Open LadislavMargai opened 2 years ago
First I'm assuming that you put your actual uuid in there and not {cameraUID}
. The camera is failing to find the IP address from the UUID. Go is the cellular one yes? I believe we recently had someone report that the IP address look up fails for the cellular cameras. I looked into their logs and discovered that the IP address message received from the server is slightly altered from what we expect. That is why it fails. It won't work until someone has the time to fix it.
First I'm assuming that you put your actual uuid in there and not
{cameraUID}
. The camera is failing to find the IP address from the UUID. Go is the cellular one yes? I believe we recently had someone report that the IP address look up fails for the cellular cameras. I looked into their logs and discovered that the IP address message received from the server is slightly altered from what we expect. That is why it fails. It won't work until someone has the time to fix it.
Correct - @LadislavMargai see #95 for more detail on battery/cellular cams. My thought is to hardcode the ip/port with that of the value returned by the relay in dmap to see if it works - just haven't had time to reason through it yet.
@PrplHaz4 So I went ahead and made the changes for it to try this dmap
key in the xml. It is currently building here Maybe once it is done you could try it out
First I'm assuming that you put your actual uuid in there and not
{cameraUID}
. The camera is failing to find the IP address from the UUID. Go is the cellular one yes? I believe we recently had someone report that the IP address look up fails for the cellular cameras. I looked into their logs and discovered that the IP address message received from the server is slightly altered from what we expect. That is why it fails. It won't work until someone has the time to fix it.
Yes, it is a cellular one and the strings in the curly brackets are just placeholders replaced by actual values.
@PrplHaz4 So I went ahead and made the changes for it to try this
dmap
key in the xml. It is currently building here Maybe once it is done you could try it out
I've just downloaded and tested the windows 2019 artifact from this build, however, the result is the same:
Error: Failed to connect to camera driveway at UID: {cameraUID} on channel 0
May I send you via PM my Reolink Camera UID
for easier troubleshooting and debugging?
Thanks.
@PrplHaz4 So I went ahead and made the changes for it to try this
dmap
key in the xml. It is currently building here Maybe once it is done you could try it out
@QuantumEntangledAndy Amazing turnaround - thanks for looking at it! Here are my updated debug logs...
So at this point it seems to be replying with a new xml R2C_C_R
. This has the keys dmap and relay. I could try forwarding the connection to the relay
but I would just be trying random stuff. The best thing to do now would be to one of these camera with an official client and observe the official communications.
So at this point it seems to be replying with a new xml
R2C_C_R
. This has the keys dmap and relay. I could try forwarding the connection to therelay
but I would just be trying random stuff. The best thing to do now would be to one of these camera with an official client and observe the official communications.
Sorry for the delay, I've been away. I just sent a pcap to you via email if you're still interested in looking at it. Thanks again for all the attention already - interesting to see how it comes together...
First I'm assuming that you put your actual uuid in there and not
{cameraUID}
. The camera is failing to find the IP address from the UUID. Go is the cellular one yes? I believe we recently had someone report that the IP address look up fails for the cellular cameras. I looked into their logs and discovered that the IP address message received from the server is slightly altered from what we expect. That is why it fails. It won't work until someone has the time to fix it.
Hi! Is there both a UID and an UUID?
First I'm assuming that you put your actual uuid in there and not
{cameraUID}
. The camera is failing to find the IP address from the UUID. Go is the cellular one yes? I believe we recently had someone report that the IP address look up fails for the cellular cameras. I looked into their logs and discovered that the IP address message received from the server is slightly altered from what we expect. That is why it fails. It won't work until someone has the time to fix it.Hi! Is there both a UID and an UUID?
No they are one and the same - the UUID is usually on the camera's label or can be retrieved from the ReoLink app.
Hi everyone, I'm also trying to use neolink with a Reolink Go PT and would like to know if any progress could be made on the issue ? Thank you very much !
@QuantumEntangledAndy - if there is any interest to test and observe the comms with a 4G camera, lmk what you would like us to test and we can work on a fix for these 4G cams.
@hblanken
Interest sure, time not so much. Too many life things to do at the moment. If you can work with wireshark and have the energy/time to work out the protocol that would make it a lot easier for me to program it up. I have documented some protocols in dissector/
that might be helpful to get a start on what we currently know about the protocol.
