Dahua IPC-HFW2431T-ZS

Dahua · bullet IP camera, 4 MP, motorized zoom lens · IPC-HFW2431T-ZS

Generic drawing of the device class, not of this model

what it is

An IP camera in a bullet housing with a rectangular front: length 244.1 mm, front 79.0 × 75.9 mm, white body with a white sunshield, black front plate with a single window. Four infrared LEDs sit behind the same glass as the lens. Mounted on a ball joint and a round wall plate.

The "244.1 mm × Φ90.4 mm" entry in the manufacturer's data sheet looks like the tube diameter, and it is not. Φ90.4 mm is the diameter of the wall plate; the head is rectangular.

Dahua encodes the housing type in the group of letters after IPC-: HFW is a bullet, HDW — an eyeball, HDBW — a vandal-resistant dome, HF — a box camera. The "IPC" prefix itself means only "network camera".

PoE power depends on the revision. The data sheet for the -ZS version lists 802.3at class 4 and under 14 W, the data sheet for the -ZS-S2 revision — 802.3af and under 9.6 W. The name alone without the suffix does not settle it.

what we read from it

Open ports: 80 (web page, CGI, ONVIF), 554 (RTSP) and 37777 (Dahua protocol). SNMP does not respond. CGI with Digest authentication returns:

device type, serial number and system information (magicBox.cgi),
a snapshot 2688 × 1520,
device time and configuration — NTP, time zone and DST, video encoding (configManager.cgi?action=getConfig),
configuration writes through the same CGI (action=setConfig).

RTSP streams H.264: main 2688 × 1520 at 20 fps and sub 704 × 576 at 20 fps. ONVIF reports the time without login, the rest after WS-Security authentication.

measured pitfalls

Several settings in one write. setConfig with multiple parameters returns Error / Bad Request! and saves nothing from the batch, even when only one parameter is wrong. The message does not say which field. Safe approach: write one at a time and read getConfig after each.
Range of the DST fields. Locales.DSTStart.Week accepts −1 and 1–4; −1 means "last", and that is the value for EU rules (last Sunday of March and October). 5 and 6 give Bad Request, and 0 gives neither acceptance nor an error. Day accepts 0–6, where 0 is Sunday.
Clock an hour behind. The GMT+1 zone with DST disabled gives winter time all year. The factory time server is the external clock.isc.org.
The snapshot returns 500 with a correct password. Authentication passes (401, then 500), and the same calls later give 200. It is not a wrong path or password — the cause was not determined; retrying helps.
RTSP DESCRIBE with curl --digest gives 404. When retrying with the authentication header, curl drops the URL parameters. This problem does not occur on CGI.
Another Dahua camera from the same firmware era behaves the opposite way: CGI responds 401 despite a correct password, and the sub stream is disabled. The same brand does not guarantee the same behavior.

what we cannot read

Anything over SNMP.
The PoE power revision from the model name alone — see above.
The share of the lens itself in the front — the manufacturer's drawing shows only the glass.

full parameter list

A full parameter list for this model is not here yet — the ones described above are those we have read and verified. A missing list does not mean the device exposes nothing more.