Skip to main content
protocols.pageprotocols.page
554

Port 554 – RTSP

TCP

Port 554 is the RTSP (Real Time Streaming Protocol) port for controlling media streams from IP cameras, media servers, and surveillance systems. RTSP on port 554 handles session control (PLAY, PAUSE, TEARDOWN) while RTP carries the actual media. Exposed RTSP cameras are a massive privacy risk – Shodan indexes thousands of unprotected feeds.

Port Number

554

Protocol

TCP

Service

Real Time Streaming Protocol

Range

IANA Well-Known (0–1023)

Description

RTSP on port 554 is the control channel for streaming media. It negotiates codec parameters, controls playback (PLAY, PAUSE, RECORD, TEARDOWN), and manages sessions. The actual video/audio data flows over RTP on separate ports. RTSP is essentially HTTP-like commands for media control. IP cameras from Hikvision, Dahua, Axis, and others listen on port 554 by default. Many ship with default credentials or no authentication. Search engines like Shodan regularly find thousands of exposed camera feeds. Always change default RTSP credentials, restrict port 554 to a dedicated VLAN, and use RTSPS (RTSP over TLS) when supported.

Security risks

  • 1CVE-2021-36260: Hikvision IP camera RCE via crafted RTSP requests – unauthenticated command injection affecting millions of cameras worldwide (CVSS 9.8, actively exploited by Mirai variants)
  • 2Default credentials epidemic: IP cameras ship with admin/admin, admin/12345, or no password. Shodan indexes 10M+ exposed RTSP streams (Insecam.org demonstrated this at scale)
  • 3No encryption by default: RTSP streams video in cleartext (RTP over UDP) – anyone on the network path sees the full video feed. RTSPS (TLS) exists but is rarely enabled
  • 4Camera as network pivot: compromised IP cameras (Linux-based, always-on, rarely patched) are used as botnet nodes (Mirai), network scanners, and persistent backdoors into corporate networks
  • 5Audio eavesdropping: many IP cameras have microphones – exposed RTSP streams capture audio from offices, homes, and restricted areas without any indication to occupants

Firewall guidance

Never expose port 554 to the internet. Place cameras on a dedicated VLAN with no internet access. Access streams via VPN or an NVR/VMS on the same VLAN. Change default credentials on ALL cameras before deployment. If remote viewing is needed, use the NVR's HTTPS portal (with 2FA), not direct RTSP exposure. Block cameras from initiating outbound connections (prevents botnet C2).

Diagnosis commands

Test RTSP stream access and codec info

shell
ffprobe rtsp://admin:password@camera-ip:554/stream1 2>&1 | head -10

Enumerate RTSP methods supported (DESCRIBE, SETUP, PLAY)

shell
nmap -p 554 --script rtsp-methods target

Brute-force RTSP stream paths (security audit for exposed cameras)

shell
nmap -p 554 --script rtsp-url-brute target

Test RTSP connectivity and supported features

shell
curl -v rtsp://camera:554/ -X OPTIONS

Usage examples

Port 554 – RTSP
shell
ffplay rtsp://camera.local:554/stream1
DESCRIBE rtsp://host:554/media.mp4 RTSP/1.0
vlc rtsp://user:pass@camera/live

Common services on this port

Hikvision camerasDahua camerasAxis camerasONVIF devicesVLC streamingFFmpeg rtsp-serverWowza Streaming Engine

Related ports

554

RTSP control (this port)

8554

RTSP alternate (many cameras)

80

Camera web UI (config interface)

443

Camera HTTPS UI

1935

RTMP (flash streaming, legacy)

History

RTSP (Real-Time Streaming Protocol) was standardized in RFC 2326 (1998) by RealNetworks, Netscape, and Columbia University. Port 554 was assigned for the control channel (like FTP's port 21 – signaling only, media flows separately via RTP). RTSP was designed for internet streaming but became dominant in the IP surveillance industry. RTSP 2.0 (RFC 7826, 2016) added security features but adoption is minimal. WebRTC and HLS/DASH are replacing RTSP for consumer streaming.

FAQ

How do I find all cameras on my network?

Scan for common camera ports: nmap -p 554,8554,80,443,37777,34567 --open 192.168.1.0/24. Use ONVIF discovery: pip install onvif-zeep, then run a discovery probe. Check your DHCP leases for known camera MAC prefixes (Hikvision: c0:56:e3, Dahua: 3c:ef:8c, Axis: ac:cc:8e). All cameras should be on a dedicated VLAN – if they're on the main network, segment immediately.

RTSP vs HLS vs WebRTC for live streaming?

RTSP: lowest latency (<1s), requires dedicated port (554), no browser support, best for NVR/VMS systems. HLS: 3-10s latency, works in all browsers via HTTP (port 443), scales with CDN, best for public streaming. WebRTC: sub-second latency, peer-to-peer capable, works in browsers, best for real-time communication. For IP cameras feeding an NVR: RTSP. For sharing camera feeds to web viewers: transcode RTSP → HLS/WebRTC via a media server.

Specification

RFC 7826 – Port 554 specification →