What I would ideally like to start would be a list of what messages the client send and what the client recieves in reply. E.g. client->reolink send C2D_S
xml
reolink->client receives D2C_S
xml
I think these are the xml messages up to the stream starting, after a relay server is selected...I can email the full .pcap file if you're interested in digging deeper...I'd just rather not post it with creds here. LMK if there's a better way to see it...
Everything starting with C is coming from me (so i'm decoding those as "Client to"), everything coming from the relay IP (52.249.249.90) i've labeled either Relay or Device to Client based on message name...
C2R_C (Client to Relay?)
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<C2R_C>
<uid>
REDACTED
</uid>
<cli>
<ip>
192.168.2.155
</ip>
<port>
23561
</port>
</cli>
<relay>
<ip>
52.249.249.90
</ip>
<port>
58100
</port>
</relay>
<cid>
561000
</cid>
<debug>
251658240
</debug>
<family>
4
</family>
<p>
WIN
</p>
<r>
3
</r>
</C2R_C>
</P2P>
R2C_T (Relay to Client)
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<R2C_T>
<dmap>
<ip>
172.58.63.72
</ip>
<port>
27100
</port>
</dmap>
<sid>
127536491
</sid>
<cid>
561000
</cid>
<rsp>
0
</rsp>
</R2C_T>
</P2P>
C2R_C (Client to Relay)
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<C2R_C>
<uid>
REDACTED
</uid>
<cli>
<ip>
192.168.2.155
</ip>
<port>
23561
</port>
</cli>
<relay>
<ip>
52.249.249.90
</ip>
<port>
58100
</port>
</relay>
<cid>
561000
</cid>
<debug>
251658240
</debug>
<family>
4
</family>
<p>
WIN
</p>
<r>
3
</r>
</C2R_C>
</P2P>
R2C_C_R (Relay to Client Response?
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<R2C_C_R>
<dmap>
<ip>
172.58.63.72
</ip>
<port>
27100
</port>
</dmap>
<relay>
<ip>
52.249.249.90
</ip>
<port>
51616
</port>
</relay>
<nat>
NULL
</nat>
<sid>
127536491
</sid>
<rsp>
0
</rsp>
<ac>
127536491
</ac>
</R2C_C_R>
</P2P>
C2D_T (Client to Device via Relay maybe?)
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<C2D_T>
<sid>
127536491
</sid>
<conn>
relay
</conn>
<cid>
561000
</cid>
<mtu>
1350
</mtu>
</C2D_T>
</P2P>
D2C_CFM (Device to Client?)
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<D2C_CFM>
<sid>
127536491
</sid>
<conn>
relay
</conn>
<rsp>
0
</rsp>
<cid>
561000
</cid>
<did>
704
</did>
<time_r>
0
</time_r>
</D2C_CFM>
</P2P>
C2R_CFM (Client to Relay?)
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<C2R_CFM>
<sid>
127536491
</sid>
<conn>
relay
</conn>
<rsp>
0
</rsp>
<cid>
561000
</cid>
<did>
704
</did>
</C2R_CFM>
</P2P>
Relay to Client Login Nonce
Baichuan Message Body, modern, length: 158, type 1
Meta Payload
Decrypted XML (in Meta Payload)
eXtensible Markup Language
<?xml
<body>
<Encryption
version="1.1">
<type>
md5
</type>
<nonce>
62e151d3-iPzjETVuU7qTXz4Jfwrk
</nonce>
</Encryption>
</body>
Client to Relay Login User/PW
Baichuan IP Camera Protocol, login:1 message
Baichuan Message Header, length: 24, type 1
magic: 180150000
messageId: 1 (login)
messageLen: 296
xmlEncryptionOffset: 0 (& 0xF == 0)
channel_id: 0
streamID: 0 HD (Clear)
unknown: 0
messageHandle: 0
messageClass: 25620 (modern)
status_code: 0
binOffset: 0
Baichuan Message Body, modern, length: 296, type 1
Main Payload
Decrypted XML (in Main Payload)
eXtensible Markup Language
<?xml
<body>
<LoginUser
version="1.1">
<userName>
REDACTED
</userName>
<password>
REDACTED
</password>
<userVer>
1
</userVer>
</LoginUser>
<LoginNet
version="1.1">
<type>
LAN
</type>
<udpPort>
0
</udpPort>
</LoginNet>
</body>
R2C_T (Relay to Client?)
