| By Simon,
on 17-03-2007 15:31
|
Views : 10812  |
Favoured : 171 |
Published in : The Blog, HW news |
A long time ago, in a galaxy far, far away, out of frustration of not being able to use IP cams behind firewalls, I poked around the firmware of several IP cams, including the TrendNet TV-IP400W pan and tilt camera. I'll summarize here some of the things I found. I'll also update this as I discover new ways of making this type of a camera tick.
Hardware specs:- LAN Connector : One RJ-45 port, 10/100M auto sensed, AutoMDIX
- Wireless LAN : Built-in 802.11g wireless LAN
- Communication protocol : HTTP, FTP, TCP/IP, UDP, ARP, ICMP, BOOTP, DHCP, PPPoE, DDNS, UPnP
- CPU : RDC R2880
- RAM : 8MB
- Flash ROM : 2MB
- OS : RTOS
- Power Supply : DC 5V 2.5A, switching type
- Power consumption : 8Watt (1600mA x 5V)
- LED Indicator : Power LED (Blue) Link LED (Orange)
- Pan/Tilt : Pan -170�~ +170� Tilt +45 ~ -90�
What the camera runs:
Server: Camera Web Server/1.0
Auther: Steven Wu
What we want to do:
There is a lot of functionality in PANTILTCONTROL.CGI which is what we will explore to allow us to traverse firewalls as regular HTTP traffic.
Moving the camera:
To pan/tilt the camera by a certail "degree", we use PANTILTCONTROL.CGI with the following parameters set
- PanSingleMoveDegree
- TiltSingleMoveDegree
- PanTiltSingleMove
where PanTiltSingleMove=X is set to one of the following types signifying the direction of motion:
0 1 2
3 4 5
6 7 8
If PanTiltSingleMove is 0, 2, 6, or 8 the camera moves diagonally by the "degrees" specified.
Range of Motion:
Here is the horizontal and vertical range of "degrees" or steps as displayed by the ActiveX and/or Java applet (camera being with the base down). Basically, this is the range of motion for the camera.
Left
| Middle
| Right
| H,V
| H,V
| H,V
| 0,114
| 157,114
| 312,114
| 0,46
| 157,46
| 312,46
| 0,0
| 157,0
| 312,0
|
Favourite (or pre-set) Locations:
To swing the camera to a favourite location, we use PANTILTCONTROL.CGI with the following parameters
- PanTiltPresetPositionMove
where PanTiltPresetPositionMove=X is set to the number (0-24) associated with our pre-set position
To save a pre-set location, we must POST to PANTILTCONTROL.CGI with the following parameters
- PanTiltHorizontal
- PanTiltVertical
- SetName
- SetPosition
Of course the problem is that there seems to be no way or retrieving the current position outside of parsing the current MJPG stream. The camera's web page uses GetHorizontalPosition and GetVerticalPosition methods of the ActiveX or Java applet ..
uPNP:
The camera also broadcasts uPNP packets on port 1900 and listens on port 8712
http://IP.of.camera:8712/rootdesc.xml and advertises itself as a Cellvision UPnP/1.0 server
Device description looks as follows :
<root>
<specVersion>
<major>1</major>
<minor>0</minor>
</specVersion>
<URLBase>http://1.2.3.4:8712</URLBase>
<device>
<deviceType>urn:schemas-upnp-org:device:Basic:1.0</deviceType> <friendlyName>Camera Server CS-8AA22C</friendlyName> <manufacturer>TRENDnet</manufacturer> <manufacturerURL>http://www.trendnet.com</manufacturerURL> <modelDescription>Wireless IP Camera</modelDescription> <modelName>TV-IP400W</modelName> <modelNumber>3.17 (2006-02-23)</modelNumber> <modelURL>http://www.trendnet.com</modelURL> <UDN>uuid:0011188AA22C-0</UDN> <UPC/> <serviceList> <service>
<serviceType>urn:cellvision:service:Null:1</serviceType>
<serviceId>urn:cellvision:serviceId:RootNull</serviceId>
<SCPDURL>/rootService.xml</SCPDURL>
<controlURL>/rootControl</controlURL>
<eventSubURL>/rootEvent</eventSubURL>
</service>
</serviceList> <presentationURL>http://1.2.3.4</presentationURL>
</root>
|
Show current picture:
Display Camera picture: http://1.2.3.4/IMAGE.JPG
Show current MJPEG stream:
Display video stream: http://1.2.3.4/VIDEO.CGI or http://1.2.3.4/MJPEG.CGI (both are not the same thing. For some cameras one works better than the other. Try both.) The video stream is an MJPEG stream that can be viewed by installing a plugin for IE or with Firefox's internal decoder.
