Mathias Dietz Weblog

I've finished the first version of a java based video grabber tool.
It grabs the live stream of the ovislink webcam and stores it into a file.
MDGrab Java Package (JRE 1.5.x required)

To start the video grabber command line tool, enter the following command:
java -jar MDGrab.jar [webcam IP-Address] [output filename]

To get the plain mpeg4 video stream I had to remove Cellvisions additional header structure.
The header seems to be always 40 bytes long, and index 24-27 are the size of the following video data.
In java it look like this:
byte[] hdr = new byte[HEADERSIZE];
int r = in.read(hdr);
//convert 4 bytes to an int
int ret = (hdr[27]& 0xFF)<< 24 | (hdr[26]& 0xFF) << 16 | (hdr[25]& 0xFF) << 8 | (hdr[24]& 0xFF);

Webcam Security Hole
After playing around with the protocol, I found a very critical security hole in the Webcam firmware.
It is possible to capture the video data without authentication . The userid and password is only required for the web part of the webcam.But when you connect directly to port 5000 and 5001 then you can look video without ever using the web part.
I'll provide a sample program later (check downloads).

After some hours of network tracing. I found out how the Webcam works:


It has multiple TCP Ports open:
Port 80 = Web Interface. All commands to control the webcam (pan&tilt...) are http requests.It also handles the authentication
Port 5000 = Stream initialization.
Port 5001 = Streaming Port, sends the video packets
Port 500 = documented as ipview port. But ipview pro does not connect to this port !
dynamic Port = UPnp Mediaserver port

The following sequence is used to start the video streaming:
1) connect to port 80 and authenticate (http authentication)
2) connect to port 5000, send a init sequence and disconnect
3) connect to port 5001, send a start sequence and receive the video stream (with a cellvision header in each packet)

Meanwhile I found out that the Ovislink Airlive 5460CAM is equal to the Cellvision CAS670W.

Cellvision seems to be the original developer of the Webcam, while tracing the network traffic I found a lot of "Cellvision" strings in the package header.
Cellvision offers a Aragorn SDK which is a documentation of a webcam protocol (but not 100% equals).

I've bought a Ovislink Airlive 5460CAM Webcam.
It's a really nice Webcam with integrated Wireless LAN and Pan&Tilt function.
A detailed specification could be found here Ovislink Airlive

After unpacking the webcam, I found out that the java applet was missing, instead an ActiveX plugin was required to use the Webcam. WTF...
So, I've decided to implement my own java applet to capture the Webcam video.