How is my DVR connecting? - Page 1
Forum section: electronics / general

author: metrologist
author_rank: Super Contributor
timestamp: September 10, 2025, 02:53:02 pm
content: I have an old CCTV system, ~15 years old.I connect Ethernet to the DVR and install the old CCTV PC app on my laptop. I enter the network IP address of the DVR into the app and it connects as expected, so I have the complete UI and camera views on my laptop now.I go to work and open the CCTV app, and there I can see live stream from my DVR, but I'm not expecting this connection to be possible.The app must have queried my router IP and the DVR must be communicating through an unsecured socket, right? I'm not sure how this communication is getting through my router?BTW, I think newer systems route this traffic through a central server, so your DVR and PC/Phone connect to the server, but I do not think that's what's happening here.

author: NE666
author_rank: Frequent Contributor
timestamp: September 10, 2025, 05:40:19 pm
content: Quote from: metrologist on September 10, 2025, 02:53:02 pmIf the DVR is set to use DHCP, then yes. The router will have provided its own address as a gateway and likely DNS settings too.Quote from: metrologist on September 10, 2025, 02:53:02 pmEven if you had no firewall in place at all on the router, which I highly doubt, there would still need to be network translation between your external, public IP address and the internal IP range on which the DVR sits. If there's no central server involved as an intermediatory, then I would first look to see whether you have any port forwarding configured on your router which is applicable to the DVR. Port forwarding provides just such translation and inbound firewall access. I would especially look out for any 'automated port forwarding' (aka UPnP), as if this service is active it may permit clients to request port translation themselves, without you explicitly configuring it.Quote from: metrologist on September 10, 2025, 02:53:02 pmUnless you know for certain this isn't the case, it remains a reasonable explanation if port forwarding isn't active on your router.

author: Haenk
author_rank: Super Contributor
timestamp: September 10, 2025, 06:01:01 pm
content: Quote from: metrologist on September 10, 2025, 02:53:02 pmUsually, the cheap routers don't have any type of control what is happening on the port/network (other than maybe on/off), so likely everything is on "broadcast".What is likely happening: The DVR puts out a DHCP request, and receives an IP, netmask, gateway, maybe DNS. The client can grab the netmask, gateway, DNS directly from the operating system. That's all you need to connect on the same network (don't actually need DNS, that's only more useful when the DVR or Application checks for an update server e.g.).It is possible the connection / data stream is encrypted, you might be able to try VLC (Video LAN CLient) to connect to the IP. If that works and delivers a video stream, it's unencrypted. If not, that does not tell anything

author: NE666
author_rank: Frequent Contributor
timestamp: September 10, 2025, 06:09:11 pm
content: Quote from: Haenk on September 10, 2025, 06:01:01 pmI don't think the OP is questioning access on the same network but from a different oneQuote from: metrologist on September 10, 2025, 02:53:02 pm

author: tom66
author_rank: Super Contributor
timestamp: September 10, 2025, 11:12:54 pm
content: It will be talking to a cloud server somewhere, if it has an internet connection. This avoids the need to open a port on the router.The manufacturer probably left the server running for two reasons.a) They may still use the same server for new productsb) If the company is based in China or another country that is not super friendly to the west, their national security may benefit from access to CCTV cameras around the world... I am kind of kidding, but then it's shocking how long some products remain cloud supported long after there is no commercial incentive, so I do believe there is a policy of some kind here, even if it isn't directly nefariousPersonally I would not connect such a DVR to the internet. Instead I would do so locally only, and tunnel video through my own private VPN or similar where I hold all the keys.

author: metrologist
author_rank: Super Contributor
timestamp: September 11, 2025, 01:26:34 am
content: yeah, that's why I'm asking.To connect the dvr, I had to enter the network IP and port. I look more into the settings and it's using UPnP.

