D-Link Forums
The Graveyard - Products No Longer Supported => IP Cameras => DCS-930L => Topic started by: dalef on June 23, 2011, 09:33:34 AM
-
I have a DCS-930L network camera that I configured from its Web-based interface. In SETUP | Network Setup, I have disabled both UPnP and UPnP Port Forwarding. In my router's (Netgear WNDR3700) settings, I reserved the local IP address, 192.168.1.80, for the DCS-930L. In the DCS-930L I assigned the network camera HTTP Port 8000; therefore, I can access the DCS-930L on the LAN from http://192.168.1.80:8000. In addition, in the router, I have forwarded port 8000 to the local IP address, 192.168.1.80, so I can access the DCS-930L from outside the LAN.
I can access the DCS-930L both from within the LAN and outside of the LAN.
However, even though UPnP and UPnP Port Forwarding in the DCS-930L are disabled, the DCS-930L keeps adding and deleting UPnP NAT rules in the router. In addition, a system at the IP address, 207.232.83.172, keeps attempting to access the DCS-930L from different ports. I traced the IP address, 207.232.83.172, to the ISP, Telekenex, in Los Angeles, California. A partial log from the router is below.
Why does the DCS-930L keep using UPnP even though I disabled it in its Web-based interface? In addition, why does a system at the IP address 207.232.83.172 keep trying to access the network camera at different ports?
I could probably rectify this issue by disabling UPnP on the router. However, I want to use UPnP for other purposes so I rather not disable it for all devices on the network.
[UPnP set event: add_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:56:14
[UPnP set event: del_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:56:14
[UPnP set event: add_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:56:02
[UPnP set event: del_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:56:02
[LAN access from remote] from 207.232.83.172:57520 to 192.168.1.80:3128, Thursday, June 23,2011 11:55:58
[LAN access from remote] from 207.232.83.172:56570 to 192.168.1.80:3128, Thursday, June 23,2011 11:55:55
[LAN access from remote] from 207.232.83.172:56104 to 192.168.1.80:3128, Thursday, June 23,2011 11:55:50
[UPnP set event: add_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:55:40
[UPnP set event: del_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:55:40
[UPnP set event: add_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:55:28
[UPnP set event: del_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:55:28
[UPnP set event: add_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:55:16
[UPnP set event: del_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:55:16
[LAN access from remote] from 207.232.83.172:59864 to 192.168.1.80:80, Thursday, June 23,2011 11:55:15
[LAN access from remote] from 207.232.83.172:57761 to 192.168.1.80:80, Thursday, June 23,2011 11:55:07
[LAN access from remote] from 207.232.83.172:56356 to 192.168.1.80:80, Thursday, June 23,2011 11:55:02
[UPnP set event: add_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:54:54
[UPnP set event: del_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:54:48
[UPnP set event: add_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:54:36
[UPnP set event: del_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:54:36
[UPnP set event: add_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:54:24
[UPnP set event: del_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:54:24
[LAN access from remote] from 207.232.83.172:52228 to 192.168.1.80:20107, Thursday, June 23,2011 11:54:23
[LAN access from remote] from 207.232.83.172:51140 to 192.168.1.80:20107, Thursday, June 23,2011 11:54:19
[LAN access from remote] from 207.232.83.172:49492 to 192.168.1.80:20107, Thursday, June 23,2011 11:54:14
[LAN access from remote] from 207.232.83.172:48110 to 192.168.1.80:20107, Thursday, June 23,2011 11:54:09
[UPnP set event: add_nat_rule] from source 192.168.1.80 Thursday, June 23,2011 11:53:59
-
I too have seen the access of Telekenex and others. An whois query show that 207.232.83.* associated with DLINK (see at bottom of this post). So it seems the camera is accessing dlink.com. Worse than that, from my router's log it appears to be the camera that's initiating the connection. Below is a list from the router of all connections established after just a few minutes of operation of the camera. Even more disturbing is the fact that on my router that just happens to also be a DLINK, I set up a filter to sop all outbound access to all of the internet (1.1.1.1 to 191.255.255.254), and all inbound access from 207.232.83.* and 204.194.234.* yet the router still records a connection (with a state of "-" ... whatever that means.)
