Experiment report on the Wireless Internet Camera TV-IP200W (TRENDnet)

Jean-Patrick Gelas <jpgelas@ens-lyon.fr> (January 2006)

Update (April 2006) : Params control with http POST.

DRAFT: This page will be used for sharing my experience of the Wireless Internet Camera TV-IP200W from TRENDnet.

Picture of the tv-ip200w

My goal was to obtain far more information about this internet camera than those available in the poor documentation shipped with the camera. I wished to know all the possibilities of this camera and exploit them as much as possible. Unfortunately, despite the hours I spent Googling the web for few hints about this camera, I found nothing. It was a awful waste of time. So, I decided to roll up my sleeves and find information by myself. I hope these information will be useful for readers of this page and maybe help them to go further (please, let me know).

Network access: nmap

To know a little bit more about camera network access I tried to run the nmap scanner on the IP where the camera is available. I obtain port 80 and 21 open. With the -O option nmap run an OS detection and returns D-Link DCS-1000 webcam with firmware 1.06.

jp@kiss:~$ nmap -O 192.168.1.20

Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2006-01-30 22:21 EST
Interesting ports on 192.168.1.20:
(The 1658 ports scanned but not shown below are in state: closed)
PORT   STATE SERVICE
21/tcp open  ftp
80/tcp open  http

Device type: webcam
Running: D-Link embedded
OS details: D-Link DCS-1000 webcam with firmware 1.06

Nmap run completed -- 1 IP address (1 host up) scanned in 3.793 seconds

FTP access

You can access the camera through a standard ftp session. If you logged with the admin login and password you can access 3 files.

jp@kiss:~$ ftp 192.168.1.20
Connected to 192.168.1.20.
220 FTP server ready.
Name (192.168.1.20:jp): 
331 User name ok, need password.
Password:
230 User admin logged in.
ftp> dir
200 OK.
150 Opening data connection.
DEVICEID.DAT
IMAGE.JPG
CONFIG.DAT
226 Transfer complete.

• DEVICEID.DAT: contains the ascii strings "Vendor: Cellvision" and "Device: CAS-200"
• IMAGE.JPG: contains the last frame grabbed by the camera if you get it.
• CONFIG.DAT: contains the complete configuration of the camera (name, location, login, password, ip address,...)

I tried to access the camera's ftp server through telnet. I achieved to issue the following commands. USER, PASS, TYPE I, PORT, STOR (but file not found error), PWD, and QUIT.

More and more...

Next, I downloaded the firmware available on the TRENDnet web site, unzipped it and use the strings tool to print the strings of printable characters in this file. That was quite interesting. For example I discover the string "D-Link DE-970" !?! :-) But I also found the name of some very promising files.

• picture.html and image.jpg allow to grab a frame (usage: http://webcamaddress/picture.html or http://webcamaddress/image.jpg) you can use both equally, the result is the same.
• iocontrol.cgi: returns "Trigger1=0&Trigger2=0&ImageUpload=0&CurrentTime=2004-01-01 00:33:03" but can be called with the parameter name CGIQuaere and the following value
  • Datetime: returns "Date_manual=2004-1-1&Time_manual=0:32:20".
  • Reset
  • Factory
  • Image: returns "Video_Mode=2&Compress=2&Frame_Rate=0&Bright_cntl=64&Contrast_cntl=64&Hue_cntl=64&Light_Freq=0".
  Usage example: http://webcamaddress/IOCONTROL.CGI?CGIQUaere=Datetime
• devinfo.cgi: returns a binary file (about 250 bytes)
• config.cgi: returns a binary file. The file command returns "Applesoft BASIC program data" ???. With the strings command we obtain name, location, logins and password,...
• video.cgi: can be used to display video in a browser supporting multipart content (usage: <img src="http://webcamaddress/video.cgi"/>). To determine the boundary sequence for processing applications you can use wget (wget -S http://webcamaddress/video.cgi --http-user=toto --http-passwd=xxxx)

Params control with http POST method

This section shows how to set some parameters remotely without using the point and click web interface. When you do a simple http request from a browser like shown in the previous section with http://webcamaddress/IOCONTROL.CGI, it just dumps back the current settings. It's because you use a simple http GET request. However, when you do the same with a http POST (e.g. in software or from a java applet) you can control those params. The following example shows how to turn on and off the FTP upload service with the --post-data option of the wget command (Note: you must first configure the upload service in the System Administration -> Upload menu of your internet camera).

• Start the FTP upload service: wget --post-data='ImageUpload=0' http://webcamaddress/IOCONTROL.CGI -O /dev/null --quiet
• Stop the FTP upload service: wget --post-data='ImageUpload=1' http://webcamaddress/IOCONTROL.CGI -O /dev/null --quiet

Acknowledgements

The info available in the section "Params control with http POST method" are provided by a nice a guy on internet. Thanks C.!