NIght Owl WNIP2

redwiz666 · April 22, 2021, 7:20pm

Anyone try to connect a Night Owl WNIP2 wireless security camera system to HA? From reading the documentation it shows that the cameras support rtsp streaming but I can’t figure out how to get it to work. I did a port scan on the DVR and it shows port 554 open and it responses with “rtsp-methods: SETUP,OPTIONS,DESCRIBE,PLAY,TEARDOWN,GET_PARAMETER”

and even did a packet capture of using the windows 10 app and when the program connects it uses port 44554 and gets a response like this

CSeq: 2
Content-Type: application/sdp
Content-Length: 239
Server: minirtsp 2.2 (by kaga)
v=0
o=- 1884675279 1 IN IP4 127.0.0.1
s=ch2_1.264
i=minisdp
c=IN IP4 127.0.0.1
t=0 0
a=control:*
m=video 0 RTP/AVP 96
a=rtpmap:96 H265/90000
a=control:track=video
m=audio 0 RTP/AVP 0
a=rtpmap:0 PCMU/8000
a=control:track=audio
RTSP/1.0 200 OK
CSeq: 2
Content-Type: application/sdp
Content-Length: 238
Server: minirtsp 2.2 (by kaga)
v=0
o=- 357124098 1 IN IP4 127.0.0.1
s=ch3_1.264
i=minisdp
c=IN IP4 127.0.0.1
t=0 0
a=control:*
m=video 0 RTP/AVP 96
a=rtpmap:96 H265/90000
a=control:track=video
m=audio 0 RTP/AVP 0
a=rtpmap:0 PCMU/8000
a=control:track=audio
RTSP/1.0 200 OK
CSeq: 2
Content-Type: application/sdp
Content-Length: 238
Server: minirtsp 2.2 (by kaga)
v=0
o=- 102202132 1 IN IP4 127.0.0.1
s=ch1_1.264
i=minisdp
c=IN IP4 127.0.0.1
t=0 0
a=control:*
m=video 0 RTP/AVP 96
a=rtpmap:96 H265/90000
a=control:track=video
m=audio 0 RTP/AVP 0
a=rtpmap:0 PCMU/8000
a=control:track=audio
RTSP/1.0 200 OK
CSeq: 2
Content-Type: application/sdp
Content-Length: 239
Server: minirtsp 2.2 (by kaga)
v=0
o=- 1081770176 1 IN IP4 127.0.0.1
s=ch0_1.264
i=minisdp
c=IN IP4 127.0.0.1
t=0 0

I tried adding it as a generic camera using

platform: generic
name: Front Door
still_image_url: http://192.168.150.137/ISAPI/Streaming/channels/201/picture
stream_source: rtsp://http://192.168.150.137:9333/ISAPI/Streaming/ch2_1.264
username: !secret nightowl_username
password: !secret nightowl_password

but it can’t find that doesn’t work. From the port scan I see that the following ports are open on the box:
80/TCP
554/TCP
44554/UDP
9333/TCP

Hopefully someone here has some insight of what to try next.

Bartem · May 2, 2021, 11:59am

try

rtsp://192.168.150.137:554/ch0_1.264

If you are on iOS there is an app called NX-V (not sure if there is an android version) that found that path for me, I spent weeks trying multiple different stream paths and opened that app one day for something else and there it was…
As for the motion I have not had any luck getting motion from the camera… it was a free camera so I wasn’t too worried about it but wish I could pull a binary_sensor out of there.

Also no username or password required from me for that to work… just the URL

Also the ONVIF integration should pick it up…

(this information is related to direct to camera though, I do not have a Night Owl DVR)

redwiz666 · May 2, 2021, 2:09pm

How did you get the camera to connect to your wifi? I tried using the nightowl app but after selecting my wifi it says configuring and then an error has occurred and the tech support is less than helpful

Bartem · May 2, 2021, 2:14pm

I just used the NightOwl Protect app… maybe your camera needs a reset? I just plugged it in and it created its own wifi for initial connection… if I remember correctly it spoke also saying it was ready or something.

Krelkci · August 24, 2021, 7:28am

I found a solution to this that provides full onvif for all the cameras that operate “behind” the secure-enclave wireless WNVR (WNIP2). I’ll be writing up something shortly. Its nothing insignificant and involves packet captures. That said, I’m working with NightOwl to provide them responsible disclosure since, I believe it to be a security related oversight.

Regardless, the result is the cameras working with BlueIris/Hubitat/HomeAssistant with or without the WNIP2 WNVR recorder.

I’m open to working with another owner of a WNIP2 to produce the same results, to confirm that each WNIP2 uses a dedicated, non-similar wireless PSK. If anyone would like to be part of that research, let me know.

After penetration into the WNIP2’s (secure enclave) wireless network, it is possible to interact with the wireless cameras directly on the broadcast network. The cameras themselves (at least the WNIP-2LTA-BS models). profiles’ are /ch0_0.264 and /ch1_0.264 respectively. RTSP is port 554 and ONVIF discovery is port 8089. Model loads as “generic ONVIF” “*RSP H.264/H.265/MPJG/MPEG4” in Blue Iris auto-discovery. Doing the above also allows the opportunity to remove the WNIP2 camera’s internet requirement that otherwise relies on a generated P2P tunnel between the camera wLAN network and the camera manufacture’s P2P tunnel service.

