Security Issue

[BlendiH]

I received this notice from my firewall today about my RLC-810A.

Why would the camera scan for ports?

[joseph_1979]

@blendih Yes, a number of ports should be open to allow communication with a number of entities like Reolink P2P servers (UDP port 9999), establish communication with camera from client (TCP port 9000), browser access using HTTPS 443 or HTTP 80, ONVIF 8000 (or whatever value you have set it), Live streaming protocol RTSP 554, Live streaming protocol (Requires Adobe Flash) RTMP 1935 and UDP ports for media transfer with Reolink client/NVR.

[user_665261034414183_665261034414183]

I received this notice from my firewall today about my RLC-810A.

Why would the camera scan for ports?

The RLC-810A camera may scan for ports for various reasons. One possibility is that the camera is designed to perform regular port scans as part of its normal operation to ensure that it can communicate with other devices on the network.
Another possibility is that the camera may be compromised or infected with malware, and is scanning for open ports in order to find vulnerabilities that can be exploited for unauthorized access or other malicious purposes.
It is important to investigate the reason why the camera is scanning for ports, as it could potentially pose a security risk to your network. You may want to check the camera's settings and logs, run antivirus and malware scans on your network, and consider seeking the assistance of a security professional if you have concerns about the camera's behavior.

[Crimp On_62210811129]

@blendih More detail would be useful:

• Are there other cameras on the network? Do they trigger the same warning from the Firewall?
• Which specific ports does the Firewall mention?
• How often does the Firewall complain about the camera?
• Is it correct to assume that 192.168.0.1 is the IP of the gateway from the LAN subnet to the internet?

My impression is that typically data connections are from a user device to the camera, not from the camera to other devices.

[BlendiH]

@crimp-on_62210811129

Are there other cameras on the network?
Yes, 2 E1 Pros

Do they trigger the same warning from the Firewall?
They do not trigger the same warning.

Which specific ports does the Firewall mention?
It is scanning all ports. As far as I know, the camera should be programmed to know the ports that it needs. There should be no need for it to scan all ports.

How often does the Firewall complain about the camera?
This was the first time I have received a warning. I’ve had the camera for about 1 year.

Is it correct to assume that 192.168.0.1 is the IP of the gateway from the LAN subnet to the internet?
That is correct.

[joseph_1979]

@crimp-on_62210811129 Nope, there are packets sent to P2P servers at regular intervals to update both the private and the public IP of the camera, push notification message relayed to the Reolink message application server which pushes it to the Google FCM for Android, etc.

@BlendiH Did you do any operation from the Reolink client at that point in time such as trying device linkage? Did you check that the MAC address correspond to that of the RLC810A? What is the FW model? Any logs you can share (of course hiding any personal data)?