Experiment report on the Wireless Internet Camera TV-IP200W (TRENDnet)

Jean-Patrick Gelas <jpgelas@ens-lyon.fr> (January 2006)

Update (April 2006) : Params control with http POST.

DRAFT: This page will be used for sharing my experience of the Wireless Internet Camera TV-IP200W from TRENDnet.

Picture of the tv-ip200w

My goal was to obtain far more information about this internet camera than those available in the poor documentation shipped with the camera. I wished to know all the possibilities of this camera and exploit them as much as possible. Unfortunately, despite the hours I spent Googling the web for few hints about this camera, I found nothing. It was a awful waste of time. So, I decided to roll up my sleeves and find information by myself. I hope these information will be useful for readers of this page and maybe help them to go further (please, let me know).

Network access: nmap

To know a little bit more about camera network access I tried to run the nmap scanner on the IP where the camera is available. I obtain port 80 and 21 open. With the -O option nmap run an OS detection and returns D-Link DCS-1000 webcam with firmware 1.06.

jp@kiss:~$ nmap -O

Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2006-01-30 22:21 EST
Interesting ports on
(The 1658 ports scanned but not shown below are in state: closed)
21/tcp open  ftp
80/tcp open  http

Device type: webcam
Running: D-Link embedded
OS details: D-Link DCS-1000 webcam with firmware 1.06

Nmap run completed -- 1 IP address (1 host up) scanned in 3.793 seconds

FTP access

You can access the camera through a standard ftp session. If you logged with the admin login and password you can access 3 files.

jp@kiss:~$ ftp
Connected to
220 FTP server ready.
Name ( 
331 User name ok, need password.
230 User admin logged in.
ftp> dir
200 OK.
150 Opening data connection.
226 Transfer complete.
Notice: if you logged as a simple user, you will access to the image.jpg file only.

I tried to access the camera's ftp server through telnet. I achieved to issue the following commands. USER, PASS, TYPE I, PORT, STOR (but file not found error), PWD, and QUIT.

More and more...

Next, I downloaded the firmware available on the TRENDnet web site, unzipped it and use the strings tool to print the strings of printable characters in this file. That was quite interesting. For example I discover the string "D-Link DE-970" !?! :-) But I also found the name of some very promising files.

Params control with http POST method

This section shows how to set some parameters remotely without using the point and click web interface. When you do a simple http request from a browser like shown in the previous section with http://webcamaddress/IOCONTROL.CGI, it just dumps back the current settings. It's because you use a simple http GET request. However, when you do the same with a http POST (e.g. in software or from a java applet) you can control those params. The following example shows how to turn on and off the FTP upload service with the --post-data option of the wget command (Note: you must first configure the upload service in the System Administration -> Upload menu of your internet camera).

This method is applicable to Trigger1 and Trigger2.


The info available in the section "Params control with http POST method" are provided by a nice a guy on internet. Thanks C.!