded/buckling spring etc) or if its some sort of stationary, capacitive touch sensor (PCT) of some kind.

After receiving my SD-M5 (KW-05 manufacturer) I can confirm the button is a "mechanical" buckling spring button.

If the SD-M5 if cracked open would is it possible to solder leads directly to the pushbutton contacts. I'm hoping to use it with my existing mechanical doorbell .

Yes... if needed it is possible to isolate the push button contacts on the circuit board if your design requires it however, as it turns out hacking & soldering may not be necessary. Per Knox KW005 specs it states: Works with your 8~ 24V or 100~240V Existing Mechanical bell. Unfortunately I have yet to find any specifics on how to accomplish that unless they mean via the USB chime kit which to me isn't the same as using my exisiting 1980's "mechanical" doorbell.

I'm able to monitor all the Lorex / Dahua cameras at my Lorex NVR... will I be able to monitor the SD-M5 at the NVR?

It's Onvif and offers an RTSP stream and it has been found to work with BlueIris and at least one other Onvif compatible program so chances are it will work with your NVR if that is Onvif too but the only way to be absolutely sure about compatibility is to try it out with your specific NVR.

My plan is to hook this doorbell camera to my Lorex LNR6100 NVR via CAT5e/6 and a Ubiquiti PoE Adapter and just let it record 24/7 like the other cameras in the system. Will a CAT5e/6 POE connection to the doorbell alone carry video back to the NVR or is the ENET port on the doorbell only for power to the camera? (just want to verify WIFI is not required for video)

ANSWER: Yes! As it turns out, the only connection made to the doorbell was the Ethernet cable. It powers the camera as well as carry video feed back to my NVR. I'm currently able to monitor and record all my Lorex / Dahua cameras at the NVR as well as the SD-M5. NOTE: Thanks to feedback from @SecuritySeeker, the Ubiquiti INS-3AF-I-G adapter was indeed needed in my specific application because the doorbell is passive and was not 802.3af/802.3at as required by the Lorex NVR.
Initial Observations:
Upon initial connection/power up of doorbell the tamper alarm activates and sounds off for about 5 seconds or so.
Pressing the doorbell button the doorbell assembly itself emits an audible doorbell tone which gives the visitor an indication that the doorbell works and homeowner has been alerted. Unfortunately I haven't discovered how or if I can get the Lorex NVR to detect the doorbells motion sensor feature as it currently does with the motion sensors in the Lorex cameras. Also... although my particular Lorex NVR allows for two way audio and recording... at this time I can only get the feature to work using their cameras. Beginning to think those particular features won't work due to firmware variations.

… purchased via ebay. Seller accepted my $60 “offer” for the standalone doorbell with Free shipping. BTW...great communication from my specific seller... has sent me several messages both pre and post order .. including a tracking number with an estimated arrival in October (about 20 days but I'm not holding my breath... I won't believe it until I see it.) Will follow up once the shipment arrives.
193052391626 | eBay

Actually took 30 days ... door to door. @johnnyletrois who also ordered via bay received his in 16 days door to door! Tracking shows both shipments were shipped within 2 days of the orders being placed. Even though he’s on the west coast and I’m on the east coast, both were shipped via China EMS e-packet so I can’t account for why mine took almost twice as long to arrive.

... all China sellers currently advertising them on ebay, show an estimated "delivery date" which slips a little each day, now stating: This item has an extended handling time and a delivery estimate greater than 19 business days. Fri. Nov 8 and Fri. Dec. 23

Side note

As far as I could tell from my research it appears the YouSee MD-S5 might actually be a product of: Shenzhen Konx Smart Technology Co. Ltd: Products- - KONX International Limited. In any event, for those interested I uploaded some photos to the Media section of ipcamtalk… showing the unboxing and contents of my ebay purchase as well as an image capture taken with the doorbell (ignore the time stamp) . Was surprised to find the doorbell included a 12 page full color user manual printed entirely in English!

SD-M5 Doorbell (KW05)

ipcamtalk.com

 

[whoami ™]

Going to need some help on this. Hacking with wire and solder isn't my area of expertise...

The button for the doorbell has 4 pins where it connects to the pcb... The top two (which are the bottom two in pic below cuz I'm holding it upside down) have about 2.22 - 2.25 volts +/- going to them. When the button is pressed it closes the circuit for about 30-45 seconds +/- sending power to the bottom two pins (top 2 in pic)... The way a mechanical door bell works it only closes the circuit for as long as the button is held down. So that's a problem. Also the button on the SD-M5 does more than just send the signal for the wireless doorbell. It also triggers the duplex audio & turns on the LED's. I'm also thinking the camera has a converter that's converting AC to DC because the only way I'm getting anything that resembles a reliable reading on voltage is with DC or I cant find a common ground.

 

[silencery]

If you're not as comfortable with solder, try this method instead.

With the doorbell powered on, try pushing the doorbell button and measure the voltage drop. Most traditional doorbells operate by creating a dead short on the wires and the video doorbells seem to emulate this.

If your voltage drops to 0V, that's a good sign. that means you can wire a relay in parallel to your doorbell's power supply (The relay will need to be AC or DC to match your power) to trigger your home automation.

 

[SecuritySeeker]

@whoami ™

If you're not as comfortable with solder, try this method instead.

With the doorbell powered on, try pushing the doorbell button and measure the voltage drop. Most traditional doorbells operate by creating a dead short on the wires and the video doorbells seem to emulate this.

