my five cents // 4G/LTE Budget H6 Cellular Trail Cam

4G/LTE Budget H6 Cellular Trail Cam

June 16th, 2024, last changes on June 18th, 2024

TEXT

My previous wildcam has been stolen, so I decided to buy a cheapest one that has a cellular connection. It's absolutely ok for its price. Here a short summary of the features. It was sold at Amazon under the name ZAIYW, but it seems it is more about the model H6 sold under different names, e.g. Jerderfo as on aliexpress.

tldr;

🟢 Cheap

🟢 Ready-to-go (camera, battery, SIM card, solar cell)

🟢 Energy-efficient

🟢 HD live stream

🟢 5K photos

🟢 Two-way audio

🔴 Extremely weak / non-existing thief and sabotage protection

🔴 VGA-quality videos to the cloud only

🔴 Many cloud outages

In the box

The camera, a mini solar cell, an IoT SIM card with a 300 MB welcome pack, six type-18620 batteries (2600mAh at 3.7V), metal mounting with a 1/4"-20 screw (tripod-like), plastic mounting (holds both the camera and the solar cell, can be fixed with the straps or with screws), two really long straps, some screws.

IoT SIM card

I did not use it as it seems to be a Hong Kong card and the 300 MBs are not much. It was not clear from the operator's website, what would be the data package once payed. The camera works perfectly fine with a local operator's card.

Solar cell

It's really small. It seems to provide enough energy to keep the batteries on 100%, but we have summer now. I'm 100% sure it will fail in autumn. But it's a really nice gadget for the beginning!

Protection against thieves

H6 Battery Compartment

This is the weakest point of the camera. Only the back pane is actually mountable (straps, optional cable, screws). There is no way to protect the camera against opening the pane. So at any time someone may remove the batteries or even steal the camera by breaking the hinge. The slots for a SIM card and for a memory card are accessible at all times. They are just protected from rain with a rubber plug. Same for the USB port (charging only) and the main power switch: accessible at all times, just behind a rubber plug.

Sensitivity

No real difference between the three levels. On windy days the camera kept sending false alarms all the day. On quiet weather conditions the sensitivity is quite good: almost no fake alarms and triggering even with smaller distant animals.

Cloud service

The cloud service costs 1.99€ per 30 days and 7-days storage (30-days storage was at 3.99€ if I'm not wrong) and it is not the best one. It has continuous performance issues in the morning and afternoon hours. You may choose to either send photos (high quality, 5120x2880 pixels) or videos (poor quality, 640x360 pixels, HEVC encoded) on alarm. Even if you choose no cloud, miniature pictures will be sent to the cloud (640x360 pixels). I did not find any way to (temporarily) turn off the alarm function. You can switch off push messages only.

The rest of the analysis was to see what happens on the data level. Only the app-side as it would be too much work to set up a SIM-card-based isolated network.

Some of the traffic reported below may come from other apps, although the phone was forcing the data saving mode. tldr; it does not look like the camera and/or app would talk directly with Chinese servers. The probably main service portal.ubianet.com seems to coordinate most of the work, but it's IP address seems to be specific to my geographical location and (in my case) to be actually located in Germany. The recordings are stored on S3 servers and at least accessed through the southeast endpoint. I did not try to intercept the TLS traffic.

Push message (58-61 s.)

Opening the app (102-104 s.)

Opening a live stream of the camera (request 118 s., video 126-140 s.)

Opening a list of recordings (144-145 s.)

No relevant traffic observed, although it takes time to load the list of the recordings. Maybe it happens in the background while the application is running?

Playing a recording (request 179 s., video 182-188 s.)

Network diagnosis (218-224 s.)

If you open that page in the app, some tests are made and the roundtrip results are presented. The app is trying to reach out some services.

Changing camera settings (settings open 261 s., PIR sensitivity 284-285 s., back to settings 295 s.)

It looks like there is no interaction between the app and the cloud when changing camera settings. After opening the settings menu, the video stream stops and smaller packets with a visible repeating structure are exchanged between the camera and the app directly.

Next: LineageOS for Samsung S7 Edge

Previous: OSC5A2B02-based 10 MHz Oscillator

Main Menu