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<R2C_T>
<dmap>
<ip>
172.58.63.72
</ip>
<port>
27100
</port>
</dmap>
<sid>
127536491
</sid>
<cid>
561000
</cid>
<rsp>
0
</rsp>
</R2C_T>
</P2P>
D2C_T (Device to Client?)
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<D2C_T>
<sid>
127536491
</sid>
<conn>
relay
</conn>
<cid>
561000
</cid>
<did>
704
</did>
</D2C_T>
</P2P>
R2C_C_R (Relay to Client Response?)
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<R2C_C_R>
<dmap>
<ip>
172.58.63.72
</ip>
<port>
27100
</port>
</dmap>
<relay>
<ip>
52.249.249.90
</ip>
<port>
51616
</port>
</relay>
<nat>
NULL
</nat>
<sid>
127536491
</sid>
<rsp>
0
</rsp>
<ac>
127536491
</ac>
</R2C_C_R>
</P2P>
D2C_CFM (Device via Relay to Client?)
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<D2C_CFM>
<sid>
127536491
</sid>
<conn>
relay
</conn>
<rsp>
0
</rsp>
<cid>
561000
</cid>
<did>
704
</did>
<time_r>
0
</time_r>
</D2C_CFM>
</P2P>
C2R_CFM (Client to Relay?)
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<C2R_CFM>
<sid>
127536491
</sid>
<conn>
relay
</conn>
<rsp>
0
</rsp>
<cid>
561000
</cid>
<did>
704
</did>
</C2R_CFM>
</P2P>
Relay to Client Login Response
Baichuan IP Camera Protocol, login:1 message
Baichuan Message Header, length: 24, type 1
magic: 180150000
messageId: 1 (login)
messageLen: 2271
xmlEncryptionOffset: 0 (& 0xF == 0)
channel_id: 0
streamID: 0 HD (Clear)
unknown: 0
messageHandle: 0
messageClass: 0 (modern)
status_code: 200
binOffset: 0
Baichuan Message Body, modern, length: 2271, type 1
Main Payload
Decrypted XML (in Main Payload)
eXtensible Markup Language
<?xml
<body>
<DeviceInfo
version="1.1">
<firmVersion>
00000000000000
</firmVersion>
<IOInputPortNum>
0
</IOInputPortNum>
<IOOutputPortNum>
0
</IOOutputPortNum>
<diskNum>
1
</diskNum>
<type>
ipc
</type>
<channelNum>
1
</channelNum>
<audioNum>
1
</audioNum>
<ipChannel>
0
</ipChannel>
<analogChnNum>
1
</analogChnNum>
<resolution>
<resolutionName>
1080P
</resolutionName>
<width>
1920
</width>
<height>
1080
</height>
</resolution>
<language>
English
</language>
<sdCard>
1
</sdCard>
<ptzMode>
ptz
</ptzMode>
<typeInfo>
IPC
</typeInfo>
<softVer>
33645056
</softVer>
<hardVer>
0
</hardVer>
<panelVer>
0
</panelVer>
<hdChannel1>
0
</hdChannel1>
<hdChannel2>
0
</hdChannel2>
<hdChannel3>
0
</hdChannel3>
<hdChannel4>
0
</hdChannel4>
<norm>
NTSC
</norm>
<osdFormat>
YMD
</osdFormat>
<B485>
0
</B485>
<supportAutoUpdate>
1
</supportAutoUpdate>
<userVer>
1
</userVer>
<secretCode>
REDACTED
</secretCode>
<authMode>
0
</authMode>
</DeviceInfo>
<StreamInfoList
version="1.1">
<StreamInfo>
<channelBits>
1
</channelBits>
<encodeTable>
<type>
mainStream
</type>
<resolution>
<width>
1920
</width>
<height>
1080
</height>
</resolution>
<defaultFramerate>
15
</defaultFramerate>
<defaultBitrate>
1536
</defaultBitrate>
<framerateTable>
15,10,5,2
</framerateTable>
<bitrateTable>
256,512,768,1024,1536,2048
</bitrateTable>
</encodeTable>
<encodeTable>
<type>
subStream
</type>
<resolution>
<width>
640
</width>
<height>
360
</height>
</resolution>
<defaultFramerate>
5
</defaultFramerate>
<defaultBitrate>
160
</defaultBitrate>
<framerateTable>
15,10,5,2
</framerateTable>
<bitrateTable>
64,128,160,192,256,384,512
</bitrateTable>
</encodeTable>
</StreamInfo>
<StreamInfo>
<channelBits>
1
</channelBits>
<encodeTable>
<type>
mainStream
</type>
<resolution>
<width>
1280
</width>
<height>
720
</height>
</resolution>
<defaultFramerate>
15
</defaultFramerate>
<defaultBitrate>
1536
</defaultBitrate>
<framerateTable>
15,10,5,2
</framerateTable>
<bitrateTable>
256,512,768,1024,1536,2048
</bitrateTable>
</encodeTable>
<encodeTable>
<type>
subStream
</type>
<resolution>
<width>
640
</width>
<height>
360
</height>
