海康相机IP搜索协议研究

项目中使用了海康相机用于拍照功能，要访问海康相机就需要知道相机的IP，一般我们通过配置文件将IP地址传入程序中，在调用其官方SDK进行拍照。每次都需要手工配置IP地址，每次现场安装实施都要配置，非常容易配置错误。所以如果软件能够自动搜索相机，并自动配置，免去手工配置的麻烦和易出错，可以增强软件的可靠性，降低部署复杂度。

分析之后想到，海康官方有提供一个相机IP修改的工具，功能强大，只要在局域网中，即使不在一个IP段也能搜索到相机。如果我们的程序也能够实现该功能，能否实现前面的设想？

根据这个想法，我觉得可以分析下其IP搜索通信协议。

通过使用wireshark抓包工具，发现其IP搜索使用了两种通信方式，一种是UDP广播，另一种是更加底层的通信方式，直接通过网卡发送广播包。实测时发现，两种通信方式功能基本相同，都能够所搜IP，修改配置。直接使用网卡发包的方式比UDP广播的方式貌似兼容相机多些。

UDP广播：

UDP广播通信方式，搜索工具会向IP：239.255.255.250，端口号：37020进行广播，通信内容为xml格式字符串，例如以下内容。各个字段含义已经比较清晰了。

/* 以下是海康相机UDP协议
 * 用于搜索相机和修改IP
 * 广播地址：239.255.255.250
 * 端口号：37020
 */


 搜索相机广播请求
<?xml version="1.0" encoding="utf-8"?>

<Probe>
  <Uuid>AB2CC373-2332-4F7B-AA18-838E08E748AE</Uuid>
  <Types>inquiry</Types>
</Probe>


 搜索相机返回结果
<?xml version="1.0" encoding="utf-8"?>

<ProbeMatch>
  <Uuid>AB2CC373-2332-4F7B-AA18-838E08E748AE</Uuid>  
  <Types>inquiry</Types>  
  <DeviceType>140063</DeviceType>  
  <DeviceDescription>DS-2CD5A26FWD-IZ</DeviceDescription>  
  <DeviceSN>DS-2CD5A26FWD-IZ20160518AACH604074182</DeviceSN>  
  <CommandPort>8000</CommandPort>  
  <HttpPort>80</HttpPort>  
  <MAC>bc-ad-28-53-85-e8</MAC>  
  <IPv4Address>172.16.16.191</IPv4Address>  
  <IPv4SubnetMask>255.255.255.0</IPv4SubnetMask>  
  <IPv4Gateway>172.16.16.1</IPv4Gateway>  
  <IPv6Address>::</IPv6Address>  
  <IPv6Gateway>::</IPv6Gateway>  
  <IPv6MaskLen>0</IPv6MaskLen>  
  <DHCP>false</DHCP>  
  <AnalogChannelNum>0</AnalogChannelNum>  
  <DigitalChannelNum>1</DigitalChannelNum>  
  <SoftwareVersion>V5.3.8build 151223</SoftwareVersion>  
  <DSPVersion>V7.3 build 151218</DSPVersion>  
  <BootTime>2016-08-01 17:04:52</BootTime>  
  <ResetAbility>false</ResetAbility>  
  <DiskNumber>0</DiskNumber>  
  <Activated>true</Activated>  
  <PasswordResetAbility>true</PasswordResetAbility>  
  <PasswordResetModeSecond>true</PasswordResetModeSecond> 
</ProbeMatch>





 修改相机参数请求
<?xml version="1.0" encoding="utf-8"?>

<Probe>
  <Uuid>21A9F613-5E4F-41DF-B821-E36523087D1D</Uuid>
  <Types>update</Types>
  <MAC>28-57-be-af-7a-14</MAC>
  <Password>/RsWjdUa5zJ3OQWH6zy00w==</Password>
  <IPv4Address>172.16.16.190</IPv4Address>
  <CommandPort>8000</CommandPort>
  <HttpPort>80</HttpPort>
  <IPv4SubnetMask>255.255.255.0</IPv4SubnetMask>
  <IPv4Gateway>172.16.16.190</IPv4Gateway>
  <IPv6Address>::</IPv6Address>
  <IPv6Gateway>::</IPv6Gateway>
  <IPv6MaskLen>0</IPv6MaskLen>
  <DHCP>false</DHCP>
</Probe>


 修改相机参数成功
<?xml version="1.0" encoding="utf-8"?>

<ProbeMatch>
  <Uuid>AB2CC373-2332-4F7B-AA18-838E08E748AE</Uuid>  
  <Types>update</Types>  
  <Result>success</Result>  
  <DeviceType>140063</DeviceType>  
  <DeviceDescription>DS-2CD5A26FWD-IZ</DeviceDescription>  
  <DeviceSN>DS-2CD5A26FWD-IZ20160518AACH604074182</DeviceSN>  
  <CommandPort>8000</CommandPort>  
  <HttpPort>80</HttpPort>  
  <MAC>bc-ad-28-53-85-e8</MAC>  
  <IPv4Address>172.16.16.195</IPv4Address>  
  <IPv4SubnetMask>255.255.255.0</IPv4SubnetMask>  
  <IPv4Gateway>172.16.16.1</IPv4Gateway>  
  <IPv6Address>::</IPv6Address>  
  <IPv6Gateway>::</IPv6Gateway>  
  <IPv6MaskLen>0</IPv6MaskLen>  
  <DHCP>false</DHCP>  
  <AnalogChannelNum>0</AnalogChannelNum>  
  <DigitalChannelNum>1</DigitalChannelNum>  
  <SoftwareVersion>V5.3.8build 151223</SoftwareVersion>  
  <DSPVersion>V7.3 build 151218</DSPVersion>  
  <BootTime>2016-08-01 17:04:52</BootTime>  
  <ResetAbility>false</ResetAbility>  
  <DiskNumber>0</DiskNumber>  
  <Activated>true</Activated>  
  <PasswordResetAbility>true</PasswordResetAbility>  
  <PasswordResetModeSecond>true</PasswordResetModeSecond> 
</ProbeMatch>



