ip cameras

Service Summary: The DrHeck Camera Hub (https://cam.drheck.dev) provides automatic LAN discovery, low-latency live video and MP3 audio streaming, two-way RTSP ONVIF backchannel voice talk, YOLOv8n + hardware AI event capture with a web-viewable timeline and text metadata log, optical zoom/spotlight/siren3D hardwareclick-to-zoom and optional auto-zoom on moving objects, smart floodlight/IR/LED controls, privacy sleep mode, bandwidth adaptation, and a sideloadable Google TV interface for the Reolink PoE IP cameras on 10.0.0.0/24. Access is restricted via Authentik ForwardAuth to members of the camera_access group (luke, ikura, and haruka).

Hardware Inventory & Detected Cameras

Two Reolink RLC-811A (P430) 4K 8MP PoE Spotlight IP cameras are connected to the 10.0.0.0/24 LAN on interface eth77 of host ul with static DHCP leases on danknasty:

Camera Services, Network Ports & Internal Operation

On firmware v3.1.0.4695_2504301440, Reolink cameras lock down legacy plaintext web/streaming ports out of the box and expose only the proprietary Baichuan management port (9000/tcp) until explicitly instructed to enable standard streaming protocols.

1. Port & Service Matrix (cmd_id = 37 GetNetPort / cmd_id = 36 SetNetPort)

2. How the Baichuan Protocol (9000/tcp) Works

All discovery, hardware control, and instantaneous snapshots are performed over TCP port 9000 using Reolink's Baichuan protocol:

1. Binary Framing Header: Every Baichuan packet begins with a 20-byte or 24-byte little-endian binary header starting with magic bytes 0xf0debc0a, followed by cmd_id (uint32), payload length (uint32), channel_id (uint8), status code (200 OK, 400 Bad Request), and payload offset.
2. Modern Nonce Authentication (cmd_id = 1):
   • The client sends an initial unauthenticated cmd_id = 1 request.
   • The camera replies with an XML <Encryption> challenge containing a random <nonce>.
   • The client computes uppercase MD5 digests of username + nonce and password + nonce (truncated to 31 characters) and submits the authenticated login frame.
   • Once authenticated, payload bodies are encrypted using AES-128-CFB (or XOR stream cipher depending on message class) keyed from the session nonce.
3. KeyComplete Baichuan Command IDs Used by cam.drheck.dev:
   • cmd_id = 80 (GetDevInfo): Model (RLC-811A), item number (P430), firmware version, serial number.
   • cmd_id = 37 / 36 (GetNetPort / SetNetPort): Inspects and enables rtsp (554/tcp), onvif (8000/tcp), rtmp (1935/tcp), http (80/tcp), and https (443/tcp).
   • cmd_id = 76 / 75 (GetLocalLink / SetLocalLink): Reads or writes DHCP vs. static IPv4 settings and MAC address.
   • cmd_id = 182 (Snap): Captures an immediate hardware-encoded JPEG frame (main 4K or sub 640x360) directly over the control socket in ~110 ms.
   • cmd_id = 56 / 57 (GetEnc / SetEnc): Reads and updates H.265/H.264 resolution, frame rate (frame), and target bitrate (bitRate in kbps), and audio track embedding (<audio>1</audio>) for mainStream and subStream.
   • cmd_id = 26 / 25 (GetImage / SetImage): Reads and updates ISP sensor parameters (bright, contrast, saturation, hue, sharpen, DayNightDayNight/mode auto|color|black&white, nr3d).
4. cmd_id = 264 /, 265mirror (GetAudioCfg /, SetAudioCfg): Reads and updates speaker volume (0..100flip).
5. cmd_id = 44 / 45 (GetOsd / SetOsd): Reads and updates On-Screen Display overlays, including the Reolink logo watermark (<OsdChannelName><enWatermark>0|1</enWatermark></OsdChannelName>), camera name overlayoverlay, and timestamp overlay.