WNIP-2LTA-BS differs from WNIP-2LTA-BS-U which is the stand-alone camera that can be arbitrarily added to an existing wireless network and is not dependent on the WNIP2 WNVR for provisioning. WNIP-2LTA-BS is locked to its paired WNVR (WNIP2) that it was bundled with, and, without penetrating its secure network, cannot be modified to work on other wireless networks directly. Its kinda a shame and an e-waste worry if the WNIP2 fails. The cameras themselves are actually fantastic. Its a shame the manufacturer doesn’t allow for a method to put the cameras into a stand-alone mode.

Regarding capturing the camera feeds from the LAN side of the WNIP2, I did not find a method. It appears that the WINIP2 service relies on the P2P tunnels generated by the applications to generate the feeds. I was able to identify the methods necessarily to arbitrarily re-create the P2P tunnel and create a dedicated camera feed over the P2P tunnel, re-serving it as a typical RTSP service. This is effectively exactly what the Night Owl Protect CMS application does. To that end, the re-serving of the RTSP services via Night Owl Protect are also served to the localhost, thus it is possible to login to Night Owl Protect CMS and import the re-serviced RTSP service into BlueIris/HomeAssistant, etc. Unfortunately the reliance on the P2P tunnel seems to cause the feeds to disconnect at least one every couple days. The Night Owl CMS application’s reserved RTSP service uses the following URIs:
rtsp://admin:@127.0.0.1:10080/ch0_1.264
rtsp://admin:@127.0.0.1:10080/ch1_1.264
rtsp://admin:@127.0.0.1:10080/ch2_1.264
etc…
Again, this will only work on the local host where Night Owl Protect CMS is running. To test, login to Night Owl Protect CMS, log in, open the live view & finally open VLC and connect to the URI.

Krelkci · January 28, 2022, 1:32am

Wrote it up, somewhat:

github.com

Relkci/NightOwl-WifiCamera-Config-wnip2/blob/main/README.md

# ONVIF and WIFI Information NightOwl WNIP2 Camera Series
After searching to find a way to use the WNIP2 Wifi IP Cameras from NightOwl without having to use the packaged WNIP2 NVR (which, is the weakest part of the packaged solution NightOwl sells at discount box stores like Sams Club and Costco) I was looking at trashing the cameras and buying reputable standaling IP cameras that would support ONVIF and BlueIris, etc.

Specific camera model this is about: WINIP-2LTA-BS

I made one last attempt at trying to prevent these really decent cameras from becoming e-waste.  Do note that this method effecticvely removes the cameras from any control of NightOwl.  You will ultimately loose access to the cameras on the mobile app and desktop software.  This method however also makes it possible to access the camears as though they were a traditional Wireless RSTP ONVIF securiy camera and can be added to your custom NVR solution like BlueIris or even just VLC.

Heres what I learned:

## Its a package, sorta.
- These cameras WILL work as standalone units, despite they were packaged with an Paired-NVR.
- NightOwl customer support will not help you not use the paired-NVR.
- You still initially need a NightOwl NVR to temperaily configure the devices
- Once the devices are configured, you never need the paired NVR again.
- There is a model fo camera that is standalone that will natively work.  They are add-on cameras never that were not pre-paried with the NVR.  The pre-paired NVR cameras are locked to the NVR.
- The NVR itself is fully encrypted, don't bother taking it apart.  The disk is not readable without a private key that I couldn't find anywhere.

## The hack.
If you want to use these cameras without the paired NVR, you'll have some work to do to capture network traffic and to design a network that can live without the paired NVR.

This file has been truncated. show original

Emprez · December 22, 2023, 12:32am

Do you have knowledge as to what wifi card or nodule the wnip2 series? My daughter poured water on mine and it works aside from the wifi connecting. It says failed to initialize wireless device.

D2theR · November 24, 2024, 9:33pm

First things first, credit where it’s due:
@Krelkci NONE OF THIS would have been possible without your write up, THANK YOU!

This is an older thread, so for anyone coming here from the Google, this isn’t the easiest solution to get these cameras working with Home Assistant, but it does work.

The Bad News:
The cameras are somewhat vendor locked to NightOwl’s stupid NVR Wifi network.

The Good News
If you’re tech-savvy enough there’s a really fun work around that involves using Wireshark, the NightOwl Windows client, and wifi-spoofing!

Device(s) Needed:
WNVR-WNIP2-1-CN2 (this box is a POS and we want it to go away.)
WINP-2LTA-BS Cameras (These are actually really awesome!)

You NEED to spoof the Wifi network the NVR is broadcasting by following Krelkci’s wonderful tutorial in order to get the Wifi networks pre-shared key (also YouTube is your friend). My network was on a Hidden SSID called “NOPWNVR-”[MAC Address of NVR] (Note the DASH) and it assigned IP subnet of 172.20.14.0/24 the cameras were .101-105 Also, see Github my post here.
Once you have your PSK and Wifi network setup, and have assigned proper static routing make sure you can connect to the cameras via something like VLC. via this address: rtsp://172.20.14.###:554/ch0_0.264
NOTE: Something I figured out after snooping around with Wireshark is that if the camera’s connect to a spoofed network, they assign themselves the /ch0_0.264
Now, the cool part: Go to the Home Assistant → Settings → Add a device: Search “ONVIF” and UNCHECK the box for “Search automatically” and submit. Fill out the form as so:

Name: [Camera name]
Host: [IP address of your camera]. ie 172.20.14.100
Port: 8089
Username: admin
Password: admin

Flip NightOwl the bird (pun intended)

If anyone wants to know more feel free to ask! I really hate seeing perfectly good technology go in the garbage.

Edit: This Windows client for ONVIF devices managed to help me get the cameras to connect to my Access Point via DHCP! Hurray!
https://sourceforge.net/projects/onvifdm/files/