If your voltage drops to 0V, that's a good sign. that means you can wire a relay in parallel to your doorbell's power supply (The relay will need to be AC or DC to match your power) to trigger your home automation.

Even if there were any doorbell wires externally that you could measure (there aren't), the above won't work as I already mentioned:

I don't think that is likely to work, the contacts inside are meant to provide an input to the embedded microcontrollers GPIO pins. You can't just connect a regular doorbell's wire to that in parallel.

If you could connect your doorbell wires to that button in parallel it would almost certainly fry your doorbell.

The external connectors are the RJ45 and the power input which is definitely NOT intented to be connected to a regular doorbell. As far as I can see these are the options available to detect a doorbell press:

1. Isolate the button on the PCB (cut all PCB traces to it) and connect wires to it that extend outside of the doorbell case to measure or connect a regular doorbell to
2. Sniff the 433 MHz connection
3. Sniff the network traffic
4. Hack the USB chime

I think 3 or 4 are probably the easiest to accomplish. If someone can find out what exact protocol the 433MHz uses (the difficult part), detecting a press that way would become relatively easy. The USB chime actually has an LED that lights up so you could in principle detect this optically without even opening the unit. Or you could listen with a microphone to the audible chime and detect it ringing. Or you can open it up and connect some wires to measure the voltage being fed to the LED or something.

 

[SecuritySeeker]

If your voltage drops to 0V, that's a good sign.

It's a pushbutton that shortcuts the voltage applied to the contacts (or vice versa it's shorted by default and opens up when pressed). The voltage will certainly drop to 0V in either of these cases depending on the state of the pushbutton.

that means you can wire a relay in parallel to your doorbell's power supply (The relay will need to be AC or DC to match your power) to trigger your home automation.

No, that does not follow. The voltage applied to those contacts internally is going to be 5V or 3.3.V. A doorbell power supply is going to be higher voltage. The GPIO pins of the microcontoller inside the doorbell may not like that being applied to them and if the voltage is high enough might get fried.

 

[silencery]

Fair points. I don't have the SD-M5, so I can't say either way.

I agree isolating the pushbutton is reliable (the other methods are good too), but I'm offering an alternative method to test for people who don't want to open up the case. It's easy enough to verify while avoiding any destructive modifications. You just measure the voltage on the incoming wires while the doorbell is on and the doorbell button is pushed.

I'm assuming the SD-M5 is designed similarly to both the Dahua DB-11 and the Hikvision/Laview. Both of those accept either AC or DC power. They both emulate the dead short behavior of traditional doorbells, but continue to power the doorbell with the onboard capacitors. I've tested this for both of those doorbells with both AC And DC power (and their respective relays).

Based on the specs from the yoosee site, the SD-M5 is capable of this as well (8-24V AC/ 9-36V DC). Of course, there's no guarantee it will work the same as the other doorbells, but it's worth checking since it's easy to do.

 

[SecuritySeeker]

If it works that way on the Dahua and Hikvions I suppose it might work. I thought you meant checking if the voltage dropped on the PCB but I now understand you actually mean powering it though the AC/DC connector and see if the voltage drops to zero on that connector if you push the button. Of course whatever is powering the device must be capable of handling being short-circuited while the button is pressed.

If that works and since it's passive PoE powering it through the PoE port would probably also work, I wouldn't be entirely surprised if the pins on the RJ45 carrying the power are connected direct to the AC/DC pins.

Another safe test that could be done is to measure the impedance on the AC/DC port, if that drops to zero when pressing the button that's also an indication that this might work.

 

[SecuritySeeker]

Another safe test that could be done is to measure the impedance on the AC/DC port, if that drops to zero when pressing the button that's also an indication that this might work.

I just checked: resistance across the AC/DC power connector terminals does not drop to zero when the doorbell button is pressed so this idea is unlikely to work (unless the terminals are shorted through a relay or something which I find highly unlikely).

 

[Elton Noway]

I just checked: resistance across the AC/DC power connector terminals does not drop to zero when the doorbell button is pressed so this idea is unlikely to work (unless the terminals are shorted through a relay or something which I find highly unlikely).

I also checked for a drop to zero and got the same results. Was getting ready to respond when I saw your reply. Not to confuse the issue, but as mentioned in one of my previous posts... since YouSee is the app creator for this doorbell I believe the YouSee SD-M5 is actually a renamed KW-05 as made by KONX Electronics LLC but marketed my YouSee.

In any event, per KNOX LLC, the KW-05 works "with" your existing mechanical doorbell, however I have been unable to find any reference or documentation as how to acheive this.
Also... unlike advertisement for the SD-M5 ... some ad for the KNOX KW05 show a "Power Regulator" as an optional accessory. I can't help but wonder "if" it's a requirement for connecting a mechanical bell. In the meantime... I sent an email to KNOX LLC asking for clarification on how to accomplish the mecanical doorbell connection.

1080p Hd Poe Motion Detection Video Doorbell Kw05 Konx Wifi Video Door Bell - Buy Wifi Doorbell,Yoosee Doorbell,Video Door Bell Product on Alibaba.com

1080p Hd Poe Motion Detection Video Doorbell Kw05 Konx Wifi Video Door Bell , Find Complete Details about 1080p Hd Poe Motion Detection Video Doorbell Kw05 Konx Wifi Video Door Bell,Wifi Doorbell,Yoosee Doorbell,Video Door Bell from Smart Security Devices Supplier or Manufacturer-Shenzhen Konx...

www.alibaba.com