3. RTSP Stream Endpoints & ONVIF Two-Way Audio Backchannel (554/tcp)

Once rtspEnable = 1 is set via Baichuan cmd_id = 36, each camera serves two RTSP streams:streams plus an ONVIF two-way audio backchannel track:

• Sub Stream (Low-Latency H.264)264 + AAC Audio + PCMU Backchannel):

  rtsp://admin:<password>@10.0.0.122:554/h264Preview_01_sub
  rtsp://admin:<password>@10.0.0.123:554/h264Preview_01_sub
  

  Encoded
  as
• track1: H.264 High Profile (yuv420p, 640x360, default 10 fps at 256 kbps, GOP = 4, recvonly).

rtsp://admin:<password>@10.0.0.122:554/h265Preview_01_main
rtsp://admin:<password>@10.0.0.123:554/h265Preview_01_main

Architecture of cam.drheck.dev

The web service on host ul (/data/docker/cam) bridges the isolated IPv4 camera LAN (10.0.0.0/24) to an authenticated, browser-compatible HTTPS service at https://cam.drheck.dev.

HowKey Subsystems Implemented in cam.drheck.devapp.py Communicates With the Cameras

1. Zero-Config Discovery (discover_cameras):
   • Reads the host kernel ARP table (/proc/net/arp mounted read-only at /host_proc_arp).
   ,
2. Filters formatches Reolink IEEE MAC OUI prefixesOUIs (ec:71:db and, 9c:8e:cd) and probes TCP ports 9000 and 554 across 10.0.0.0/24 (excluding infrastructure router/switch IPs).

• StandardA webbackground browsersmonitor cannotcoroutine natively(event_monitor_loop) decodesamples rawsub-stream RTSPsnapshots from online, non-sleeping cameras every 3.5 seconds, computing downscaled 160x90 grayscale pixel frame-differences (compute_frame_motion).

ffmpeg -nostdin -loglevel error -rtsp_transport tcp -analyzeduration 1500000 \
  -flags low_delay -i rtsp://admin:@10.0.0.123:554/h264Preview_01_sub -an \
  -vf "fps=10,scale=640:-2,format=yuvj420p" -strict unofficial \
  -f mpjpeg -boundary_tag frame -q:v 5 -

• Reolink'sSupports Baichuanboth Push-to-Talk (Browser Microphone) (recording SetWhiteLed (cmd_id = 288) XML parser requires <status>1</status> or <status>0</status> and rejects Python boolean strings (<status>True</status>) with status code 400. app.py normalizes stateaudio/webm via normalize_floodlight_state(req.state)MediaRecorder in the browser) and Speak Text (TTS) (synthesizing speech via espeak-ng --stdout).

Static IPs vs. DHCP Reservations on danknasty & IPv6 Support

1. Should the Cameras Be Configured for Static IPs?DHCP Reservations (/etc/dhcpd.conf & ~/git/router_config/dhcpd.conf)

YesBoth —cameras pinninghave the cameras' IPv4 addresses viapermanent static DHCP reservationsleases on danknasty is recommended.

Currently, both cameras use DHCP (<Dhcp><enable>1</enable></Dhcp>) and received 10.0.0.122 and 10.0.0.123 from the dynamic pool (range 10.0.0.114 10.0.0.250;) on danknasty. There are two ways to assign permanent IPs:

  host cam1 {
    # RLC-811A (141484731968753)
    hardware ethernet ec:71:db:f1:25:5a;
    fixed-address 10.0.0.122;
  }
  host cam2 {
    # RLC-811A (141484731989233)
    hardware ethernet ec:71:db:6d:84:ce;
    fixed-address 10.0.0.123;
  }

<LocalLink version="1.1">
  <Dynamic>
    <Dhcp><enable>0</enable></Dhcp>
    <Ip>
      <ip>10.0.0.122</ip>
      <mask>255.255.255.0</mask>
      <gateway>10.0.0.1</gateway>
    </Ip>
    <Dns>
      <auto>0</auto>
      <dns1>10.0.0.1</dns1>
      <dns2>0.0.0.0</dns2>
    </Dns>
  </Dynamic>
</LocalLink>

2. Do the CamerasIPv6 Support IPv6?

• Camera Hardware (RLC-811A Firmware v3.1.0.4695_2504301440): No native IPv6 support.stack
  on
• Inspectionthe ofcamera ip -6 neigh show dev eth77 confirms that neither ec:71:db:f1:25:5a nor ec:71:db:6d:84:ce configures an IPv6 link-localSoC (fe80::/1010.0.0.0/24), SLAAC, or DHCPv6 address, and the Baichuan LocalLink (cmd_id = 76) schema only supports 32-bit IPv4 fields.

