Skip to content

Flag cloud/app cameras by MAC OUI, not just open ports #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
holzmanshmuel wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Flag cloud/app cameras by MAC OUI, not just open ports #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ Built for a real situation: you walk into a hotel room, Airbnb, or rental and wa

## What it does

1. **Discover** — maps every live device on the local `/24`, reads each MAC, and tags it `[VENDOR]` (real hardware, could be a camera) vs `[RANDOM]` (a phone/laptop using MAC randomization). Scans each host for camera/DVR ports (RTSP 554, ONVIF 8000, and cheap-DVR ports 34567/37777/8899…).
1. **Discover** — maps every live device on the local `/24`, reads each MAC, and tags it `[VENDOR]` (real hardware, could be a camera) vs `[RANDOM]` (a phone/laptop using MAC randomization). Scans each host for camera/DVR ports (RTSP 554, ONVIF 8000, and cheap-DVR ports 34567/37777/8899…), **and** matches each MAC's manufacturer (OUI) against a bundled list of known camera vendors — so it also flags **cloud/app cameras that expose no local port** (most modern consumer cams and cheap "spy cams" stream outbound to an app; a port scan alone never sees them).
2. **Fingerprint** — sends `OPTIONS * RTSP/1.0` to read the device's `Server:` header (usually names the vendor: TVT, Dahua, Hikvision…), then brute-forces a large RTSP path dictionary to find the live stream URL.
3. **Pull frames** — enumerates DVR channels and grabs a clean frame from each with `ffmpeg`, so you can *see* the view (street? stairwell? your bedroom? your balcony?).
4. **Classify & report** — outdoor CCTV vs indoor common area vs 🚩 private space, whether audio (a mic) is present, with timestamped frames as evidence.
Expand Down Expand Up @@ -43,7 +43,8 @@ bash scripts/grab.sh 'rtsp://10.0.0.50:554/chID={CH}&streamType=main' 8
| File | Purpose |
|------|---------|
| `SKILL.md` | Skill definition + step-by-step workflow for the agent |
| `scripts/scan.sh` | Network discovery, MAC classification, camera-port scan |
| `scripts/scan.sh` | Network discovery, MAC classification, camera-port scan + vendor-OUI flag |
| `scripts/camera_ouis.txt` | Offline MAC-OUI → known-camera-vendor list (from the IEEE registry) |
| `scripts/rtsp_probe.pl` | RTSP vendor fingerprint + stream-path brute-force |
| `scripts/grab.sh` | Per-channel `ffmpeg` frame capture |

Expand Down
12 changes: 9 additions & 3 deletions SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,16 @@ Run the steps in order. Scripts live in `scripts/` next to this file — resolve
```bash
bash "$SKILL_DIR/scripts/scan.sh"
```
Prints: your interface/IP/gateway/SSID, every live host with its MAC, a **[RANDOM]** vs **[VENDOR]** tag per MAC, and any open camera ports per host.
Prints: your interface/IP/gateway/SSID, every live host with its MAC, a **[RANDOM]** vs **[VENDOR]** tag per MAC, any open camera ports per host, and — new — a **known-camera-vendor** flag derived from the MAC's manufacturer (OUI).

- **[RANDOM]** MACs (locally-administered bit set) = phones/laptops with MAC randomization → almost never cameras.
- **[VENDOR]** MACs with a camera port open (554/8000/8554/34567/37777/8899…) = **suspects**.
Two independent ways a host gets flagged as a suspect:
- **`<<< CAMERA-LIKE PORT`** — a **[VENDOR]** MAC with a camera/DVR port open (554/8000/8554/34567/37777/8899…). These are **local-stream** cameras (RTSP/ONVIF/DVR) → go to Step 2 to pull the feed.
- **`>>> KNOWN CAMERA VENDOR` / `>>> CAMERA-CAPABLE MODULE`** — the MAC's manufacturer is a known camera maker (`CAM`, e.g. Hikvision/Dahua/IMILAB/Wyze/Reolink) or a WiFi-module maker common in cheap cams (`MODULE`, e.g. Shenzhen Bilian/Tuya — also used in bulbs/plugs, so "verify"). **This catches cloud/app cameras that expose NO local port** — the kind the port scan alone misses (most modern consumer cams and cheap "spy cams" stream *outbound* to an app, so there's no port to find). Vendor list: `scripts/camera_ouis.txt` (offline, from the IEEE OUI registry; not exhaustive).

