How can I decode HTTP traffic from an IP webcam into full URLs?

April 21, 2010 3:35 AM

I have a cheapo IP WiFi webcam, its video & audio feed is viewed via an ActiveX plugin in IE. I want to access theses feeds in Linux. I was wondering if there was some tool I could use in Win XP to monitor the network traffic on my PC when using IE to access the webcam, to get the full URLs to the audio and video feeds. All the tools I have used so far just give me the IP address and port, not the full http address.
posted by prupert to computers & internet (12 answers total)

wireshark
posted by CautionToTheWind at 4:03 AM on April 21, 2010

To clarify, the camera has its own IP address, and is accessed on a port other than 80? If that is the case, it's almost certainly not running off HTTP...
posted by Dysk at 4:45 AM on April 21, 2010

How do you know it's using http? Seems pretty unlikely if it's not port 80. Otherwise, why would they need a special plugin?
posted by delmoi at 5:18 AM on April 21, 2010

Wireshark might help determine what protocols it's using, but if it's an ActiveX control, it may be IE-only. Although, a fair number of IP cameras use Motion JPEG and IE might use ActiveX to display those.

Do you have the manufacturer/model info for the camera?
posted by wxguychris at 5:38 AM on April 21, 2010

You could be lucky... using-linksys-wvc54gc-webcam-with-linux.

Introduction

The Linksys Compact Wireless-G Internet Video Camera WVC54GC is a linux based wireless webcam with its own streaming web server built in. Windows users can view the video stream through their browser without the need to install any extra software other than allowing the supplied Active-X control to run. Strangely, while the product itself appears to be linux based, and its firmware is open source which you can download from the Linksys website, there isn't much in the documentation about using this camera with Linux.

Viewing Video

The raw video stream itself is actually available at http://yourwebcamera/img/video.asf. ASF is a Microsoft format – but plenty of Linux software can use it. Its a digital video container format sometimes known as 'Advanced Streaming Format'. The actually encoding of the video is MPEG-4 – a widely used standard. So, while you cannot run the active X control under Linux, you have plenty of choices of software you can use to view the video stream, provided you know where it is. Software you can use include the popular Mplayer, Xine and VLC.

Wireshark and it's command line version tshark will do the job, if it is HTTP. This is http://slashdot.org:

root@gaz:~# tshark -w - | perl -lne '/(GET .*) HTTP/ && print $1'
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
58 GET /
GET /sd/idlecore-tidied.css?T_2_5_0_293
GET /sd/print.css?T_2_5_0_293
GET /favicon.ico
GET /sd/facebook_icon.png
GET /sd/twitter_icon.png
165 GET /p?c1=2&c2=6035546&c3=&c4=&c5=&c6=&c15=&cj=1
GET /x/34603223/false/p_1176745533=0
GET /sd/cs_i2_gradients.png?T_2_5_0_292
GET /sd/logo2.png
453 ^C

posted by zengargoyle at 6:35 AM on April 21, 2010

What model is the camera? I have a rebranded Edimax IC-1000 that works the same way, and I found a Tcl script to grab images.
posted by djb at 6:37 AM on April 21, 2010

Maybe this is obvious, but you have to either run Wireshark on the Windows machine, or you have to have your Linux machine networked in such a way that it can see the traffic going to/from the Windows box. (You could do this with a hub, or by configuring your switch appropriately if you have a managed switch. If you have a cheapo unmanaged switch you are pretty much SOL though.)

You want to intercept and analyze the traffic going to/from the Windows machine while it is loading and viewing the camera via the ActiveX control.

If it works the way I (and others) suspect, then the ActiveX control should open a connection back to the camera for the actual video stream, separate from the connection used for the management/status webpage and to display the control.

I'd probably capture to a dumpfile and then pick that apart, rather than trying to do it live.
posted by Kadin2048 at 6:56 AM on April 21, 2010

One more thing: before you go picking apart the HTTP stream, have you tried just looking at the page source? Maybe it's passing the video connection information to the ActiveX control as a parameter or something, and it would be visible in the page source if you look.

Just a random guess; I don't know that much about how ActiveX controls are loaded.
posted by Kadin2048 at 6:58 AM on April 21, 2010

Hi, since I can't work out how to reply to the answers individually, I'll reply here to everyone.

The IP Camera is annoyingly un-branded, all I could figure out from it is it's a: F-Series IP Camera model number FS-613A-M136, possibly made by Lemo Technology Co (after lots of Googling).