AvailableComplete Camera SettingsControls & HowSettings to Adjust ThemMatrix

All camera settings canare be adjustedavailable interactively in the DrHeck Camera Hub web UI (https://cam.drheck.dev/ — expand Camera Hardware Encoder, Bandwidth, Image & Protocol Settings on any camera card) or programmatically via POST /api/cameras/{ip}/control.:

# Toggle Spotlight ON at 75% brightness on 10.0.0.122
curl -X POST http://[fd77:7777:5010:0:1337:f1ac:d00d:ca30]:8000/api/cameras/10.0.0.122/control \
  -H "Content-Type: application/json" \
  -d '{"action": "spotlight", "state": true, "brightness": 75}'

# Set Optical Zoom to 14 (2.5X)
curl -X POST http://[fd77:7777:5010:0:1337:f1ac:d00d:ca30]:8000/api/cameras/10.0.0.122/control \
  -H "Content-Type: application/json" \
  -d '{"action": "zoom", "value": 14}'

# Reduce on-camera H.264 sub-stream encoder to 128 kbps @ 7 fps
curl -X POST http://[fd77:7777:5010:0:1337:f1ac:d00d:ca30]:8000/api/cameras/10.0.0.122/control \
  -H "Content-Type: application/json" \
  -d '{"action": "encoding", "sub_bitrate": 128, "sub_fps": 7}'

# Adjust ISP Image Brightness and Sharpness
curl -X POST http://[fd77:7777:5010:0:1337:f1ac:d00d:ca30]:8000/api/cameras/10.0.0.122/control \
  -H "Content-Type: application/json" \
  -d '{"action": "image", "bright": 135, "sharpen": 140}'

Authentik Access Control (camera_access Group)

Access to https://cam.drheck.dev is restricted exclusively to members of the camera_access group in Authentik:

ssh ul 'docker exec -i authentik-server ak shell << "PY"
from authentik.core.models import Group, User
grp = Group.objects.get(name="camera_access")
print("Current members:", [u.username for u in grp.users.all()])
# To add or set members:
grp.users.set(User.objects.filter(username__in=["luke", "ikura", "haruka"]))
grp.save()
PY'

Bandwidth Adjustments for Unreliable or Slow Internet

When viewing two cameras simultaneously over a slow, high-latency, or lossy internet connection (cellular tethering, hotel Wi-Fi, or rural WAN),connection, total downstream bandwidth for $N$ cameras is governed by:

$$B_{\text{total}} = N \times f_{\text{fps}} \times S_{\text{frame}}(W, H, q) \times 8 \quad \text{bits/sec}$$

where $f_{\text{fps}}$ is the frame rate, $W \times H$ is the scaled resolution, and $q \in [2, 24]$ is the FFmpeg MJPEG quantization factor (-q:v).

cam.drheck.dev provides two independent bandwidth controls:

1. Per-Viewer Stream Presets (Top Toolbar on cam.drheck.dev & /tv)

Changing the Bandwidth / Mode dropdown in the top bar adjusts server-side scaling, frame rate decimation, and JPEG compression for your browser session without affecting other viewers:

Tip for

Authentik HighAccess Packet Loss Links:

2. On-Camera Hardware H.264 Sub-Stream Bitrate Tuning

Inside each camera card's Camera Hardware Encoder, Bandwidth, ImageGroup) & Protocol Settings drawer, you can also lower the camera's internal H.264 hardware encoder (SetEnc cmd_id = 57) from 256 kbps @ 10 fps down to 64 kbps @ 4 fps (64, 128, 160, 192, 256, 384, 512 kbps).

Google TV /App

A signed, sideloadable Android TV / Google TV application (DrHeck Cameras, package dev.drheck.cam) is built and hosted directly on cam.drheck.dev at:

• Built APK Location on ul (Not Served over HTTPS): /data/docker/cam/googletv_src/cam-googletv.apk
• 10-Foot TV Web Interface:Interface: https://cam.drheck.dev/tv

Features of the Google TV App

How to Sideload onto Google TV

Option A: Via ADB over Wi-Fi / Ethernet (Fastest from a Laptop/Desktop)

scp ul:/data/docker/cam/googletv_src/cam-googletv.apk /tmp/cam-googletv.apk
adb connect <googletv-ip>:5555
adb install -r /tmp/cam-googletv.apk