I wondered how my home network looked in comparison. A few years ago I was complaining that routers which limit users to 128 WiFi devices weren't suitable for the average family. I'm not quite at that many IP addresses - but I'm closing in.

So, here's my attempt to map my network - with a splash of colour to explain the different protocols at play.

Created with Graphviz Visual Editor. Using a free trial of RunZero to discover devices.

Conceptually, the network is quite simple. Cable Internet → WiFi / Ethernet Router → Devices. But some of those devices have their own wireless networks, some connect to a mesh, and others over mains electrical wiring. And then it gets a bit complicated

I do have more IoT stuff than is sensible. And, annoyingly, there's no good way to design a home network for (potentially) hostile IoT devices. At least, not without getting professional gear.

This is just our personal kit. There's a guest network for visitors and WFH equipment. I also haven't mapped every ZigBee devices (a lot of lightbulbs) nor all the LoRaWAN sensors (lots of doors and windows being monitored) - and I'm completely ignoring the things controllable by BlueTooth (mini-printers and treadmills).

One thing I notice is that the 2.4GHz is ridiculously crowded. All the cheap IoT devices use it - plus it provides the private network for some equipment. I get it. 5GHz is expensive, power-hungry, and has a shorter-range. But it is a bit annoying that more devices can't make use of its plentiful spectrum - it's currently restricted to phones and laptops.

We have a tall, narrow house. So WiFi extenders have proven a bit useless. But, perhaps it is time to create a couple of IoT networks on different SSIDs?

All told, when including work devices and random old Android phones / tablets, ancient Xbox consoles, and assorted Raspberries Pi - we're pushing 60 devices with an individual IP address.

I've got to admit, this doesn't feel like "underkill"…!

There's no monthly fee. The recordings stay in your home. The batteries last for ages. I can get on board with this! The package costs around £220 (discount of £40 if you use my code) and you get a smart-hub, two cameras, mounting points, and some flat ethernet cable.

Set-up was easy. Install the requisite app (Android version worked fine), plug in the bits, and follow the on screen instructions. Took less than 5 minutes. There's almost zero configuration - that's because it comes with its own WiFi network. You don't have to fiddle connecting the cameras to your existing network, they connect to its own hub. That also means that guests on your WiFi network won't see the cameras. There are some lovely audio prompts from the hub to explain what you need to do.

Video quality was excellent, even in low light. The 1080p is super clear and the infrared works well. You can set movement detection zones so that it isn't set off by people walking by your home. It also uses thermal detection, rather than just looking for movement in the frame. Again, it means that a leaf blowing through your garden doesn't set the alarm off.

Audio was adequate - as a bonus, you can speak to people through the cameras! Hold down the mic button in the app. Or you can have an alarm sound when movement is detected. Again, volume was fine considering the small size of the camera.

The app lets you add guests - so multiple people in your household can get alerts. That's pretty handy. You can adjust the sensitivity of the detection algorithm, and tell it not to alert you when you're at home.

The mounting points came with screws and rawlplugs. But I used No More Nails adhesive to stick them to my walls - the cameras are pretty light.

Downsides

The Android app is pretty good. There are a few weird translations, but it's generally easy to use.

There's no 2FA for the website, so you have to use a strong password. On the subject of passwords... You're limited to 20 characters. But the app seems to let you enter more than 20 characters! It silently truncates it. Worse, not all the password fields in the system are limited to 20. I spent an annoying half an hour trying to work out why my password was failing!

The battery life claims 180 days. That means you have to mount the cameras somewhere hard for burglars to reach - but easy for you to get to. I ended up hanging out of a window to ensure optimal positioning. Because...

The camera mounts are firmly attached to the wall - but the camera is screwed into the mount via a plastic cover. Anyone can walk up and unscrew them with their fingers; no tools required. I'd have preferred something which at least required a screwdriver or allen key - something to make it a little more difficult to snatch them away. Of course, the cameras are pretty useless if they get stolen. And you want to be able to easily access them every 6 months for a recharge. Speaking of which...

On the bottom, covered by a little rubber flap, is a micro-USB recharging socket. They recharged pretty quickly, but I wish they were USB-C; like everything else in my house.

Openness

Bit of a mixed bag. The recordings all stay local to your home - but there's no direct way to access them apart from using the app. But, the hub will generate an RTSP stream which you can record on an external box. That's pretty nifty!

There are a few GitHub projects which work with EufyCam, but it is early days.

I'll spend the next few months seeing if I can bodge anything together. There's a lively community on the Eufy forums.

