Novus NVIP-4DN3513H

Novus · tube IP camera, 4 MP, motorized zoom lens · NVIP-4DN3513H

Generic drawing of the device class, not of this model

what it is

An IP camera in a tube housing with a round front: Ø109 × 284 mm with bracket, 1.1 kg, aluminum, IP66 (manufacturer datasheet). Powered by PoE or 12 V DC. One 10/100 Ethernet port.

The lens is a motorized zoom with autofocus. The camera declares a PTZ service, but its movement spaces are only zoom and digital movement — there is no pan-tilt head. In addition: an automatic IR-cut filter (day and night), an audio input and one relay output.

One letter changes the housing: NVIP-4DN3513V is a dome, not a tube. The manufacturer's sources also differ on the sensor — the product page lists 1/2.8", the manual 1/3".

what we read from it

The camera speaks ONVIF 2.3 on port 80, and this is the only management path. The web page requires an NPAPI or ActiveX plugin that modern browsers do not support, and there is no HTTP API underneath.

RTSP streams: three H.264 profiles — 2592 × 1520 at 25 fps, 1280 × 720 and 640 × 480 — plus G.711 A-law 8 kHz audio. RTSP requires a password.
Without login it answers 10 of the 15 ONVIF requests checked: time, network interface with the DHCP flag, gateway, NTP, capabilities, profiles and stream addresses — addresses without credentials.
After login: model, firmware version, serial number, account list, hostname and DNS. The serial number is the MAC address without separators.
Image settings: focus mode, IR-cut filter, brightness.
SNMP v2c is enabled by default and responds to the public and private communities. The tree is, however, trimmed to the system group and the statistics of SNMP itself: description IPCamera, uptime, name. Traffic, CPU, memory and temperature are not in it.

measured pitfalls

DHCP takes only the address. After switching to DHCP, the gateway and DNS stay static, from the old network. The camera then has an address from the new subnet and a gateway from a foreign one — ping will not detect this; the gateway has to be read via ONVIF.
The camera clock blocks login. The WS-UsernameToken must have a timestamp within the camera clock window. By default the clock is set to 1970 with the UK time zone, so a token with the current date gets 401 on everything. The camera time can be read without login and the token built from it.
The Operator level does not block writes. The only account has the Operator level, and a change of the network interface goes through anyway.
The HTTP snapshot does not check the password. A full 2592 × 1520 frame arrives without credentials, and with a wrong password also with code 200 — about 1.2 frames per second continuously. RTSP is protected, the snapshot is not. The snapshot address is returned by an anonymous ONVIF request.
Multicast is configured but does not transmit — 25 s of listening did not catch a single frame.
A camera with a foreign static address gives itself away: roughly every second it sends ARP requests for the dead gateway, and roughly every 20 s it probes a 169.254 link-local address. A silent camera would be entirely invisible.

After NTP is set via ONVIF, the time changes immediately, without a restart. It is most reliably checked on the timestamp burned into the image, not in the API response.

what we cannot read

Image or health metrics over SNMP — only “alive” and uptime.
Management via a browser — without the plugin the page is blank.
Whether the private community allows writes — not checked, because the test changes the device state.
The platform the camera is built on — the trade brand does not reveal it.

full parameter list

A full parameter list for this model is not here yet — the ones described above are those we have read and verified. A missing list does not mean the device exposes nothing more.