Interpreting the two together:
- **VENDOR-vendor-flagged _with_ a camera port** = strongest signal; fingerprint it (Step 2).
- **Vendor-flagged with _no_ open port** = likely a cloud/app cam. The scan can't see its video (it's not serving locally). Account for it (your own gear?) or confirm with a **physical lens sweep** (below). Skip Step 2 — there's no local stream to probe.
- **[RANDOM]** MACs (locally-administered bit set) = phones/laptops with MAC randomization → almost never cameras. Note: a camera using MAC randomization won't match the vendor list either — another reason the physical sweep matters.
- The gateway with port 80 is just the router — normal.

### 2. Fingerprint each suspect
Expand Down
253 changes: 253 additions & 0 deletions scripts/camera_ouis.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,253 @@
# camera_ouis.txt — MAC OUI (first 3 octets) -> known camera / camera-module vendors.
# Used by scan.sh to flag app/cloud cameras that expose NO local port (RTSP scan misses them).
# Format: OUI<TAB>TIER<TAB>Vendor
# CAM = dedicated camera / surveillance / baby-monitor maker (high confidence)
# MODULE = WiFi-module maker common inside cheap no-name cams (also bulbs/plugs -> "verify")
# Source: IEEE OUI registry via Wireshark 'manuf'. Not exhaustive; MAC randomization/private OUIs won't match.
00:02:D1 CAM Vivotek, Inc.
00:03:C5 CAM Mobotix AG
00:1F:54 CAM Lorex Technology Inc.
00:33:7A MODULE Tuya Smart Inc.
00:40:8C CAM Axis Communications AB
00:65:1E CAM Amcrest Technologies
00:BC:99 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
04:03:12 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
04:EE:CD CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
08:3B:C1 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
08:54:11 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
08:A1:89 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
08:CC:81 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
08:EA:40 MODULE Shenzhen Bilian Electronic Co.，Ltd
08:ED:ED CAM Zhejiang Dahua Technology Co., Ltd.
0C:75:D2 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
0C:8C:24 MODULE Shenzhen Bilian Electronic Co.，Ltd
0C:A6:4C CAM Hangzhou Ezviz Software Co.,Ltd.
0C:CF:89 MODULE Shenzhen Bilian Electronic Co.，Ltd
10:12:FB CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
10:5A:17 MODULE Tuya Smart Inc.
10:A4:BE MODULE Shenzhen Bilian Electronic Co.，Ltd
10:D5:61 MODULE Tuya Smart Inc.
14:0A:02 MODULE Shenzhen Bilian Electronic Co.，Ltd
14:5D:34 MODULE Shenzhen Bilian Electronic Co.，Ltd
14:6B:9C MODULE Shenzhen Bilian Electronic Co.，Ltd
14:A7:8B CAM Zhejiang Dahua Technology Co., Ltd.
18:68:CB CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
18:69:D8 MODULE Tuya Smart Inc.
18:80:25 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
18:DE:50 MODULE Tuya Smart Inc.
1C:90:FF MODULE Tuya Smart Inc.
20:2C:05 CAM Zhejiang Dahua Zhilian Co.,Ltd
20:32:33 MODULE Shenzhen Bilian Electronic Co.，Ltd
20:BB:BC CAM Hangzhou Ezviz Software Co.,Ltd.
20:F1:B2 MODULE Tuya Smart Inc.
20:F4:1B MODULE Shenzhen Bilian Electronic Co.，Ltd
24:0F:9B CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
24:28:FD CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
24:32:AE CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
24:48:45 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
24:52:6A CAM Zhejiang Dahua Technology Co., Ltd.
24:B1:05 CAM Prama Hikvision India Private Limited