Local NAT Internet Protocol State Dir Time Out
192.168.1.245:4298 4298 207.232.83.173:80 TCP TW OUT 25
192.168.1.245:3092 3092 207.232.83.172:80 TCP TW OUT 45
192.168.1.245:4322 4322 207.232.83.173:80 TCP TW OUT 48
192.168.1.245:3080 3080 204.194.234.200:53 UDP - OUT 78
192.168.1.245:3078 3078 204.194.234.200:53 UDP - OUT 4
192.168.1.245:4275 4275 207.232.83.173:80 TCP TW OUT 4
192.168.1.245:4288 4288 207.232.83.173:80 TCP TW OUT 16
192.168.1.245:4321 4321 207.232.83.173:80 TCP TW OUT 47
192.168.1.245:4987 4987 207.232.83.172:80 TCP TW OUT 15
192.168.1.245:4327 4327 207.232.83.173:80 TCP TW OUT 53
192.168.1.245:4270 4270 207.232.83.173:80 TCP TW OUT 0
192.168.1.245:4274 4274 207.232.83.173:80 TCP TW OUT 3
192.168.1.245:4302 4302 207.232.83.173:80 TCP TW OUT 30
192.168.1.245:4295 4295 207.232.83.173:80 TCP TW OUT 23
192.168.1.245:4328 4328 207.232.83.173:80 TCP TW OUT 54
192.168.1.245:4318 4318 207.232.83.173:80 TCP TW OUT 45
192.168.1.245:3079 3079 204.194.234.200:53 UDP - OUT 75
192.168.1.245:4273 4273 207.232.83.173:80 TCP TW OUT 2
192.168.1.245:4290 4290 207.232.83.173:80 TCP TW OUT 18
192.168.1.245:4315 4315 207.232.83.173:80 TCP TW OUT 41
192.168.1.245:4317 4317 207.232.83.173:80 TCP TW OUT 43
192.168.1.245:3102 3102 207.232.83.172:80 TCP TW OUT 55
192.168.1.245:4992 4992 207.232.83.172:80 TCP TW OUT 20
192.168.1.245:4332 4332 207.232.83.173:80 TCP TW OUT 57
192.168.1.245:4323 4323 207.232.83.173:80 TCP TW OUT 49
192.168.1.245:4300 4300 207.232.83.173:80 TCP TW OUT 27
192.168.1.245:4284 4284 207.232.83.173:80 TCP TW OUT 12
192.168.1.245:4301 4301 207.232.83.173:80 TCP TW OUT 28
192.168.1.245:4289 4289 207.232.83.173:80 TCP TW OUT 17
192.168.1.245:4307 4307 207.232.83.173:80 TCP TW OUT 34
192.168.1.245:4272 4272 207.232.83.173:80 TCP TW OUT 1
192.168.1.245:4311 4311 207.232.83.173:80 TCP TW OUT 38
192.168.1.245:3076 3076 207.232.83.172:80 TCP TW OUT 30
192.168.1.245:4997 4997 207.232.83.172:80 TCP TW OUT 25
192.168.1.245:4320 4320 207.232.83.173:80 TCP TW OUT 46
192.168.1.245:4331 4331 207.232.83.173:80 TCP TW OUT 56
192.168.1.245:4282 4282 207.232.83.173:80 TCP TW OUT 10
192.168.1.245:4279 4279 207.232.83.173:80 TCP TW OUT 8
192.168.1.245:3097 3097 207.232.83.172:80 TCP TW OUT 50
192.168.1.245:4285 4285 207.232.83.173:80 TCP TW OUT 13
192.168.1.245:4293 4293 207.232.83.173:80 TCP TW OUT 20
192.168.1.245:4294 4294 207.232.83.173:80 TCP TW OUT 21
192.168.1.245:4976 4976 207.232.83.172:80 TCP TW OUT 5
192.168.1.245:4310 4310 207.232.83.173:80 TCP TW OUT 37
192.168.1.245:4277 4277 207.232.83.173:80 TCP TW OUT 5