</resolution>
<defaultFramerate>
5
</defaultFramerate>
<defaultBitrate>
160
</defaultBitrate>
<framerateTable>
15,10,5,2
</framerateTable>
<bitrateTable>
64,128,160,192,256,384,512
</bitrateTable>
</encodeTable>
</StreamInfo>
</StreamInfoList>
</body>
Un-decoded UDP Message
Baichuan UDP Header, length: 20, type 16
udp_magic: 713543440
udp_type: 16
udp_connection_id: 561000
udp_unknown: 0
udp_packet_count: 2
udp_size: 965
Client to Relay (A bunch of "Ability" and unknown messages...)
Baichuan IP Camera Protocol, <AbilityInfo>:151 message
Baichuan Message Header, length: 24, type 151
magic: 180150000
messageId: 151 (<AbilityInfo>)
messageLen: 166
xmlEncryptionOffset: 1 (& 0xF == 1)
channel_id: 1
streamID: 0 HD (Clear)
unknown: 0
messageHandle: 0
messageClass: 25620 (modern)
status_code: 0
binOffset: 166
Baichuan Message Body, modern, length: 166, type 151
Meta Payload
Binary (in Meta Payload)
Baichuan IP Camera Protocol, unknown:192 message
Baichuan Message Header, length: 24, type 192
magic: 180150000
messageId: 192 (unknown)
messageLen: 0
xmlEncryptionOffset: 4 (& 0xF == 4)
channel_id: 4
streamID: 0 HD (Clear)
unknown: 0
messageHandle: 0
messageClass: 25620 (modern)
status_code: 0
binOffset: 0
Relay to Client (VideoInput then unknown payloads)
Baichuan IP Camera Protocol, <VideoInput> (IPC desc):78 message
Baichuan Message Header, length: 24, type 78
magic: 180150000
messageId: 78 (<VideoInput> (IPC desc))
messageLen: 211
xmlEncryptionOffset: 56 (& 0xF == 8)
channel_id: 56
streamID: 56 HD (Clear)
unknown: 52
messageHandle: 48
messageClass: 0 (modern)
status_code: 200
binOffset: 0
Baichuan Message Body, modern, length: 211, type 78
Main Payload
Binary (in Main Payload)
Baichuan IP Camera Protocol, unknown:255 message
Baichuan Message Header, length: 24, type 255
magic: 180150000
messageId: 255 (unknown)
messageLen: 282
xmlEncryptionOffset: 0 (& 0xF == 0)
channel_id: 0
streamID: 0 HD (Clear)
unknown: 0
messageHandle: 0
messageClass: 0 (modern)
status_code: 200
binOffset: 0
Baichuan Message Body, modern, length: 282, type 255
Main Payload
Binary (in Main Payload)
Baichuan IP Camera Protocol, unknown:252 message
Baichuan Message Header, length: 24, type 252
magic: 180150000
messageId: 252 (unknown)
messageLen: 537
xmlEncryptionOffset: 0 (& 0xF == 0)
channel_id: 0
streamID: 0 HD (Clear)
unknown: 0
messageHandle: 0
messageClass: 0 (modern)
status_code: 200
binOffset: 0
Baichuan Message Body, modern, length: 537, type 252
Main Payload
Binary (in Main Payload)
Thanks that's quite helpful, could you add some to/from ip data aswell I'd like to confirm the ips that the data is being sent/from are. Which ones go to the relay and which one to the registers etc
Thanks that's quite helpful, could you add some to/from ip data aswell I'd like to confirm the ips that the data is being sent/from are. Which ones go to the relay and which one to the registers etc
All of these network messages are from client (192.168.2.155) to relay (52.249.249.90) or vice versa
There should be a bit about connecting to the registers to learn which relay is used. It is usually negotiated over port 9999. Do you have anything about that in your logs. Depending on your wireshark dissector it may not show up as a BC packet
There should be a bit about connecting to the registers to learn which relay is used. It is usually negotiated over port 9999. Do you have anything about that in your logs. Depending on your wireshark dissector it may not show up as a BC packet
I'm using the dissector from master, and these show as BAICHUAN UDP HEARTBEAT protocol. Here's what the 9999 conversations look like. The client seems to try every register until it gets a successful response.