28:57:BE CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
28:F3:66 MODULE Shenzhen Bilian Electronic Co.，Ltd
2C:A5:9C CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
2C:AA:8E CAM Wyze Labs Inc
2C:B4:71 MODULE Tuya Smart Inc.
2C:C3:E6 MODULE Shenzhen Bilian Electronic Co.，Ltd
30:48:7D MODULE Tuya Smart Inc.
30:7B:C9 MODULE Shenzhen Bilian Electronic Co.，Ltd
30:DD:AA CAM Zhejiang Dahua Technologyco.,Ltd
34:09:62 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
34:7D:E4 MODULE Shenzhen Bilian Electronic Co.，Ltd
34:C6:DD CAM Hangzhou Ezviz Software Co.,Ltd.
38:01:46 MODULE Shenzhen Bilian Electronic Co.，Ltd
38:1F:8D MODULE Tuya Smart Inc.
38:2C:E5 MODULE Tuya Smart Inc.
38:7A:CC MODULE Shenzhen Bilian Electronic Co.，Ltd
38:A5:C9 MODULE Tuya Smart Inc.
38:AF:29 CAM Zhejiang Dahua Technology Co., Ltd.
3C:0B:59 MODULE Tuya Smart Inc.
3C:1B:F8 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
3C:33:00 MODULE Shenzhen Bilian Electronic Co.，Ltd
3C:E3:6B CAM Zhejiang Dahua Technology Co., Ltd.
3C:EF:8C CAM Zhejiang Dahua Technology Co., Ltd.
40:7A:A4 CAM Zhejiang Dahua Technologyco.,Ltd
40:AC:BF CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
40:B5:70 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
44:01:BB MODULE Shenzhen Bilian Electronic Co.，Ltd
44:19:B6 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
44:33:4C MODULE Shenzhen Bilian Electronic Co.，Ltd
44:47:CC CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
44:A6:42 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
44:B4:23 CAM Hanwha Vision Vietnam Company Limited
44:EA:54 CAM Udisense Dba Nanit
48:62:64 CAM Arlo Technology
48:78:5B CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
48:EA:63 CAM Zhejiang Uniview Technologies Co., Ltd.
4C:11:BF CAM Zhejiang Dahua Technology Co., Ltd.
4C:1F:86 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
4C:62:DF CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
4C:99:E8 CAM Zhejiang Dahua Technologyco.,Ltd
4C:A9:19 MODULE Tuya Smart Inc.
4C:BD:8F CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
4C:F5:DC CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
50:8A:06 MODULE Tuya Smart Inc.
50:8B:B9 MODULE Tuya Smart Inc.
50:E5:38 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
54:8C:81 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
54:C4:15 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
54:D6:0D CAM Hangzhou Ezviz Software Co.,Ltd.
54:EF:33 MODULE Shenzhen Bilian Electronic Co.，Ltd
58:03:FB CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
58:50:ED CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
58:8F:CF CAM Hangzhou Ezviz Software Co.,Ltd.
5C:34:5B CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
5C:F5:1A CAM Zhejiang Dahua Technology Co., Ltd.
60:7E:A4 CAM Shanghai Imilab Technology Co.Ltd
60:FB:00 MODULE Shenzhen Bilian Electronic Co.，Ltd
64:24:4D CAM Hangzhou Ezviz Software Co.,Ltd.
64:DB:8B CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
64:F2:FB CAM Hangzhou Ezviz Software Co.,Ltd.
64:FD:29 CAM Zhejiang Dahua Technology Co., Ltd.
68:57:2D MODULE Tuya Smart Inc.
68:6D:BC CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
6C:1C:71 CAM Zhejiang Dahua Technology Co., Ltd.
6C:D5:52 MODULE Shenzhen Bilian Electronic Co.，Ltd
6C:F1:7E CAM Zhejiang Uniview Technologies Co.,Ltd.
70:89:76 MODULE Tuya Smart Inc.
74:3F:C2 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