author: tom66
author_rank: Super Contributor
timestamp: September 11, 2025, 08:22:46 am
content: You plugged the DVR into your network though. It would have obtained an IP from DHCP. From there, it can get a web connection and talk to a server outside of your home, which then serves as the routing device. No ports need to be opened because it's an outgoing connection and the server facilitates this.The same technique is used by a variety of Wi-Fi smart home products, such as wireless light bulbs, and it's how you can control them from your phone anywhere. It's a major security risk IMHO, because you've got a small embedded computer in the lightbulb with full access to all wireless traffic around you and all other network devices, and it's talking to a server somewhere far away from a likely obscure manufacturer with little to lose if they wanted to be nasty. Can't recommend.

author: metrologist
author_rank: Super Contributor
timestamp: September 11, 2025, 01:59:50 pm
content: Sounds like you're negative on any kind of smart device plugged into the network.So I discovered my router does not support UPnP and any port forwarding (not called that in the UI) must be manually set up.So it seems there is still a server running and I'm connecting without needing any account.At least the company is reputable and has been around ~40 years, but maybe possible these camera feeds could be found on one of those open camera sites.I also read AES-128 Bit Encryption of all transmitted data, including video files, and they are using Amazon Web Services.So kind of a relief...But I'm not going to leave it connected long anyway.

author: tom66
author_rank: Super Contributor
timestamp: September 11, 2025, 09:03:54 pm
content: Yes, I am quite skeptical because of how much of modern world is dependent upon secure connections on the outside of a home (HTTPS, for instance), but we have a variety of insecure connections within a typical home. For instance, my smart TV and AV amplifier both have HTTP ports exposed on them. Any device inside the network could spy on that traffic or inject its own. Windows computers have documented vulnerabilities and zero days discovered frequently. So your internal network should be as secure as reasonable possible, at least if you value your privacy and IT security.I do have smart devices in my home, but they are all locally managed devices and most of them are Zigbee (a few are Bluetooth), so they have no network access. There are some Alexas, but that's the other half's doing, and whilst I don't trust Amazon directly, I think they wouldn't be so silly as to actively sabotage their customer's networks. Bad PR. But maybe I'll be shown to be wrong.You have a misunderstanding of the process here, by the way. There is no need to have a server running on your DVR and no port forwarding needed. All the DVR does is stream video and other information to an end point running in the "cloud" somewhere. It accesses this like your computer accesses google.com: you do not need to open a port to do that, because it is an outgoing request, which is explicitly allowed by almost every router. The end point then rebroadcasts this on demand to your phone. If the service is efficient, the DVR just keeps a socket open and waits for a request for video from the cloud and then sends it out.It is irrelevant how the data is transmitted to the cloud if you do not have faith in the manufacturer as they can run whatever they want on that AWS cloud instance. It is equivalent to saying a burglar of your house was very careful to lock your possessions up whilst transiting back to his base. Additionally, if the manufacturer has intentionally introduced a back door into that DVR, they can use the cloud service to command-and-control that DVR as a network probe. This can be entirely automated, like sniffing for open ports on other devices in your network, and transmitting rogue DHCP packets to convince other devices that the DVR is the gateway.All I am saying is, appreciate the risk and understand this when you're using a free service like this, it could be free for a good reason rather than just a company being nice.

author: Cyclotron
author_rank: Unknown
timestamp: September 11, 2025, 09:54:57 pm
content: Quote from: tom66 on September 11, 2025, 09:03:54 pmAgreed 100%. Consumer-grade firewalls are configured out of the box to allow all connections to the internet. They do this to make it easy on the manufacturer's support team. Most consumers couldn't care less, too.Cloud-based access to internal services is, as tom66 said. They "meet in the middle". The device establishes a connection, it gets configured with your specific details when you configure it. It creates a session under your account on the cloud portion, and then your app on your device connects to the same, and the server connects the two.I use some cloud services, but I also cordon off my home network for those devices. It isn't about trusting the company. This is a risk mitigation. These devices don't need to talk to the other parts of my network, so they shouldn't have access to do so. If a malicious actor breached the cloud service provider, they could gain access to maybe some sensor data, but they can't really leap off that to my home storage.This gets complex and the vast majority of consumers aren't going to operate a home network in such a manner nor likely need to.The last thing to consider about cloud providers is that they can appear and disappear just as easily. If the functionality you want depends on the company's health, you might have concerns in the long run. Those who run home automation know what happened when Liftmaster decided to stop allowing API Access to the application.

