Novus NVIP-4DN5002V/IRH-1P

Novus · dome IP camera, 4 MP · NVIP-4DN5002V/IRH-1P

Generic drawing of the device class, not of this model

what it is

An IP camera in a flat dome Ø100 × 53 mm. The lens is not on the front but in a dark bubble protruding from the bottom; next to it, in a separate rectangular window, there is one infrared LED. Power: PoE 802.3af class 3: consumption 3 W, 5 W with infrared, 7.5 W with infrared and heater (manufacturer datasheet).

The drawing above shows a tube — the general shape of the camera class, not this model.

This is a different family than the Novus NVIP-4DN3513H, despite the same brand: a different ONVIF stack, different stream and snapshot paths, a different network interface identifier. Assumptions from one do not carry over to the other. The NVIP-4DN5002H/IRH-1P variant is a tube.

what we read from it

The camera speaks ONVIF 2.60 on port 80 — a much newer stack than 2.3 in the brand's tube cameras.

Two RTSP streams H.264 with G.711 audio: main 2592 × 1520 and secondary 704 × 576. There is no third one.
Model, firmware version and serial number — the serial number is the MAC address with colons.
Recording, search and replay services — the stack declares recording in the camera itself. Whether storage media is mounted was not checked.
Image settings, events and analytics via ONVIF.

SNMP does not respond to either public or private. So the lack of SNMP is not a trait of the brand but of the model — the NVIP-4DN3513H tube has it.

measured pitfalls

Nothing without a password. Even a time request returns Sender not Authorized. By default the clock is set to January 1, 2000, so a login token built from the current date falls outside the camera clock window. The time has to be read some other way, for example from the timestamp in the image.
The network interface is not named eth0. ONVIF returns the identifier NetworkInterfaceToken_1 with the name lo. A tool with eth0 hardcoded will not switch the camera to DHCP — the identifier has to be read first.
Declaration and measurement differ. The main stream configuration says 20 fps, while the measured stream has 30.
The ONVIF snapshot does not check the password. A full 2592 × 1520 frame arrives with code 200 without credentials, with Basic and with Digest alike. The path differs from the brand's tube cameras — the snapshot address request returns it.
Silent by default. The camera ships with a static address from another subnet and — unlike the brand's tube cameras — sends no ARP requests. A scan of your own subnet will not find it; only active ARP requests for addresses in candidate subnets help.
The IPv6 address is a dummy — a factory address from the deprecated 3ffe::/16 pool, with no connectivity.
Set NTP after DHCP. On the factory address the camera has no route to the time server.

what we cannot read

Anything over SNMP.
Anything without credentials via ONVIF — except the snapshot, see above.
The height dimension from a measured drawing view — the three views in the manufacturer datasheet have three different scales; 53 mm comes from the datasheet text.

full parameter list

A full parameter list for this model is not here yet — the ones described above are those we have read and verified. A missing list does not mean the device exposes nothing more.