 修改相机参数失败
<?xml version="1.0" encoding="utf-8"?>

<ProbeMatch>
  <Uuid>AB2CC373-2332-4F7B-AA18-838E08E748AE</Uuid>  
  <Types>update</Types>  
  <Result>failed</Result> 
</ProbeMatch>

其中密码部分进行了加密，加密方式为md5+base64，加密参考代码如下

	/**
	 * md5加密
	 * @param password
	 * @return
	 */
	public static byte[] md5(String password) {
		try{
			// MD5
			MessageDigest md = MessageDigest.getInstance("MD5");
			md.update(password.getBytes());
			byte[] digestedValue = md.digest();
			
			return digestedValue;
		}catch(Exception e){
			e.printStackTrace();
			return null;
		}
	}
	
	/**
	 * md5(base64)加密
	 * @param password
	 * @return
	 */
	public static String md5Base64(String password){
		try{
			// MD5
			byte[] digestedValue = md5(password);
			
			// base64
			BASE64Encoder encoder = new BASE64Encoder();
			return encoder.encode(digestedValue);
			
		}catch(Exception e){
			e.printStackTrace();
			return null;
		}
	}

网卡广播方式：

网卡广播的方式，其协议内容使用二进制格式，并不像UDP方式那么容易理解。对于其协议格式只破解了一部分，其中貌似有校验和的字段，其校验和的计算方式无法得知，导致并不能实际用该协议对相机参数进行修改。要能够使用网卡进行广播通信，还需要安装WinPcap（官方工具也装了这个），java的话还需要jPCAP才能进行底层通信。以下是部分协议解析结果：

// mac通信设备搜索
//21 02 01 42 00 00 1D 2C 06 04 03 00 21 82 50 7B 9D 73 44 73 AC 10 10 F4 FF FF FF FF FF FF 00 00 00 00 00 00 00 00 FE 80 00 00 00 00 00 00 9D 57 F5 8D 3B B0 78 EC 00 00 00 00 00 00 00 00 00 00 00 00 


// 貌似以下是mac地址通信接收的数据
//21 01 01 F6 00 00 1D 07 06 04 
//04 (04=inquiry,07=update)
//00 (结果：01=失败，02=成功)
//5B 44 
//C0 56 E3 7C B0 C4 (物理地址地址)
//AC 10 10 C1 (IP地址：172.16.16.193)
//FF FF FF FF FF FF 00 00 00 00 
//FF FF FE 00 (子网掩码:255.255.254.0)
//44 53 2D 32 43 44 32 34 31 32 46 2D 49 32 30 31 35 30 33 32 35 43 43 43 48 35 30 38 35 33 37 39 37 38 (设备序列号:DS-2CD2412F-I20150325CCCH508537978)
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 11 00 00 
//1F 40 (端口:8000)
//00 00 00 01 00 00 00 00 
//56 35 2E 31 2E 36 62 75 69 6C 64 20 31 34 30 36 31 32 (软件版本：V5.1.6build 140612)
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
//56 35 2E 30 2C 20 62 75 69 6C 64 20 31 34 30 34 31 31 (DSP版本:V5.0, build 140411)
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
//32 30 31 36 2D 30 38 2D 30 32 20 31 38 3A 31 37 3A 33 31 (启动时间：2016-08-02 18:17:31)
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 9C 9D 99 
//AC 10 10 01 (网关:172.16.16.1)
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 
//00 (DHCP：00=关，01=开) 
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
//50 (http端口:80)
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
//44 53 2D 32 43 44 32 34 31 32 46 2D 49 (设备类型：DS-2CD2412F-I)
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 


// mac通信修改信息
//21 02 01 42 00 00 26 19 06 04 06 00 33 16 50 7b 9d 73 44 73 
//ac 10 10 f4 (PC机IP(20)) 
//c0 56 e3 7c b0 c4 (mac地址(24))
//ac 10 11 87 (IP地址(30)：172.16.17.135)
//ff ff fe 00 (子网掩码(34)：255.255.254.0)
//82 7c cb 0e ea 8a 70 6c 4c 34 a1 68 91 f8 4e 7b (md5加密(38))
//00 00 1f 40 00 00 00 00 00 00 00 00 02 9c 02 41 (1f 40两个值可能是校验和)
//ac 10 10 01 (网关(70)：172.16.16.1)
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (IPV6地址(74))
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 (IPV6网关(90))
//00 (IPV6子网前缀长度(104))
//00 
//00 (DHCP(106))
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
//50 (http端口(137):80)
//00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

来源：oschina

链接：https://my.oschina.net/u/2450094/blog/791385

标签

海康

uuid