74:C9:29 CAM Zhejiang Dahua Technology Co., Ltd.
74:EE:2A MODULE Shenzhen Bilian Electronic Co.，Ltd
78:22:88 MODULE Shenzhen Bilian Electronic Co.，Ltd
78:A6:A0 CAM Hangzhou Ezviz Software Co.,Ltd.
78:C1:AE CAM Hangzhou Ezviz Software Co.,Ltd.
78:DF:72 CAM Shanghai Imilab Technology Co.Ltd
7C:78:B2 CAM Wyze Labs Inc
7C:A7:B0 MODULE Shenzhen Bilian Electronic Co.，Ltd
7C:F6:66 MODULE Tuya Smart Inc.
80:48:2C CAM Wyze Labs Inc
80:48:9F CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
80:64:7C MODULE Tuya Smart Inc.
80:7C:62 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
80:BE:AF CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
80:F5:AE CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
84:94:59 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
84:9A:40 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
84:E3:42 MODULE Tuya Smart Inc.
84:FC:14 MODULE Shenzhen Bilian Electronic Co.，Ltd
88:26:3F CAM Zhejiang Uniview Technologies Co.,Ltd.
88:49:2D MODULE Shenzhen Bilian Electronic Co.，Ltd
88:DE:39 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
8C:1D:55 CAM Hanwha NxMD (Thailand) Co., Ltd.
8C:22:D2 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
8C:E7:48 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
8C:E9:B4 CAM Zhejiang Dahua Technology Co., Ltd.
90:02:A9 CAM Zhejiang Dahua Technology Co., Ltd.
94:BA:06 MODULE Shenzhen Bilian Electronic Co.，Ltd
94:E1:AC CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
94:EC:13 CAM Hangzhou Ezviz Software Co.,Ltd.
94:F8:27 CAM Shanghai Imilab Technology Co.Ltd
98:03:CF MODULE Shenzhen Bilian Electronic Co.，Ltd
98:8B:0A CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
98:9D:E5 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
98:DF:82 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
98:F1:12 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
98:F9:CC CAM Zhejiang Dahua Technology Co., Ltd.
9C:14:63 CAM Zhejiang Dahua Technology Co., Ltd.
9C:8E:CD CAM Amcrest Technologies
A0:60:32 CAM Amcrest Technologies
A0:92:08 MODULE Tuya Smart Inc.
A0:9F:10 MODULE Shenzhen Bilian Electronic Co.，Ltd
A0:BD:1D CAM Zhejiang Dahua Technology Co., Ltd.
A0:FF:0C CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
A4:11:62 CAM Arlo Technology
A4:14:37 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
A4:29:02 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
A4:4B:D9 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
A4:A4:59 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
A4:D5:C2 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
A8:80:55 MODULE Tuya Smart Inc.
A8:B5:8E MODULE Shenzhen Bilian Electronic Co.，Ltd
A8:CA:87 CAM Zhejiang Dahua Zhilian Co.,Ltd
AC:1C:26 CAM Hangzhou Ezviz Software Co.,Ltd.
AC:A2:13 MODULE Shenzhen Bilian Electronic Co.，Ltd
AC:B9:2F CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
AC:CB:51 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
AC:CC:8E CAM Axis Communications AB
B0:FF:0D CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
B4:10:1C CAM Shanghai Imilab Technology Co.Ltd
B4:4C:3B CAM Zhejiang Dahua Technology Co., Ltd.
B4:6D:C2 MODULE Shenzhen Bilian Electronic Co.，Ltd
B4:A3:82 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
B8:06:0D MODULE Tuya Smart Inc.
B8:88:80 CAM Shanghai Imilab Technology Co.Ltd
B8:A4:4F CAM Axis Communications AB
BC:29:78 CAM Prama Hikvision India Private Limited
BC:32:5F CAM Zhejiang Dahua Technology Co., Ltd.