192.168.1.245:4971 4971 207.232.83.172:80 TCP TW OUT 0
192.168.1.245:4299 4299 207.232.83.173:80 TCP TW OUT 26
192.168.1.245:4280 4280 207.232.83.173:80 TCP TW OUT 9
192.168.1.245:4326 4326 207.232.83.173:80 TCP TW OUT 52
192.168.1.245:4306 4306 207.232.83.173:80 TCP TW OUT 33
192.168.1.245:3086 3086 207.232.83.172:80 TCP TW OUT 40
192.168.1.245:4286 4286 207.232.83.173:80 TCP TW OUT 15
192.168.1.245:4314 4314 207.232.83.173:80 TCP TW OUT 40
192.168.1.245:4305 4305 207.232.83.173:80 TCP TW OUT 32
192.168.1.245:4309 4309 207.232.83.173:80 TCP TW OUT 35
192.168.1.245:4333 4333 207.232.83.173:80 TCP TW OUT 59
192.168.1.245:4312 4312 207.232.83.173:80 TCP TW OUT 39
192.168.1.245:4325 4325 207.232.83.173:80 TCP TW OUT 50
192.168.1.245:3081 3081 207.232.83.172:80 TCP TW OUT 35
192.168.1.245:4330 4330 207.232.83.173:80 TCP TW OUT 55
192.168.1.245:4278 4278 207.232.83.173:80 TCP TW OUT 6
192.168.1.245:4291 4291 207.232.83.173:80 TCP TW OUT 19
192.168.1.245:4304 4304 207.232.83.173:80 TCP TW OUT 31
192.168.1.245:4296 4296 207.232.83.173:80 TCP TW OUT 24
192.168.1.245:4981 4981 207.232.83.172:80 TCP TW OUT 10
192.168.1.245:4316 4316 207.232.83.173:80 TCP TW OUT 42
192.168.1.245:4283 4283 207.232.83.173:80 TCP TW OUT 11
noname.telekenex.com [207.232.83.173]
noname.telekenex.com [207.232.83.172]
unknown [204.194.234.200]
Note below
network:Network-Name:ocix-tkx-sna-sup32-Dlinks
network:Organization;I:Dlinks
[Querying whois.arin.net ]
[Redirected to 69.170.160.29:4321]
[Querying 69.170.160.29]
[69.170.160.29]
%rwhois V-1.5:003fff:00 localhost (by Network Solutions, Inc. V-1.5.9.5)
network:Class-Name:network
network:ID:NETBLK-CCDT-207.232.83.0/24
network:Auth-Area:207.232.83.0-24
network:Network-Name:ocix-tkx-sna-sup32-Dlinks
network:IP-Network:207.232.83.0/24
network:IP-Network-Block:207.232.83.0 - 207.232.83.255
network:Organization;I:Dlinks
network:Tech-Contact;I:ipmanager@telekenex.com
network:Admin-Contact;I:ipmanager@telekenex.com
network:Updated:20100607
network:Updated-By:admin@telekenex.com
My suspicion is that that the camera has functionality in the firmware to contact the dlink site (for who knows what reason) . It's also odd that the DLINK router shows these connections when I have explicitly banned all access to the internet. Does the router also have some code to allow access to dlink.com even when the rest of the IP range 1.1.1.1 to 191.255.255.254 has been banned?
-
BTW, port 53 is DNS ... perhaps these cameras have some development code left active in the firmware release?