Finding every IP camera, NVR, and DVR on a local network can be surprisingly difficult. Devices may advertise themselves through ONVIF or mDNS, expose only an RTSP service, use a vendor-specific web endpoint, or respond on an unexpected port. CamScan brings these clues together in one Bash-based discovery tool designed for networks you own or are authorized to test.
The open-source project is available on GitHub at error0327/CamScanner. It is designed and tested around Kali Linux, while also including fallback package mappings for other supported systems where possible.
What makes CamScan useful?
CamScan does more than look for a single port. It combines multiple discovery and fingerprinting signals, then scores each host as a possible, likely, or confirmed camera device. This helps reduce noise while still surfacing devices that may not identify themselves in an obvious way.
- Scans a subnet, IP range, or individual host.
- Uses ARP discovery when available, with an Nmap ping sweep as a fallback.
- Sends ONVIF WS-Discovery probes for strong camera detection.
- Checks mDNS and Bonjour advertisements.
- Scans common camera, recorder, RTSP, HTTP, and vendor ports.
- Fingerprints HTTP titles, server headers, RTSP responses, and known vendor paths.
- Exports structured results to CSV and JSON.
- Can open an RTSP stream or capture a snapshot when valid credentials and a stream path are supplied.
Getting started
Clone or download the repository, make the script executable, and run it with the privileges required for local network discovery:
chmod +x camscan.sh
sudo ./camscan.shTo run a single scan and export the findings:
sudo ./camscan.sh --once -o camsFor a deeper scan of a specific subnet:
sudo ./camscan.sh -t 192.168.1.0/24 -m deepWhen an output prefix is provided, CamScan creates both CSV and JSON files. Results can include the IP and MAC addresses, vendor, confidence score, classification, relevant open ports, ONVIF URL, HTTP title or banner, RTSP server, detected model, and supporting evidence.
Requirements and optional integrations
The core requirements are Bash, Nmap, curl, the ip utility from iproute2, and timeout from GNU coreutils. Optional tools improve specific workflows: arp-scan speeds up local discovery, socat enables ONVIF probing, avahi-browse adds mDNS discovery, and players such as ffplay, mpv, or VLC can open live streams.
Built for responsible auditing
CamScan is intended for inventory, troubleshooting, and security auditing on authorized networks. Normal scans do not attempt to log in to devices. The optional --find-creds mode checks known default credentials and should be used only on equipment you own or have explicit permission to test.
This safety boundary matters. Camera systems can expose private video and sensitive network information, so discovery results and credentials should be handled carefully. CamScan is most valuable as a defensive tool: locating forgotten devices, documenting exposed services, verifying recorder deployments, and identifying systems that still rely on default paths or credentials.
A practical approach to camera inventory
By combining discovery protocols, service fingerprints, vendor clues, and confidence scoring, CamScan turns a messy manual process into a repeatable terminal workflow. If you manage cameras on a home lab, office network, or authorized security assessment, the project offers a practical starting point for building a clearer inventory.
Explore the source code, usage options, and latest updates on the CamScan GitHub repository.
Comments