BC:35:1E MODULE Tuya Smart Inc.
BC:51:FE CAM Swann communications Pty Ltd
BC:5E:33 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
BC:9B:5E CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
BC:AD:28 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
BC:BA:C2 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
C0:39:5A CAM Zhejiang Dahua Technology Co., Ltd.
C0:51:7E CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
C0:56:E3 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
C0:6D:ED CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
C0:F8:53 MODULE Tuya Smart Inc.
C4:2F:90 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
C4:3C:B0 MODULE Shenzhen Bilian Electronic Co.，Ltd
C4:79:05 CAM Zhejiang Uniview Technologies Co.,Ltd.
C4:82:E1 MODULE Tuya Smart Inc.
C4:AA:C4 CAM Zhejiang Dahua Technology Co., Ltd.
C8:A7:02 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
C8:FE:0F MODULE Shenzhen Bilian Electronic Co.，Ltd
CC:13:F3 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
CC:64:1A MODULE Shenzhen Bilian Electronic Co.，Ltd
CC:8C:BF MODULE Tuya Smart Inc.
D0:32:E7 MODULE Tuya Smart Inc.
D0:3F:27 CAM Wyze Labs Inc
D0:82:E8 MODULE Tuya Smart Inc.
D0:82:EB MODULE Tuya Smart Inc.
D4:43:0E CAM Zhejiang Dahua Technology Co., Ltd.
D4:A6:51 MODULE Tuya Smart Inc.
D4:E8:53 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
D8:1F:12 MODULE Tuya Smart Inc.
D8:C8:0C MODULE Tuya Smart Inc.
D8:D6:68 MODULE Tuya Smart Inc.
D8:FC:92 MODULE Tuya Smart Inc.
DC:07:F8 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
DC:D2:6A CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
E0:2E:FE CAM Zhejiang Dahua Technology Co., Ltd.
E0:50:8B CAM Zhejiang Dahua Technology Co., Ltd.
E0:B9:4D MODULE Shenzhen Bilian Electronic Co.，Ltd
E0:BA:AD CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
E0:CA:3C CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
E0:DF:13 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
E4:24:6C CAM Zhejiang Dahua Technology Co., Ltd.
E4:30:22 CAM Hanwha Vision VietNam
E4:AE:E4 MODULE Tuya Smart Inc.
E4:D5:8B CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
E8:27:25 CAM Axis Communications AB
E8:A0:ED CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
EC:3D:FD MODULE Shenzhen Bilian Electronic Co.，Ltd
EC:71:DB CAM Reolink Innovation Limited
EC:97:E0 CAM Hangzhou Ezviz Software Co.,Ltd.
EC:A9:71 CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
EC:C8:9C CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
F0:C8:14 MODULE Shenzhen Bilian Electronic Co.，Ltd
F0:C8:8B CAM Wyze Labs Inc
F4:70:18 CAM Hangzhou Ezviz Software Co.,Ltd.
F4:B1:C2 CAM Zhejiang Dahua Technology Co., Ltd.
F8:17:2D MODULE Tuya Smart Inc.
F8:4D:FC CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
F8:CE:07 CAM Zhejiang Dahua Technologyco.,Ltd
F8:F6:B7 MODULE Shenzhen Bilian Electronic Co.，Ltd
FC:23:CD MODULE Shenzhen Bilian Electronic Co.，Ltd
FC:24:22 CAM Hangzhou Ezviz Software Co.,Ltd.
FC:37:6D MODULE Shenzhen Bilian Electronic Co.，Ltd
FC:3C:D7 MODULE Tuya Smart Inc.
FC:5F:49 CAM Zhejiang Dahua Technology Co., Ltd.
FC:67:1F MODULE Tuya Smart Inc.
FC:9C:98 CAM Arlo Technology
FC:9F:FD CAM Hangzhou Hikvision Digital Technology Co.,Ltd.
FC:B6:9D CAM Zhejiang Dahua Technology Co., Ltd.
38 changes: 37 additions & 1 deletion scripts/scan.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,23 @@
# No nmap required. macOS + Linux.
set -u

