Restoring bricked ip-camera Hikvision DS-2CD2132-I

According to manual Hikvision NVRs and IP cameras at boot trying to download firmware from tftp server.
Device address is, server address is

Running tcpdump on interface shows ARP requests. Fine. Device is not fully dead.

ARP, Request who-has tell, length 46
ARP, Reply is-at [mac_address], length 28

But it does not try to download digicap.dav at all from server…

Run tcpdump again and found @strange@ UDP to 9978 port. But tftpd is at 69..

IP > UDP, length 20

Google knows all, so, here is an answer:

IP > UDP, length 20
IP > UDP, length 20

This is “Hikvision handshake”. Without it device will NOT try to download firmware from tftp.

The Hikvision TFTP handshake (for both cameras and NVRs) is stupid but easy enough. The client sends a particular packet to the server’s port 9978 from the client port 9979 and expects the server to echo it back. Once that happens, it proceeds to send a tftp request (on the standard tftp port, 69) for a specific file, which it then installs. The tftp server must reply from port 69

So.. After 2 years of bricked state my cam is alive again.

Залишити відповідь

Ваша e-mail адреса не оприлюднюватиметься. Обов’язкові поля позначені *