According to manual Hikvision NVRs and IP cameras at boot trying to download firmware from tftp server.
Device address is 192.0.0.64, server address is 192.0.0.128.

Running tcpdump on interface shows ARP requests. Fine. Device is not fully dead.

ARP, Request who-has 192.0.0.128 tell 192.0.0.64, length 46
ARP, Reply 192.0.0.128 is-at [mac_address], length 28


But it does not try to download digicap.dav at all from server…

Run tcpdump again and found @strange@ UDP to 9978 port. But tftpd is at 69..

IP 192.0.0.64.9979 > 192.0.0.128.9978: UDP, length 20

Google knows all, so, here is an answer:
https://github.com/scottlamb/hikvision-tftpd


IP 192.0.0.64.9979 > 192.0.0.128.9978: UDP, length 20
IP 192.0.0.128.9978 > 192.0.0.64.9979: UDP, length 20

This is “Hikvision handshake”. Without it device will NOT try to download firmware from tftp.

The Hikvision TFTP handshake (for both cameras and NVRs) is stupid but easy enough. The client sends a particular packet to the server’s port 9978 from the client port 9979 and expects the server to echo it back. Once that happens, it proceeds to send a tftp request (on the standard tftp port, 69) for a specific file, which it then installs. The tftp server must reply from port 69

So.. After 2 years of bricked state my cam is alive again.