Skip to main content

AXIS Cameras

Testing done 7/9/2021 with two AXIS M2026-LE MkII cameras running firmware version 8.40.3.

What do we learn from this testing?

At times, the AXIS Device Manager doesn't properly detect one or more cameras connected to the network. The AXIS IP Utility so far has not failed in detecting cameras. There are alternate ways to detect and access these cameras.

Behavior on boot

  • The netd service manages assigning IP addresses to the Ethernet interface:
    • If the device is configured to use DHCP, the IP address 192.168.0.90/24 is assigned to the Ethernet interface and the DHCP client is started. If a DHCP response is received from a DHCP server, the IP address received is replaces the 192.168.0.90/24 address, along with all other DHCP options received from the server. If no DHCP response is received from a DHCP server, the 192.168.0.90/24 IP address remains instantiated on eth0 and the DHCP client continues to send DHCP requests.
    • If the device is configured with a specified static IP address, that static IP address is instantiated on the Ethernet interface eth0.
  • The zeroconf-ip service claims a link-local IP address in the range 169.254.0.0/16 and instructs the netd service to add this as a secondary IP address on the Ethernet interface eth0. This IP address is always accessible on the device, unless the ZeroConf service gets disabled.

AXIS IP Utility

The AXIS IP Utility uses MDNS requests to discover cameras on the network. These MDNS requests are responded to by the Bonjour service running on the camera. If the Bonjour service is disabled, no response will be given.

Multiple UDP requests with different PTR queries are sent to the multicast address 224.0.0.251. The following requests were sent from the test computer to the diagnostic network with two cameras attached.

  • 10.77.69.2 224.0.0.251 MDNS Standard query 0x0000 PTR _axis-nvr._tcp.local, "QM" question

  • 10.77.69.2 224.0.0.251 MDNS Standard query 0x0000 PTR _axis-bwsc._tcp.local, "QM" question PTR _axis-video._tcp.local, "QM" question

Cameras respond to the queries by sending an MDNS response to the 224.0.0.251 multicast address. The following are the responses from the two cameras connected to the diagnostic test network:

  • 169.254.93.22 224.0.0.251 MDNS Standard query response 0x0000 PTR AXIS M2026-LE Mk II - B8A44F0A98A1._axis-video._tcp.local TXT, cache flush A, cache flush 169.254.93.22 A, cache flush 192.168.0.91 SRV, cache flush 0 0 80 axis-b8a44f0a98a1.local NSEC, cache flush AXIS M2026-LE Mk II - B8A44F0A98A1._axis-video._tcp.local NSEC, cache flush axis-b8a44f0a98a1.local

  • 169.254.190.127 224.0.0.251 MDNS Standard query response 0x0000 PTR AXIS M2026-LE Mk II - B8A44F1136E5._axis-video._tcp.local TXT, cache flush A, cache flush 169.254.190.127 A, cache flush 10.77.69.198 SRV, cache flush 0 0 80 axis-b8a44f1136e5.local NSEC, cache flush AXIS M2026-LE Mk II - B8A44F1136E5._axis-video._tcp.local NSEC, cache flush axis-b8a44f1136e5.local

You can see that both camera responses shown above list all of the IP addresses instantiated on the camera.

AXIS Device Manager (ADM)

The AXIS Device Manager uses MDNS requests and SSDP requests to discover cameras on the network.

Using the ADM to configure a device makes more changes than just assigning the IP address. I believe multiple services are disabled, but this is still to be tested.

- more content to come

Alternate detection methods

Windows ARP Cache

Running "arp -a" on a Windows computer will display the arp cache. The link-local IP addresses instantiated by the ZeroConf service of recently booted cameras should be visible in the ARP list.

Packet sniffing using Wireshark

Wireshark can be used to observe broadcast/multicast traffic generated by cameras (especially prevalent during the initial boot) as well as ongoing DHCP requests if the camera is connected to a network lacking a DHCP server.

:end

Back to top