CamSniff

Authorized reconnaissance for IP cameras and network video endpoints.

Version 2.3.0

CamSniff combines active scanning, local service discovery, short packet captures, protocol probes, and a vendor catalogue into one reproducible camera inventory. It produces structured evidence instead of treating a common port as proof of a particular vendor or device type.

• Scans selected IPv4 addresses and CIDRs with Nmap and optional Masscan.
• Correlates RTSP, HTTP, ONVIF, SSDP, mDNS, HLS, RTMP, SRT, WebRTC, and optional CoAP signals.
• Verifies RTSP endpoints with bounded OPTIONS/DESCRIBE requests and parses SDP media tracks without authenticating or starting playback.
• Enumerates unauthenticated ONVIF identity, services, capabilities, scopes, network interfaces, and system time with a fixed six-request budget.
• Uses OUI, banner, path, and protocol evidence to rank vendor profiles.
• Loads declarative YAML vendor fingerprints that correlate HTTP, ONVIF, RTSP, SSDP, path, and OUI evidence without treating shared ports as identity.
• Tries bounded HTTP/RTSP credential candidates and validates captured media.
• Emits schema-versioned JSON, raw logs, optional reports, and thumbnails.
• Optionally synchronizes discovery and credential results into IVRE.

Version 2.3.0 turns CamSniff's discovery pipeline into an evidence-driven identification engine. Smart mode now plans follow-up work from the same confidence model used in reports, while native RTSP, expanded ONVIF, negative evidence, and YAML fingerprints improve both depth and false-positive control.

authorized targets
      │
      ├─ Nmap + optional Masscan
      ├─ SSDP/mDNS + short TShark capture
      ├─ focused UDP/HTTP/ONVIF probes
      │
      ▼
evidence correlation + confidence scoring
      │
      ├─ evidence-driven follow-up probe plan
      ├─ discovery.json
      ├─ bounded credential/media checks
      ├─ optional Markdown/HTML report
      └─ optional IVRE synchronization

Every discovered address is checked against the original target list before it can become a candidate or receive a follow-up probe. TShark request traffic is interpreted directionally so clients are not promoted as camera servers.

See Mode reference and Scanning configuration for exact rates, flags, and ports.

sudo apt install ./camsniff_2.3.0_all.deb
sudo camsniff --mode medium

The repository PKGBUILD packages the current checkout, making it suitable for release CI and local validation:

make arch-verify
make arch-package
sudo pacman -U packaging/arch/camsniff-2.3.0-1-any.pkg.tar.zst
sudo camsniff --mode medium

git clone https://github.com/John0n1/CamSniff.git
cd CamSniff
sudo ./bin/camsniff --mode medium

Missing required tools can be installed on the first run. Pass --skip-install when dependencies are managed by the operating system. coap-client is optional and is built only when make build-coap is requested.

Start with an explicit target file and disable credential attempts until the discovery output looks correct:

# targets.txt
192.168.50.20
192.168.50.32/28

sudo camsniff \
  --mode stealth \
  --targets targets.txt \
  --skip-credentials \
  --report markdown

JSON target files are also accepted:

{
  "targets": ["192.168.50.20", "192.168.50.32/28"]
}

If --targets is omitted, CamSniff uses the IPv4 prefix assigned to the default interface. It does not guess a /24 from the gateway address.

--mode <name>           Select stealth+, stealth, medium, aggressive, war, nuke
--targets <file>        Load authorized IPv4 addresses/CIDRs from JSON or text
--output-root <dir>     Choose the artifact base directory
--run-name <label>      Add a readable suffix to the timestamped run directory
--interface <iface>     Select the TShark capture interface
--skip-credentials      Disable credential and media acquisition attempts
--skip-install          Never invoke the dependency installer
--smart                 Prioritize deeper probes using the canonical evidence score
--ssdp-describe         Fetch in-scope SSDP device descriptions
--report <format>       Generate markdown, html, or both
--encrypt-results       Create an age/GPG encrypted archive after the run
--extra ivre            Set up and synchronize with IVRE
--yes                   Skip interactive confirmation

Run camsniff --help for the complete CLI contract.

Source checkouts write to dev/results/<timestamp>/. Installed packages write to /var/lib/camsniff/results/<timestamp>/. Override either with --output-root.

<run>/
├── discovery.json       canonical host and service evidence
├── credentials.json     canonical credential results, when enabled
├── report.md|html       redacted human-readable report
├── paths.json           vendor catalogue snapshot
├── thumbnails/          validated HTTP/RTSP captures
└── logs/                raw output from each discovery/probe phase

Run directories are owner-only (0700) and files inherit an owner-only umask. Rendered reports redact passwords and URL userinfo; credentials.json remains sensitive. Encryption creates an encrypted archive alongside the plaintext run directory, so remove or relocate plaintext only after independently verifying the archive.

Discovery schema version 2 represents transport explicitly:

{
  "schema_version": 2,
  "hosts": [
    {
      "ip": "192.168.50.20",
      "services": [
        {"protocol": "tcp", "port": 554, "state": "open"},
        {"protocol": "udp", "port": 3702, "state": "open_filtered"}
      ],
      "confidence": {
        "score": 72,
        "classification": "camera",
        "positive_score": 87,
        "negative_score": 15,
        "evidence": [
          {
            "kind": "observation",
            "source": "discovery",
            "weight": 30,
            "reason": "onvif detected",
            "polarity": "positive",
            "value": null
          }
        ]
      }
    }
  ]
}

• Mode reference — exact mode behavior and selection guidance.
• Scanning configuration — scanner flags, port profiles, and protocol interpretation.
• Customization and IVRE — catalogue/dictionary formats and supported IVRE commands.
• Development helpers — tests, linting, and package builds.
• Vendor data guide — vendor-specific endpoint files.
• Upstream intelligence sync — provenance, review-only candidates, and automated update PRs.

Primary editable data lives under data/catalog/, data/dictionaries/, and data/vendors/. Keep additions narrow and evidence-backed. A port match alone is deliberately insufficient to claim a vendor.

make test           # regression suite
make lint           # shellcheck plus Bash syntax
make arch-verify    # PKGBUILD/.SRCINFO consistency
make arch-package   # build the current checkout for pacman
make build          # build the Debian package

GitHub Actions independently build both package formats. The regression suite also covers target containment, SSDP URL scope, TShark CSV parsing, Masscan contracts, TCP/UDP preservation, report redaction, profile confidence, and credential/media probing behavior.

• No candidates: inspect logs/nmap-command.log, the selected target file, and the chosen port profile before increasing scan intensity.
• Masscan disabled: install Masscan and use medium or a higher mode.
• Avahi warning: confirm the Avahi daemon and D-Bus are available; the phase is optional and failures are logged in logs/avahi-command.log.
• No thumbnails: inspect per-host FFmpeg/curl logs. A 200 response is not sufficient; the resulting file must contain a valid video stream.
• CoAP skipped: install a working coap-client explicitly; CamSniff no longer builds unpinned network source during an ordinary scan.

Keep changes focused, add regression coverage for altered behavior, and run the development checks above. Do not add broad credential lists or unverified vendor/CVE claims. See CONTRIBUTING.md for the development, testing, data-evidence, and pull-request guidelines. Report vulnerabilities privately according to SECURITY.md.

MIT — see LICENSE. CamSniff is provided for authorized security work; the authors are not responsible for misuse.