com.overset.dev» Blog Archive » Canon Network Camera Control Protocol Hack

1.24.07

Canon Network Camera Control Protocol Hack - VB-C50i Control Port Communication

UPDATE 10/10/2007 - Put together a very simple Coldfusion script that can control a camera by connecting directly to the cam, taking control of it, and sending binary control data. Here’s the example source:

<!--- Access the Java Thread class (for sleep) --->

<cfset thread = createObject("java", "java.lang.Thread")>

<!--- Create a default TCP socket connection to the camera --->

<cfset sock = createObject("java", "java.net.Socket").init("10.0.0.20", 65311)>

<!--- Ensure that we are connected to the camera --->

<cfif sock.isConnected()>

    <!--- Create a simple binary output stream, for writing to the camera's control port --->

    <cfset sWriteStream = createObject("java", "java.io.DataOutputStream").init(sock.getOutputStream())>

    <!--- Send the "Authentication" aka "handshake" command to the camera so that we can control it --->

    <cfset sWriteStream.write(BinaryDecode("00000000002100010000000000000000", "Hex"), 0, 16)>

    <!--- Send the camera to upper left zoomed in: PAN 170.00deg + TILT 10.01deg + ZOOM 41.26deg --->

    <cfset sWriteStream.write(BinaryDecode("00000000003300E0426803E9101E0000", "Hex"), 0, 16)>

    <!--- make the controls wait for 5 seconds --->

    <cfset thread.sleep(5000)>

    <!--- Send the camera back to center zoomed in: PAN 0.00deg + TILT 0.00deg + ZOOM 41.26deg --->

    <cfset sWriteStream.write(BinaryDecode("00000000003300E0FFFFFFFF101E0000", "Hex"), 0, 16)>

    <!--- cleanup - close the output stream and the socket connection --->

    <cfset sWriteStream.close()>

    <cfset sock.close()>

<cfelse>

    Cannot connect to the camera's control port

</cfif>

Download this code: camera_control-coldfusion.cfm

Another goal of mine was to be able to control a Canon VB-series Network Camera that has controllable Pan, Tilt and Zoom functionality. I wanted to figure out how to access the camera directly through it’s proprietary “Control” port which defaults to 65311.

After analyzing the traffic sent over this port - the protocol has proven to be rather easy to use. A single 16byte TCP packet controls the camera’s Pan, Tilt and Zoom. The 16byte command is outlined in the following packet breakdown:

This is just a note sent to outline my initial findings. This is specific to the “VB-C50i” cameras. The maximum Pan, Tilt and Zoom values should be outlined in the manual - and the “33|00|E0″ command works for the VB-C10i camera as well.

Other functions used over this control protocol need to be determined, such as:

how to authenticate with the camera
the backlight on/off (for the VB-C50 series)
keepalive connection

Notes:

The socket - once created and authenticated - needs to remain open in order to send multiple commands
If the socket is closed and the camera is setup to return to “home” after a connection is lost - it will
The applet takes precedence when allowing users to control the camera - and commands sent via the control protocol are ignored.
A user with an open socket can control the camera only if there is noone controlling it through the applet (which controls the camera via HTTP)

… More to come …

dirk maas on 4.9.08 at 2pm

This is looks very promising, as Canon VB-C50iR is good hardware with crappy firmware. I guess nobody dares to make a paperweight from his camera by force-flashing Axis PTZ 213 firmware?
This may be of interest, though:
http://www.daantje.nl/2007/05/07/convert-axis-webcam-stream-to-flash-swfflv/

dirk maas on 4.12.08 at 2pm

another interesting find:
http://www.shawnhogan.com/2006/08/canon-vb-50i-php-control-class.html

dirk maas on 4.22.08 at 2am

one more if you don’t mind.
http://www.realitystorm.com/experiments/flash/streamingFLV/index.cfm

Jim Palmer on 4.22.08 at 11am

the shawnhogan writeup uses the built-in web server on the cameras which is very effective. This might actually be a better avenue when trying to build a front-end to control the cameras one user at a time.

the realitystorm writeup is rad too - I just haven’t gotten as far as to even come close to finishing this project let alone really start coding the front-end piece.

Good finds - keep them coming - you’re helping me start to pseudo-code my front-end from these links!

dirk maas on 5.7.08 at 10pm

if you are on mac, use securityspy as a server http://www.securityspy.com/ It has it’s own code versus LiveScope WebView. My concern is to find if VB-C50iR is capable of any Axis 213PTZ features and formats, though. Like native FLV stream. Control can take place via another layer and session management on the proxy/streaming server (Darwin streaming server, red5, ffmpg, whatever). Actually I was hoping for you to do some more dissection of the Canon. I’ll drop by with ne finds on my side - if we don’t switch to Axis.

5 Comments