Verdict

No cloud! No subscription! No hassle! No brainer! If you want to stick up a couple of cameras and have everything just work - you can't go wrong with the Eufy Cam 2C.

Discount!

There's a £40 discount when you use my referral link.

The design is gorgeous - and award winning. It's a sleek unit and, surprisingly, feels nice in the hand.

It can store videos on an SD card (not included) or via the cloud. The app - which is pretty nice - also lets you view the camera when you're away from home.

Let's tear straight into it!

Unboxing

Standard image

Night Mode

In low light, the Infrared LEDs turn on. Night mode works pretty well.

Video

This is the video quality when streamed from Android.

App

One really nice touch is the way it handles WiFi sign on. The app generates a QR code - hold it in front of the camera, and it automagically connects.

There's an in-app tutorial when you boot up. It's all pretty self-explanatory. Swipe the screen to move the camera.

There's a range of options where you can play with motion tracking. You also receive alerts when it detects motion.

Finally, there's 2-way audio support. You can hear what's going on in the vicinity - although it's fairly low quality mono feed. You can tap a button on the app and broadcast your voice to the camera. Good for scaring off burglars.

Cloud Services

I have mixed feelings about this. €170 per year feels a bit much - but it depends on what price you place on security. Hopefully that price includes regular firmware updates. If you don't want to pay that price, you can record videos to the local SD card. There's no option to specify your own server, sadly.

Security

Whenever you invite a 3rd party into your home, you place trust in their security. The Nooie has a sensibly written privacy policy and ToS. All data is stored on AWS, rather than a Windows Vista box under a developer's desk in China. All the connections to AWS were correctly secured, as far as I could tell.

The camera doesn't respond to common port scans.

The first thing the app asked me to do was update the firmware - which removed the FTP Daemon to increase security.

There's no 2FA on the app - but that may be overkill for a consumer device. It does let you create guest accounts, so your household don't have to share a single password.

This isn't a full and formal analysis of the product - but it is a hell of a lot better than the security on most IP cameras.

Final Thoughts

It's a good looking camera. The video and audio quality are fine - but nothing special. Two way audio is handy. Firmware updates and cloud functionality really round off the package. All-in-all, it's excellent value for money.

Discount Code

Save 10% on Nooie Cam 360 & get one month of Nooie Cloud service for free. Available from 27th April to 30th April. Discount code: NOOIEMAR

Buy the Nooie 360 WiFi camera on Amazon.

I thought about how I might get access. Using a man-in-the-middle attack to sniff the password, or trying to dump the firmware and examine that. Sadly, all the vulnerabilities previously reported no longer work. After a little bit of thought, I went for decided low-tech solution; I hit the reset button! Yes, each camera had a recessed switch, accessible only with a paperclip, which reset the device to factory settings after holding it down for 10 seconds.

Anyway, this is my voyage of discovery with the three cameras. They are:

• RC8221 - a basic internal camera.
• OC821D - an external camera with weatherproof features.
• RC8230 - a pan/tilt camera.

All of them are manufactured by Taiwanese OEM Sercomm. Annoyingly, Sercomm don't have any customer services. They mostly resell the cameras to Linksys, Cisco, Xanboo.

SerComm don't offer any firmware, GPL downloads, or much information about the cameras - so it's all very much trial and error.

Defaults

After resetting the cameras, they'll happily attach up to any wired network via the Ethernet port. Visit the IP address assigned by DHCP and you'll get to the admin panel. The default username is "administrator" - there is no password set. You can now go and fiddle with all the settings.

High Resolution Mode

The cameras are meant to be able to record at 720p - yet the user interface doesn't seem to allow it. Luckily, the API allows us to force the resolution.

http://192.168.0.42/adm/set_group.cgi?group=H264&resolution=4

http://192.168.0.42/adm/set_group.cgi?group=JPEG&resolution=4

Wait! What? API?!

Oh yes, all the cameras come with a variety of commands which can be controlled by simple a HTTP GET request.

Discovering The API

As I said previously, Sercomm provides no documentation. Luckily, their resellers do! EyeSpy247 have the admin manual for the RC8221. Use-IP have the admin manual for the OC821D. I haven't yet found a manual for the RC8230 - but it uses most of the same API commands. The only main addition is the ability to move the camera via its pan/tile functionality. After a bit of digging, I found a discussion on how to activate this functionality.

