Port knocking for streaming from different subnets

Development
1

Hi,

Aravis currently only partially supports accessing cameras in different subnets.

By knowing the IP address of a camera I can open a device and send gvcp packets and receive correct results. Streaming however is not possible. The gvsp packets are sent from the camera and are not requested the user pc.

Would you consider this a useful addition?
Should it always be executed?

Cheers,

Edgar

2

Hi Edgar,

I think that sounds like a nice addition, but I fail to understand the problem and the solution. Could you point me to some documentation about this issue, and why the sent packet fixes it ?

Cheers,

      Emmanuel.

3

Hi Emmanuel,

The setup is as follows:

PC ---- (net0) ---- router0 ---- (net1) ---- camera

router0 and the camera are in the same subnet, whereas the PC is in a different one.
router0 acts as the gateway, thus receiving all traffic not intended for the subnet.

Most routers have a simple firewall mechanism that blocks unrequested packets.
This means GVCP will work correctly as all data the camera sends is a
direct response to a packet the PC has sent.
GVSP however will fail. The stream is initialized via GVCP but sends to a port that is unrelated.
The router, not knowing that we want incoming data, blocks these packets as
no outgoing data exists that made the incoming ones appear as wanted.

This is where the patch comes in. What it does is it sends a single packet to the
router with the correct port. This is enough to make the router expect incoming traffic and
let it pass through, thus enabling GVSP. The content of the packet is not relevant.
It just has to be sent to the correct port.

Does that clear up what is going on?

  • Edgar
5

Hi Edgar,

Please avoid to cite GigEVision standard documents. The AIA is still hostile to a use of their documents for open source development. Also, if you have read the GigEVision documents, I prefer to not use your code if it is related to GVCP and GVSP protocols.

Anyway, I have understood the problem and I will implement a fix. I guess the dummy packet can be sent every time we start the streaming.

Thanks,

Emmanuel.
6

Hi Emmanuel,

My apologies. I wasn’t aware that even small parts may pose such a problem.
I personally have not read any of the documents, the section had been sent to me by someone else.
My code should thus always be somewhat secure. Still better safe than sorry.

I agree that sending the packet every time would be the easiest implementation

Thanks,

Edgar

7

No worry. I’m may be over cautious when a work is directly based on the GigEVision standard documents.

Cheers,

Emmanuel.