Common camera ports and protocols

A reference table of camera, VMS and discovery ports, with the shipped state vendors print and the widely repeated numbers that could not be confirmed.

TCP 37777 answering on a camera VLAN is a Dahua-family device. The port is unregistered, so scanners fingerprint it by payload rather than look it up. TCP 4520 is Wisenet. TCP 8000 is more ambiguous than it looks — it is Hikvision's SDK service on an embedded device, and it is also what Milestone's Mobile Server uses for its SysTray app, so the same integer means different things on a camera and on a Windows host. Axis has no proprietary control port at all: VAPIX and ONVIF both ride 80 and 443, which is why an Axis fleet leaves no distinctive number behind for a scanner to key on.

Protocols and their default ports#

ONVIF fixes the path, not the port; read the port from XAddrs or GetNetworkProtocols. The Dahua multicast row bites on a shared segment: the group and all three port numbers are identical on every unit out of the box, so camera two lands where camera one already is.

Outbound cloud connectivity — Hik-Connect, Dahua P2P, ONVIF Uplink — puts devices out of reach of both these tables; that is covered in how cameras become internet-exposed.

Vendor ports, and what ships enabled#

Remote shell is where the vendors diverge most sharply. Hanwha says it removed the daemons; Hikvision ships SSH present and disabled, adding that "For devices without this configuration interface, SSH is disabled by default"; Dahua ships it as a user-toggleable service in the same panel as ONVIF and CGI. Axis documents SSH as supported from AXIS OS 5.50 and recommends disabling it.

Three gaps, stated rather than filled. Bosch names only "RCP+ ports 1756" and refers to "the discovery ports" without printing their numbers; the 1757/1758 pair repeated across integrator forums appears in no Bosch-authored document we could fetch, and Bosch's knowledge base has moved to keenfinity-group.com with the old URLs returning shells or 404. Hikvision's "Configure Port" page lists Alarm Host, Server, HTTP, RTSP and Enhanced SDK but no HTTPS port, so 443 is not citable as a Hikvision default from it. And Axis's audio white paper prints RTSPS as 332 where Genetec documents the IANA-registered 322 for secure RTSP to cameras — Axis choice, product-line difference or typo, we could not resolve it.

Two qualifications on the Bosch row. On CPP14 and the CPP6/7/7.3 family, a fleet upgraded in place keeps RCP+, HTTP and RTSP as it had them: "New defaults will not automatically become effective during a firmware upgrade but require a factory default to be applied." Only CPP13 at firmware 8.90 takes the new defaults on upgrade. Two of the five closures are also inbound-only — the iSCSI client "uses the same port 3260 in 'outgoing' direction, which is still open", and a camera with its NTP server shut is "still listening on port 123 to synchronize its time base".

Dahua's note above Table 4-23 reads: "0-1024, 1900, 3800, 5000, 5050, 9999, 37776, 37780-37880, 39999, 42323 are occupied for specific uses." The manual advises against assigning them without stating that the device enforces it. 37776 and the 37780–37880 block sit immediately beside the documented 37777/37778 pair, so a sweep of 37777 alone undercounts.

VMS servers answer on camera ports#

Three of those rows answer RTSP on a Windows server: Milestone's Open Network Bridge on 554, Genetec's Media Router on 554, the Media Gateway on 654. The 5432 row is the trap most likely to survive into a report, because a scanner labelling ports from the IANA registry will call an XProtect recording server a database host. And 15000–19999 is five thousand ports wide before you count the second Archiver agent, which is why camera-VLAN egress rules get written loosely.

The Milestone numbers come from the 2020R3 documentation, roughly six years old as of September 2026; the current ports page returned only the portal shell, so verify them against your own release. The Genetec figures span two pages — 5.13 for the port list, 5.9–5.12 for the firewall guidance — and where they disagree we could not determine which supersedes the other.

Why the list is a starting point#

Ports move, and the vendors say so. Hikvision states its three remote-access ports "can be customized" and gives the Server Port a range of 2000–65535. Hanwha's guide tells the installer to raise 80, 443, 554 and 4520 to high numbers, then warns in the same section that doing so "may cause communication problem if there is a connected recording device or VMS".

So scan wider than the defaults. RTSP alone has three registered numbers — 554, 322 and 8554 — plus Hikvision's 10554, and both unauthenticated-RTSP CVEs above were on 8554. Enumerate services per device and record the answer against the asset; that is the discipline the Video Attack Surface Management framework is organised around. Protocol detail on RTSP sits on the RTSP page, ONVIF's authentication model on ONVIF security.