Finding Where Your Cameras Actually Live on the Network
Most people assume CCTV cameras show up cleanly in their router's DHCP table. They rarely do. I spent three days last month tracking down a set of Hikvision units that had been silently assigned to a guest VLAN by a network admin who "just set it up and walked away." The cameras weren't even broadcasting SSDP announces. Here is how I actually find them, and why the easy methods fail half the time. The most reliable starting point is your own gateway. Log into your router and pull the DHCP lease table. Look for manufacturer OUI prefixes — the first three bytes of a MAC address map to a vendor. Ubiquiti ends in 00:1E:10 range, Dahua in 00:12:1F, Hikvision in 00:15:6D. This gets you about sixty percent of the targets on a typical small business setup. The other forty percent is where it gets annoying. When the router table lies, run a subnet scan. Advanced IP Scanner is free and does the job without command line friction. Set it to your local subnet, hit start, and let it ARP-ping every address. It takes about thirty seconds on a /24. This method catches anything actively responding on the broadcast domain. Static IP cameras that sit outside the DHCP pool will show up here even if the router doesn't know about them.
For larger networks or when you need more precision, use Nmap. A basic host discovery sweep looks like this: nmap -sn 192.168.1.0/24 That pings every address and reports who answers. Add port scanning once you have live hosts:
nmap -p 80,443,554,8000,8080,37775,37000 192.168.1.0/24 Those ports cover HTTP web interfaces, HTTPS, RTSP video streams, and the most common manufacturer proprietary ports. Hikvision uses 8000 and 37775. Dahua defaults to 37777 and 37778. Axis cameras commonly sit on 80 and 554. If a host responds on any of those, you found a camera. I hit a wall recently with a set of brand cameras on a hospital network. They weren't on standard ports at all — they were running RTSP on 5555 and their web interface on 9090. Nmap's default port list missed them entirely. I had to run a full top-1000 scan just to find the open ports, then dig through the ONVIF discovery responses to confirm they were actually surveillance devices and not some random IoT thermostat. That took about forty minutes instead of five.
Get the Full Details
ONVIF is worth understanding because it is the industry standard for device discovery. Most modern IP cameras support WS-Discovery, which lets you query the network for ONVIF-compliant devices without knowing their IP ahead of time. Tools like OnvifDeviceManager are free and run on Windows. You install it, open it, and it broadcasts a WS-Discovery probe. Any ONVIF camera on the same VLAN that hasn't been locked down will respond with its media profile, stream URLs, and credentials prompt. This is often faster than port scanning because it tells you exactly what the camera can do, not just that something is listening on port 80. Here is the thing nobody mentions: many cameras have mDNS/Bonjour advertising enabled by default. On a Mac or Linux machine, you can run dns-sd -B _onvif._tcp . and get a live list of ONVIF devices without installing anything. On Windows,Bonjour is sometimes pre-installed with Apple software, or you can grab it separately. This method caught a pair of Axis cameras for me once that had been given static IPs outside my scan range but were still advertising on the local link-local multicast address. When nothing works, check the physical device. Every IP camera I have ever dealt with has a label on it showing the default IP, username, and password. Reboot the camera and hold the reset button for ten seconds — it usually reverts to factory defaults with a known IP. This is the nuclear option but it works when the network has been reconfigured so many times that nobody remembers what happened.
The biggest pitfall is assuming all cameras on your network are discoverable. Some manufacturers ship with device discovery disabled by default. Samsung SRN series cameras, for example, turn off WS-Discovery and SSDP out of the box. You find them only by IP scan and then log into the web interface to enable discovery. Another common failure mode is cameras sitting on a separate management VLAN with no routed access from your workstation. In that case, you need to either jump to a machine on that VLAN or ask the network team to add a temporary route. I once spent two hours scanning an entire floor only to realize the cameras were on a different subnet entirely, separated by a VLAN tag I couldn't see from my desk port. If you want a single tool to keep in your pocket, get Advanced IP Scanner for quick sweeps and OnvifDeviceManager for when you need protocol-level detail. They cover roughly ninety percent of typical installations. The remaining ten percent is usually a network architecture problem, not a discovery problem.