You can vary the port the camera is accessible on. It offers access via both IE and Firefox, but the only way to access the audio stream with the video stream is by using IE, or the supplied Super Client software.

The camera uses Motion JPEG as its video format, I can use the following URLs to get video:
http://192.168.1.126:81/video.cgi
http://192.168.1.126:81/videostream.cgi
http://192.168.1.126:81/snapshot.cgi
I chose port 81 btw. I can open all these in VLC in Linux to get a live video stream, but its the audio stream I wanna access as well.

I've already analysed the page source, but it seems to contains lots of calls and functions to the ActiveX control, and there are no nice easy to understand links to IPADDRESS/audiostream.cgi ;)

I guess I just need to find a HowTo for Wireshark....

thanks for the replies so far people ;)
posted by prupert at 10:33 AM on April 21, 2010

Hmm, well, wireshark seems to be showing that it isn't HTTP, but TCP.

It's HTTP when accessing using Firefox, but then that doesn't give me audio, when using IE and ActiveX, it seems to be all TCP connections.

Damn.
posted by prupert at 11:43 AM on April 21, 2010

Next step:

Look at the dump of the first packet from the computer to the camera for two different runs. Does the computer send any data in the initial packet? If it does, is the data sent the same for both runs?

Look at the data that the camera sends back on multiple runs. Is the first bit of data the same?

Having the same data at the beginning of the first packet to the camera over multiple runs tends to mean that it's some kind of request to start or something. You may have to capture out the common part and send it to the camera to get it going. Same data at the beginning of the first packet from the camera is likely a header or format indicator. You may need to recognize it.

Install 'sox' and 'netcat' programs. Ubuntu has packages for both, actually netcat was already installed on my system. Install any libsox-blah stuff.

Here's where it gets fun.

'play' from the sox package supports almost everything, some of it will even auto-detect, worst case you skip some header bytes and guess at the data format.

AUDIO FILE FORMATS: 8svx aif aifc aiff aiffc al amb au avi avr caf cdda cdr cvs cvsd cvu dat dvms f32 f4 f64 f8 fap ffmpeg flac fssd gsm hcom htk ima ircam la lpc lpc10 lu m4a mat mat4 mat5 maud mp2 mp3 mp4 mpg nist ogg paf prc pvf raw s1 s16 s2 s24 s3 s32 s4 s8 sb sd2 sds sf sl smp snd sndfile sndr sndt sou sox sph sw txw u1 u16 u2 u24 u3 u32 u4 u8 ub ul uw vms voc vorbis vox w64 wav wavpcm wmv wv wve xa xi

try this:

$ nc 192.168.1.101 81 | play - # replace IP and Port with your TCP stream info.

(on my server I run: nc -l -p 81 < 05\ -\ Iron\ Man.wav and the above will play the song on my laptop.)

$ nc 192.168.1.101 81 | play -r 44100 -s -2 -c2 -B -t raw - # plays raw cdda stream - 44.1KHz signed 2 byte samples stereo big endian raw.

If you muck around enough you'll probably get it. :)
posted by zengargoyle at 1:56 PM on April 21, 2010

Hi All

I finally found it!! Yay!

Thanks to everyone's help. I did try using netcap and sox, but first I had to install a Windows XP virtual machine in VirtualBox, so I could run the commands in Ubuntu on the network traffic, since I could only get the audio stream in IE. Sadly, I didn't get very far.

Then I messed around with various Windoze software that uses WinPCAP and one of them, called EtherDetect from effetech.com gave me a new name for the WebCam: "Netwave IP camera". Googling this led me to discover that the webcam is a ripoff of a Fosscam webcam, which led me to this document: http://www.drivehq.com/file/df.aspx/publish/bubbah/PublicFolder/IPCAMCGISDKV1.7.pdf

Which lists all the cgi functions of the Fosscam IP Camera, which led me finally to:

192.168.1.126:81/videostream.asf?user=admin&pwd=&resolution=32

which is a direct link to the videostream with audio!! So, zengargoyle, you were actually SO close with your first post ;) THANKS LOADS. What's cool with that pdf I found, is that it also lists all the commands to operate the camera remotely via http calls, so I can now use motion to move the camera around, and I even found this command:
http://192.168.1.126:81/set_misc.cgi?led_mode=2
which turns off the anoying flashing LED at the front.

This is so brill, thanks so much people for pointing me in the right direction!
posted by prupert at 3:55 PM on April 24, 2010