Open DVR DHCPDiscover Report

LAST UPDATED: 2022-08-29

This report identifies devices that have an open DVR DHCPDiscover service on port 37810/UDP. DHCPDiscover is a UDP-based JSON protocol used to help manage networked digital video recorders (DVRs), particularly of the Dahua brand.

This service is actively abused for DDoS amplification attacks, with an amplification factor of  around 25. More details can be found in the original research and discovery by Phenomite.

If you are receiving this report, please take steps to filter/block traffic to this service from the Internet.

For more information on our scanning efforts, check out our Internet scanning summary page.

This report was enabled as part of the European Union INEA CEF VARIoT project.

Filename: scan_dvr_dhcpdiscover


Fields

  • timestamp
    Time that the IP was probed in UTC+0
  • ip
    The IP address of the device in question
  • protocol
    Protocol that the DVR DHCPDiscover response came on (always UDP)
  • port
    Port that the DVR DHCPDiscover response came from (often 37810 even though scan is aimed at 37777).
  • hostname
    Reverse DNS name of the device in question
  • tag
    Set to dvrdhcpdiscover
  • asn
    ASN of where the device in question resides
  • geo
    Country where the device in question resides
  • region
    State / Province / Administrative region where the device in question resides
  • city
    City in which the device in question resides
  • naics
    North American Industry Classification System Code
  • sic
    Standard Industrial Classification System Code
  • device_vendor
    Device vendor identified, if any
  • device_type
    Device type identified, if any
  • device_model
    Device model identified, if any
  • device_version
    Device version identified, if any
  • device_id
    Device id identified, if any
  • device_serial
    Device serial identified, if any
  • machine_name
    Machine name
  • manufacturer
    Manufacturer
  • method
    Request method (client.notifyDevInfo)
  • http_port
    HTTP port of device as reported by the device
  • internal_port
    Port of device used for management (different to the one being scanned for) - as reported by the device
  • video_input_channels
    Video input channel
  • alarm_input_channels
    Alarm input channel
  • video_output_channels
    Video output channel
  • alarm_output_channels
    Alarm output channel
  • remote_video_input_channels
    Remote video input channels
  • mac_address
    MAC address of the device
  • ipv4_address
    IPv4 address of the device (as reported by the device)
  • ipv4_gateway
    IPv4 gateway of the device (as reported by the device)
  • ipv4_subnet_mask
    IPv4 subnet mask of the network of the device (as reported by the device)
  • ipv4_dhcp_enable
    Is IPv4 DHCP enabled
  • ipv6_address
    IPv6 address of the device, if any (as reported by the device)
  • ipv6_link_local
    IPv6 link local address (as reported by the device)
  • ipv6_gateway
    IPv6 gateway of the device (as reported by the device)
  • ipv6_dhcp_enable
    Is IPv6 DHCP enabled
  • response_size
    Response size in bytes
  • amplification
    Amplification factor (This amplification is is based solely on the payload size sent and payload size received)

Sample

"timestamp","ip","protocol","port","hostname","tag","asn","geo","region","city","naics","sic","sector","device_vendor","device_type","device_model","device_version","device_id","device_serial","machine_name","manufacturer","method","http_port","internal_port","video_input_channels","alarm_input_channels","video_output_channels","alarm_output_channels","remote_video_input_channels","mac_address","ipv4_address","ipv4_gateway","ipv4_subnet_mask","ipv4_dhcp_enable","ipv6_address","ipv6_link_local","ipv6_gateway","ipv6_dhcp_enable","response_size","amplification"
"2010-02-10 00:00:00",192.168.0.1,udp,37810,node01.example.com,dvrdhcpdiscover,64512,ZZ,Region,City,0,0,"Communications, Service Provider, and Hosting Service",General,IPC,BCS-TIP3401IR-E-V,2.800.106F004.0.R,,6J0E022PAG35073,6J0E022PAG35073,General,client.notifyDevInfo,80,37777,1,0,0,0,0,38:c4:e8:03:b3:e2,192.168.0.1,192.168.0.240,255.255.255.0,0,fd09:4ab5:dae9:b078::1,fe80::3ac4:e8ff:fe03:b3e2/64,fd09:4ab5:dae9:b078::ff,0,794,794.00
"2010-02-10 00:00:01",192.168.0.2,udp,37810,node02.example.com,dvrdhcpdiscover,64512,ZZ,Region,City,0,0,,Private,HCVR,HCVR,3.210.1.4,,2K0488CPAGS0ND6,HCVR,Private,client.notifyDevInfo,80,37777,3,0,0,0,9,3c:ef:8c:18:a5:07,192.168.0.2,192.168.0.240,255.255.255.0,0,fd09:4ab5:dae9:b078::2,fe80::3eef:8cff:fe18:a507/64,fd09:4ab5:dae9:b078::ff,,761,761.00
"2010-02-10 00:00:02",192.168.0.3,udp,37810,node03.example.com,dvrdhcpdiscover,64512,ZZ,Region,City,0,0,"Communications, Service Provider, and Hosting Service",General,HCVR,BCS-XVR0401-IV,4.000.0000002.11,,5L034FAPAZA0E30,XVR,General,client.notifyDevInfo,80,37777,4,0,0,0,0,38:c4:e8:02:74:da,192.168.0.3,192.168.0.240,255.255.255.0,0,fd09:4ab5:dae9:b078::3,fe80::3ac4:e8ff:fe02:74da/64,fd09:4ab5:dae9:b078::ff,,711,711.00

Our 129 Report Types