UPDATE 10/10/2007 Put together a very simple Coldfusion script that can control a camera by connecting directly to the cam, taking control of it, and sending binary control data. Here's the example source:

<!--- Access the Java Thread class (for sleep) --->
<cfset thread = createObject("java", "java.lang.Thread")>
<!--- Create a default TCP socket connection to the camera --->
<cfset sock = createObject("java", "java.net.Socket").init("10.0.0.20", 65311)>
<!--- Ensure that we are connected to the camera --->
<cfif sock.isConnected()>
	<!--- Create a simple binary output stream, for writing to the camera's control port --->
	<cfset sWriteStream = createObject("java", "java.io.DataOutputStream").init(sock.getOutputStream())>
	<!--- Send the "Authentication" aka "handshake" command to the camera so that we can control it --->
	<cfset sWriteStream.write(BinaryDecode("00000000002100010000000000000000", "Hex"), 0, 16)>
	<!--- Send the camera to upper left zoomed in: PAN 170.00deg + TILT 10.01deg + ZOOM 41.26deg --->
	<cfset sWriteStream.write(BinaryDecode("00000000003300E0426803E9101E0000", "Hex"), 0, 16)>
	<!--- make the controls wait for 5 seconds --->
	<cfset thread.sleep(5000)>
	<!--- Send the camera back to center zoomed in: PAN 0.00deg + TILT 0.00deg + ZOOM 41.26deg --->
	<cfset sWriteStream.write(BinaryDecode("00000000003300E0FFFFFFFF101E0000", "Hex"), 0, 16)>
	<!--- cleanup - close the output stream and the socket connection --->
	<cfset sWriteStream.close()>
	<cfset sock.close()>
<cfelse>
	Cannot connect to the camera's control port
</cfif>

Another goal of mine was to be able to control a Canon VB-series Network Camera that has controllable Pan, Tilt and Zoom functionality. I wanted to figure out how to access the camera directly through it's proprietary "Control" port which defaults to 65311.

After analyzing the traffic sent over this port - the protocol has proven to be rather easy to use. A single 16byte TCP packet controls the camera's Pan, Tilt and Zoom. The 16byte command is outlined in the following packet breakdown:



This is just a note sent to outline my initial findings. This is specific to the "VB-C50i" cameras. The maximum Pan, Tilt and Zoom values should be outlined in the manual - and the "33|00|E0" command works for the VB-C10i camera as well.

Other functions used over this control protocol need to be determined, such as:

• how to authenticate with the camera
• the backlight on/off (for the VB-C50 series)
• keepalive connection

Notes:

• The socket - once created and authenticated - needs to remain open in order to send multiple commands
• If the socket is closed and the camera is setup to return to "home" after a connection is lost - it will
• The applet takes precedence when allowing users to control the camera - and commands sent via the control protocol are ignored.
• A user with an open socket can control the camera only if there is noone controlling it through the applet (which controls the camera via HTTP)

... More to come ...