IP2M-841 Camera Auto-assigns IP Address 192.168.0.108

[Erik]

A few days ago, I discovered an unexpected device on my home network. I have my router set to address 192.168.0.150 and the DHCP pool set to start at address 192.168.0.151. Upon doing a network scan, I saw a device responding to pings at address 192.168.0.108. Since this address is below my router's DHCP pool and I don't have any static IP addresses on my network, this was obviously unexpected.

I looked up the MAC address associated with 192.168.0.108, and it was the MAC address for the ethernet port (hardwire) one of my IP2M-841 cameras. This camera was set to a reserved address (192.168.0.206) in my router's DHCP settings, and is connected via a Cat6 ethernet cable to the router. I could ping both addresses 192.168.0.206 and 192.168.0.108 and got valid responses. I also pointed my web browser to each address (including the non-standard port number for that camera) and was able to log into the camera with my credentials. The TCP/IP page of the camera's setup reported a DHCP assigned address of 192.168.0.206, no matter which IP address I pointed my web browser to.

Thinking the camera may have been hacked, I unplugged the power from the camera. Then I pinged 192.168.0.108 again. I still got a valid response. I checked the MAC address of the responding device and it was the MAC address for the ethernet (hardwire port) of my OTHER IP2M-841 camera! I found I could log into that camera via address 192.168.0.108 at this point, even though its DHCP-assigned address (that works as well) was 192.168.0.207

I unplugged that camera as well. Then nothing on my network responded to pings at 192.168.0.108. At this point, the only cameras on the network were an IP4M-1024E and an IP2M-841E, both of which were/are working properly as far as I can tell.

All 4 of my cameras are connected via Cat6 Ethernet cables, have their WiFi interfaces disabled and are assigned reserved IP addresses by my router, which is a Netgear Nighthawk R7000

To isolate the extra-IP-address problem, I've tried the following:

• Confirm latest firmware installed for all cameras and router Result: they have the latest firmware
• Reset the cameras to their factory default settings (described above).Result: problem still exists (cameras respond to 192.168.0.108 as well as reserved IP address).
• Unplug my cable modem and do a full reset of my network by removing power to all devices, powering on the router (LAN-only with no internet connection), and then powering on the other LAN- and WiFi-based devices. Result: problem still exists (cameras respond to 192.168.0.108 as well as reserved IP address).
• Do a hard reset of the IP2M-841 cameras (hold button on back until factory defaults restored), and then let the cameras reconnect to the network. Result: problem still exists (cameras respond to 192.168.0.108 as well as reserved IP address). This should mean that no device outside my network is somehow assigning address 192.168.0.108 to my camera(s).

At this point, I have observed BOTH IP2M-241 cameras behaving the same way, the behavior is repeatable, and the behavior occurs when the cameras are restored to their default settings. Given that the behavior occurs with the freshly-factory-reset cameras, I think the only way for this to be a hacked camera is if a hacker was able to overwrite the factory settings the ROM/NVRAM in the camera... assuming that's even possible. Thus, I'm leaning toward this being a bug in the camera.

My main concern is assessing whether these cameras have a security problem associated with responding to an IP address that the network infrastructure did not provide. Amcrest tech support: are you able to reproduce this behavior internally? What thoughts do you have on how this behavior occurs?

[Erik]

To rule out anything specific to my network causing this problem I tried a minimal network configuration with both a router and a camera reset to factory default setting. I grabbed an old router and tried having only these devices connected via physical cables:

1. Linksys WRT54G router
2. Win10 PC
3. Amcrest IP2M-841 camera

Here's what I did:

1. Hard reset router
2. Connect PC to router's ethernet port
3. Via PC login, set router to 192.168.0.200
4. Set DHCP pool to 192.168.0.201 (default 50 devices)
5. Disable Wireless Networking in router
6. Reboot router
7. Reboot PC
8. Confirm PC has address 192.168.0.201 and can log into router
9. Hard reset IP2M-841 camera
10. Connect IP2M-841 camera to router's ethernet port
11. Observe camera is accessible from both 192.168.0.202 (expected DHCP) AND 192.168.0.108 (unexpected, and not assigned via router)
12. Ping address 192.168.0.108 (it responds)
13. Observe camera's MAC address is listed for both IP address, and both IP addresses are listed as dynamic. When looking at ARP table

Here's what I get from my PC when I look up addresses on this network:

Code: Select all

C:>arp -a



Interface: 192.168.0.201 --- 0xb

  Internet Address      Physical Address      Type

  192.168.0.108         9c-8e-cd-XX-XX-X7     dynamic

  192.168.0.200         <My Router's MAC>     dynamic

  192.168.0.202         9c-8e-cd-XX-XX-X7     dynamic

  192.168.0.255         ff-ff-ff-ff-ff-ff     static
  

This is what I see from the camera's configuration page when I point a web browser to the unexpected IP address (192.168.0.108):

Amcrest Unexpected IP Address.png (48.64 KiB) Viewed 6601 times

[mikedj]

I have a new Amcrest system that I've been using over the last few weeks. I'm not sure this will help you, but I've made some observations related to IP addresses with my system.

I noticed with my Wifi cameras, even with Wifi disabled and the camera hard wired with Cat5 cable, I can still access the cameras via both the Wifi IP address and the Wired address from a browser on the LAN. Disabling Wifi seems to stop the camera from searching for a Wifi access point, but does not disable the Wifi IP address.

On the Network Settings, TCP/IP page for your camera, use the pull down menu next to Ethernet Card to check the Wifi Settings and see if it's set for Static or DHCP, and which IP address is assigned. Does that shed any light on your situation?

Mike

[pfrankersons]

Mike,

I had the same issue as yours but with an IP3M-956W camera. Your screenshot was exactly what my camera showed. I couldn't get any static IP to stick. My router would recognize the camera's mac address, but not the ip address. The only trick that worked was turning dhcp on the camera and making my dlink dir-868L router kick out the same IP address every time the camera rebooted.

[JShaw30]

If you discover the camera by SNMP it has a 2nd network interface assigned to 192.168.0.108