Filenames found in firmware:
List of files included in the 3.17 firmware
HOME.HTM
TOP.HTM
IMODE.HTM
AVIEW.HTM
JVIEW.HTM
TITLE.HTM
CONTENT.HTM
CONTNT11.HTM
CONTNT12.HTM
CONTNT13.HTM
CONTNT14.HTM
CONTNT15.HTM
CONTNT21.HTM
CONTNT22.HTM
CONTNT23.HTM
CONTNT24.HTM
CONTNT25.HTM
CONTNT26.HTM
CONTNT27.HTM
CONTNT28.HTM
CONTNT30.HTM
CONTNT31.HTM
CONTNT32.HTM
CONTNT33.HTM
CONTNT34.HTM
CONTNT35.HTM
CONTNT41.HTM
INDEX11.HTM
INDEX12.HTM
INDEX13.HTM
INDEX14.HTM
INDEX15.HTM
INDEX21.HTM
INDEX22.HTM
INDEX23.HTM
INDEX24.HTM
INDEX25.HTM
INDEX26.HTM
INDEX27.HTM
INDEX28.HTM
INDEX30.HTM
INDEX31.HTM
INDEX32.HTM
INDEX33.HTM
INDEX34.HTM
INDEX35.HTM
INDEX41.HTM
REPLYK.HTM
REPLYU.HTM
REPLY.HTM
STSUSER.HTM
STSSYS.HTM
STSNET.HTM
STSWLAN.HTM
STSVDO.HTM
BACKUP.HTM
FTPTEST.HTM
EMTEST.HTM
FACTORY.HTM
RESET
ABOUT.HTM
MOTORDRV.HTM
DLOADBAR.GIF
LOGO.JPG
ETITLE.JPG
XPLUG.CLASS
XPLUG$SI.CLASS
SYSTEM.CGI
IMAGE.CGI
WIRELESS.CGI
NETWORK.CGI
USER.CGI
USERLIST.CGI
DATETIME.CGI
UPLOAD.CGI
EMAIL.CGI
PANTILT.CGI
ISYSTEM.CGI
IIMAGE.CGI
IWLAN.CGI
INETWORK.CGI
IUSER.CGI
CGIVER.CGI
MVIEW2.JAR
MVIEW2.JAD
I haven't checked them all out, but most seems to be identical to what Pauldy found in his hacking around. Note that PANTILTCONTROL.CGI is not there, it therefore must be an alias to one of the other CGIs (likely PANTILT.CGI)
Other interesting info in the firmware
Parent device?
Intersil ARM WLAN Firmware
Similar cameras:The TV-IP400W appears to be a twin sister of Sparklan CAS-370W and NeuFusion NCS-370W (Google cache)
Projects:RoboCam - Control IP cameras using PHP
Peter Hulst's Ruby driver for the TV-IP400 - ip400.rb - Control using Ruby
my ip400w-http effort - Control via HTML
Wikis:
There is a superb and very descriptive WIKI for RoboCam PHP script meant to deal specifically with this family of cameras. Highly recommended even if you don't speak German.
I've also started a wiki for the ip400w-http project (mostly update of information from this page)
User Manuals:TV-IP400W user manual
CAS-370 user manual
FirmwareTV-IP400W firmware v3.17
CAS-370 firmware v3.12
update: new firmware v3.30 released September 2007
TV-IP400W firmware v3.30
update: new firware v3.33 released Dec 20, 2007
TV-IP400W firmware v3.33
CAS-370 firmware v3.33
update: new firware v3.36 released Feb 8, 2008
TV-IP400W firmware v3.36
TV-IP400 firmware v3.36
Todo:
- pictures
- real-life example HTML
URLs:
http://www.timespace.org/content/view/43/2/1/1/
http://www.trendnet.com/asp/download_manager/list_subcategory.asp?SUBTYPE_ID=752
http://www.sparklan.com/product_details.php?prod_id=125
http://perso.ens-lyon.fr/jean-patrick.gelas/webcam/webcam-trendnet-tv-ip200w.html
Wiki for RoboCam
Peter Hulst's effort to document and write a Ruby driver for the TV-IP400 - ip400.rb
Last update : 16-05-2008 00:15
|
|
|
Help
By: Paul (Guest) on 22-08-2010 18:28