# --- locate our own dir + the camera-vendor OUI database (offline, no network calls) ---
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
OUI_DB="$SCRIPT_DIR/camera_ouis.txt"

# normalize a MAC's first 3 octets to zero-padded uppercase OUI (arp strips leading zeros)
oui_of() {
local o1 o2 o3
o1=$(printf '%s' "$1" | cut -d: -f1); o2=$(printf '%s' "$1" | cut -d: -f2); o3=$(printf '%s' "$1" | cut -d: -f3)
printf '%02X:%02X:%02X' "0x${o1:-0}" "0x${o2:-0}" "0x${o3:-0}" 2>/dev/null
}

# look up an OUI in the vendor DB -> prints "TIER<TAB>Vendor" if a known camera vendor, else nothing
cam_vendor() {
[ -f "$OUI_DB" ] || return 1
grep -i "^$1 " "$OUI_DB" 2>/dev/null | head -1 | cut -f2,3
}

# --- locate interface / IP / gateway / SSID ---
if command -v route >/dev/null 2>&1 && route -n get default >/dev/null 2>&1; then
IFACE=$(route -n get default 2>/dev/null | awk '/interface:/{print $2}')
Expand Down Expand Up @@ -68,6 +85,14 @@ arp -a -n 2>/dev/null | grep -oE "\(${SUBNET}\.[0-9]+\) at ([0-9a-f]{1,2}:){5}[0
# scan ports
open=""
for p in $PORTS; do check_port "$ip" "$p" && open="$open $p"; done

# camera-vendor lookup by MAC OUI — catches cloud/app cams that expose NO local port
vtier=""; vname=""
if [ "$kind" != "[ROUTER]" ]; then
vinfo=$(cam_vendor "$(oui_of "$mac")")
if [ -n "$vinfo" ]; then vtier=$(printf '%s' "$vinfo" | cut -f1); vname=$(printf '%s' "$vinfo" | cut -f2); fi
fi

# flag camera-like ports — but never on the router (its admin ports aren't cameras)
flag=""
if [ "$kind" != "[ROUTER]" ]; then
Expand All @@ -76,6 +101,17 @@ arp -a -n 2>/dev/null | grep -oE "\(${SUBNET}\.[0-9]+\) at ([0-9a-f]{1,2}:){5}[0

printf " %-14s %-18s %-9s%s\n" "$ip" "$mac" "$kind" "$tag"
[ -n "$open" ] && printf " open ports:%s%s\n" "$open" "$flag"
if [ -n "$vname" ]; then
if [ "$vtier" = "CAM" ]; then
printf " >>> KNOWN CAMERA VENDOR: %s (app/cloud cam — may expose NO local port)\n" "$vname"
else
printf " >>> CAMERA-CAPABLE MODULE: %s (verify — module also used in bulbs/plugs)\n" "$vname"
fi
fi
done
echo "--------------------------------------------------"
echo "Next: perl rtsp_probe.pl <IP> on any [VENDOR] host with a camera-like port."
echo "Suspects = any host tagged <<< CAMERA-LIKE PORT or >>> KNOWN CAMERA VENDOR / CAMERA-CAPABLE MODULE."
echo "Next:"
echo " • camera-like port -> perl rtsp_probe.pl <IP> (fingerprint + find the stream)"
echo " • vendor-flagged, no open port -> likely a cloud/app cam that streams outbound; the network"
echo " scan can't see its video. Account for it (your own gear?) or confirm with a physical lens sweep."