Up:

http://192.168.0.42/pt/ptctrl.cgi?mv=U,10

Down:

http://192.168.0.42/pt/ptctrl.cgi?mv=D,10

Left:

http://192.168.0.42/pt/ptctrl.cgi?mv=L,11

Right:

http://192.168.0.42/pt/ptctrl.cgi?mv=R,11

The manuals give all sorts of instructions, how to view video streams, get photos, set and get various options. There are, sadly, some omissions.

Sending Sounds

One of the tasks I wanted to accomplish was to make the cameras play some of the turret sounds from the video game "Portal". This is proving tricky, despite the manual's promises to the contrary.

It should be possible to POST an audio file to the cameras, either in G.726, or G.711 (a-law or u-law). Despite creating the audio files correctly, and POSTing them to the cameras - they make not a peep!

curl -vv --data-binary @alaw8k.wav http://user:pass@192.168.0.42/img/g711a.cgi

curl -vv -X POST -d @alaw8k.wav http://user:pass@192.168.0.42/img/g711a.cgi --header "Content-Type:audio/x-wav"

I get a 200 OK, and the volume is set on the camera. Most vexing!

If you think you can help, please leave an answer on StackOverflow.

Arming - or lack thereof

With my other cameras, I can send a command to arm or disarm. I don't need the motion detection to send me emails every second of the day - only when I'm out of the house.

Looking at the source code of one of the pages, it looks like it's possible to POST some data to /adm/file.cgi - but it's not clearly documented which parameters are required. It will take me some time to work through the tangled nest of JavaScript.

Email

The cameras will send video when they detect motion - although getting this to work isn't at all obvious. Firstly, the password is hard-coded to be a maximum of 16 characters. If your password is "StarTrekIntoDarkness1" you're out of luck. Secondly, the "Test the Server" button doesn't actually work. It randomly gave me errors about not being able to reach the server. I struggled for hours until I discovered that the error messages were lying to me! If you enter the details correctly, and the camera has access to the Internet, it should just work.

That said, once enabled, it will happily send emails with large video attachments to you.

Video Audio

All the cameras have microphones, and all do audio triggering (sending an alert when noise levels rise). Yet none of the cameras would embed audio in with the video. When streaming over RTSP, it was possible to pick up audio from the microphone. Lowish quality, 8kHz, mono - but better than nothing. Again, if anyone knows how to get the alert videos to include audio, please let me know!

Motion Detection

Setting the motion detection area is very useful. You might want to ignore movement on the floor if you have a pet, or concentrate on a door handle. Sadly, with these cameras, you have to use IE6 or greater to set the detection area.

You can try and use the API to set areas - but without being able to see the area in question, it's an exercise in frustration.

For my needs, having full screen video detection is fine. I may have to borrow a Windows machine if that changes.

Open Source

Each camera has an embedded Open Source page at /adm/Licenses.txt which includes all the text of the relevant GPL etc.

All three cameras have the following Open Source components:

• Davicom Ethernet driver
• Linux kernel 2.6.18
• wireless_tools 26
• busybox 1.16.0
• dhcpcd 1.3.22-pl1
• ez-ipupdate 3.0.11b7
• iptables 1.3.4
• ppp 2.4.1
• cron daemon
• samba client 3.06
• glibc 2.8
• alsa-lib-1.0.16
• wpa_supplicant 0.4.5
• NTP
• thttpd-2.25b

Interesting to note that BusyBox is an unstable release version from 2010, thhtpd supports IPv6 even though the cameras don't appear to. wpa_supplicant is ancient - that may explain why it can't cope with SSIDs with spaces in them. I presume it's the hardware which won't scan the 5GHz range. The Linux kernel is from 2006 - that's common enough in embedded systems, but I do wonder if it presents a security risk.

Security

The cameras offer an SSL connection. However, the certificate is self signed and uses MD5 with 1024 bits. Basically, a security signing which was advised against in 2010. There's no way to replace the certificate without replacing the firmware. If you are willing to trust it, the connection is secured via SSL. Assuming you can confirm the certificate is correct, the encryption should be sufficient to stop anyone but the NSA peeking through your cameras.

That said, the RTSP channel isn't protected by SSL. You can give a username/password, set time of day access, and restrict to specific IP addresses - but the video is transmitted in the clear.

For now, I'm keeping my cameras on my LAN with no external access to them.

What Next

At the moment, I've set the cameras up, but I'm not actively monitoring them - it's just too much work to switch each of them on when I leave for work.

So, if you can help....

1. How do I send sound to the cameras?
2. How do I get audio with the video alerts?
3. How do I arm the cameras via the API?