192.168.2.155 is my client where the Reolink app is running.
C2M_Q Request to Registers:
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<C2M_Q>
<uid>
REDACTED
</uid>
<ver>
3
</ver>
<p>
WIN
</p>
</C2M_Q>
</P2P>
M2C_Q_R Unsuccessful Response
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<M2C_Q_R>
<devinfo>
<type/>
<mac/>
<bat>
0
</bat>
<qr>
0
</qr>
</devinfo>
<rsp>
-3
</rsp>
</M2C_Q_R>
</P2P>
M2C_Q_R Successful Response
Baichuan/Reolink IP Camera Protocol UDP Message Data
eXtensible Markup Language
<P2P>
<M2C_Q_R>
<reg>
<ip>
52.249.249.90
</ip>
<port>
58200
</port>
</reg>
<relay>
<ip>
52.249.249.90
</ip>
<port>
58100
</port>
</relay>
<log>
<ip>
52.249.249.90
</ip>
<port>
57850
</port>
</log>
<t>
<ip>
52.249.249.90
</ip>
<port>
9996
</port>
</t>
<timer>
<def>
3000
</def>
<hbt>
240000
</hbt>
<cl>
3000
</cl>
<cp>
15000
</cp>
<cr>
2000
</cr>
<ct>
5000
</ct>
<itvl>
1000
</itvl>
<nat>
2000
</nat>
<hb>
20000
</hb>
</timer>
<retry>
<def>
3
</def>
<hbt>
1
</hbt>
<cl>
4
</cl>
<cp>
15
</cp>
<cr>
3
</cr>
<ct>
1
</ct>
<nat>
3
</nat>
<hb>
1
</hb>
<upg>
1
</upg>
</retry>
<mtu>
1350
</mtu>
<debug>
251658240
</debug>
<ac>
-1700607721
</ac>
<rsp>
0
</rsp>
</M2C_Q_R>
</P2P>
Thank you very much it seems to be the same as the discovery method at the beginning but with a slightly different handshake at the end. I think there's maybe a signal to pass off to the relay rather than swapping to local comms. I'll try and work this up when I can in my fork and then get back to you all.
For anyone following, Andy's updated fork now supports discovery for Cellular cameras (and a ton of new features and fixes): https://github.com/QuantumEntangledAndy/neolink#cellular
Sorry forgot the whole getting back thing. But yes cellular is working. Use discovery = "cellular"
in the [[cameras]]
config
Describe the bug I am trying to turn off the PIR sensor on my Reolink camera. However, it ends with the following error every time:
Error: Failed to connect to camera driveway at UID: {cameraUID} on channel 0
To Reproduce
sample_config.toml
which will contain> neolink --config sample_config.toml pir driveway off
Actual behavior The command ends with an error:
Expected behavior The PIR sensor would be turned off
Versions NVR software: n/a OS: Ubuntu 22.04 (VM) & Win10 (both the same result) Neolink software:
release-ubuntu-18.04
&release-windows-2019
Reolink camera model and firmware: Reolink GO, firmware v.1.0.213.00Any ideas?