author: microwhat
author_rank: Contributor
timestamp: September 11, 2025, 09:58:14 pm
content: Quote from: metrologist on September 11, 2025, 01:59:50 pmAnd now Amazon has unlimited access to your camera streams, and they can do whatever they want with them.

author: thm_w
author_rank: Super Contributor
timestamp: September 11, 2025, 10:02:07 pm
content: It would help to give the name and model number of the product.

author: metrologist
author_rank: Super Contributor
timestamp: September 12, 2025, 05:55:22 pm
content: Quote from: microwhat on September 11, 2025, 09:58:14 pmThe data is encrypted

author: metrologist
author_rank: Super Contributor
timestamp: September 12, 2025, 05:58:28 pm
content: Quote from: thm_w on September 11, 2025, 10:02:07 pmI did not do that initially because I was not aware if it could have been a fully open port.Swann CCTV system of ~2016

author: Cyclotron
author_rank: Unknown
timestamp: September 12, 2025, 07:09:33 pm
content: Quote from: metrologist on September 12, 2025, 05:58:28 pmJust be sure to keep your patching updated. Given the product's age, the company may stop supporting it or patching it.I don't see a published life cycle plan for their products. Swann sells to consumer and business so maybe they have a life cycle published somewhere as often business require it.These "meet in the middle" technologies provide a vector and its just good to keep that in mind.Here's an example of what can happen.https://www.bbc.com/news/technology-44809152

author: thm_w
author_rank: Super Contributor
timestamp: September 13, 2025, 01:12:01 am
content: Its probably registered on their DDNS and data goes directly from the NVR to the phone through the internet, I assume.If its a secure password it won't be open access from the net, but I'm sure there are vulnerabilities and they haven't patched it in a while.https://support.swann.com/hc/en-us/articles/4803064960409-Why-Can-t-I-View-My-Cameras-Remotely-When-Away-from-Home#step-1https://support.swann.com/hc/en-us/articles/4803478354585-How-to-create-a-DDNS-or-hostname

author: PlainName
author_rank: Super Contributor
timestamp: September 14, 2025, 10:06:14 am
content: Not a DVR but a very similar thing with some kit I just bought (knowing it would do this).It's aGS-911 OBDIIdoobrey. With a PC/Laptop you can connect via USB or WiFi direct and it acts as you'd expect (that is, a direct connection). But if you want to use your phone, which, it has to be said, is rather more appropriate in the garage, then it doesn't work. OK, strictly, you can connect but can't do much since you have to use a browser which lacks the knowledge necessary to deep dive into your motor. So the device connects to some internet server which does know what to do and how, and your phone talks to that instead.Big red flag here is that the internet server is what's actually controlling the GS-911 and potentially screwing up your bike's ECU. Ignoring that, setting up is dead simple: connect in direct mode to set the WiFi access details, then switch to infrastructure mode and it's done. The device calls out just like any other device on your network (IoT, PC, TV, DVR) and connects to the server, your phone or whatever browser does the same and they are now connected.

author: tom66
author_rank: Super Contributor
timestamp: September 14, 2025, 10:26:22 am
content: Quote from: metrologist on September 12, 2025, 05:55:22 pmYou have absolutely no idea where the decryption happens. It is possible the video is sent truly end to end and the cloud server has no access to the video stream, but that is technologically more complex to implement. It is more likely the video is only encrypted to and from the server, and the server processes decrypted video. At the end of the day, it is impossible to say without Swann (more likely the Chinese manufacturer like ANNKE, Hikvision) disclosing the process used and making that process auditable.

author: metrologist
author_rank: Super Contributor
timestamp: September 15, 2025, 03:44:38 pm
content: I would expect the server to just pass the encrypted stream and the end user app does the decrypting, butAt least the company has been in the news and not some unknown brand, so maybe they do things to protect their image, but that also makes them more a target.