Genetec

October 2021

Basic Video
Streaming in SC
Pierre-Olivier Lafontaine
BASIC VIDEO STREAMING IN SC

Introduction

Pierre-Olivier Lafontaine
• Been working in R&D at Genetec for nearly 20 years
• Currently in the Technical Delivery team
• Handling the RDSolutions mailbox

The presentation should be a around 2h

• Will be leaving time at the end for questions and feedback
BASIC VIDEO STREAMING IN S

Basic Video Streaming in Security Center

Stream Storage Stream Transport Stream

consumption
• Hardware • Media Router &
• Archiver & Aux Redirectors • Security Desk
Archiver • Networks\Routes\Tunnels • Media Gateway, Web
• Alternate Storage • Federation and Mobile Server
• Archive Transfer
Stream
storage
HARDWARE

Internal storage

Types of disks Performance

Serial ATA (SATA) Least performance and reliability but best price/GB
Middle ground between pricier SAS and cheaper
Near Line SAS (NL-SAS)
SATA
Serial Attached SCSI (SAS) Best performance and reliability but expensive

SSD hard drives versus mechanical drives

• SSD should be used for the OS partition, not video archiving
• Mechanical drives are usually capped around 200Mbps
HARDWARE

Raid Controller

RAID controllers manage disks to make them work as a one

logical unit.
Array Performance
Raid 0 Best performance but no provides no fault tolerance. Not
recommended for SC usage.
Raid 1 Data will be mirrored on all disks used in the array. Good for
small IO operations (OS).
Raid 5 Data is spread over all the disks. Can afford one disk loss
and the rebuild can be really long.
Raid 6 Same as Raid 5 but slower for writing. It can support two
disk failures and disk rebuild are faster.
HARDWARE

NAS and SAN

NAS is a file-level data storage server.
• When using a NAS with SC, make sure it report’s its max size and remaining space to
windows because of the archiver retention feature.
• Protocols
• NFS, CIFS (Windows), SMB, AFP

A SAN is seen as a disk by the OS and does not have a file

system.
• Protocols
• Fiber channel (1 Gbps to 16 Gbps)
• iSCSI (1 Gbps to 40 Gbps)
• AoE, FCoE, HyperSCSI
HARDWARE

IOPS

IOPS numbers published by storage manufacturers do not

relate to real-world performance. You must define the
application workload.
IO characteristics
• IO size (> 1000KB for the Archiver)
• IO access pattern (Random, sequential)
• thread count
• read/write ratio
HARDWARE

Files and folders

Windows NTFS supports the following

• Maximum disk and file size: 256 terabytes
• Maximum number of files on disk or in a single folder : 4,294,967,295

Windows performance will start to decline when dealing with

large number of files in a single folder.
• You should try to keep the number of files under 1000 per folder.
HARDWARE

Fragmentation

File fragmentation is a term that

describes a group of files that are
scattered throughout a hard
drive platter instead of one
continuous location.
This will have a significant impact
on writing and reading from disk.
ARCHIVER AND AUXILIARY ARCHIVER

Architecture overview – Archiver Role

Archiver Role
• [Link]

The archiver role is the brains of the

operation. It controls the following
functions:
• Connection to the Directory
• Recording configuration
• Camera configurations
• The archiver agents and the fail-over
ARCHIVER AND AUXILIARY ARCHIVER

Architecture overview – Archiver Agent

[Link]
• Does the actual recording and indexing of the video
• A 32 bit process so it’s memory is capped at 4GB

[Link]
• Responsible for enforcing the archiving priority (FOA)

[Link]
• Responsible for the command and control of the
video units
• Receives the video packets, re-orders and re-
assemble the video frames and copy send them to
the archiving agent (shared memory)
ARCHIVER AND AUXILIARY ARCHIVER

Streams and g64 files

Each stream in the fusion stream will have it’s own g64 file.
The main track used today for the fusion stream are
• Video
• Audio
• Metadata
• Encryption keys
ARCHIVER AND AUXILIARY ARCHIVER

Disk group management

• The default disk group consists of all

the local drives.
• An archiver can manage more than one
disk group.
• It can assign different cameras to
different groups.
• The archiver agent must be the only
thing using a selected disk.
ARCHIVER AND AUXILIARY ARCHIVER

Archiver recording mode

Continuous
• Simplest when it comes to design and
configuration. Make sure storage can
match the throughput and the retention.

On motion / Manual
• Can be tricky to calculate the amount of
storage needed because of the pre-event
buffer and the unpredictable nature of
motion recording.
• Beware of sudden archiving bursts
• Can generate a lot of events in a large
system
ARCHIVER AND AUXILIARY ARCHIVER

Archiver Encryption

Can be done by the archiver or the camera (Bosch, Axis, Pana,

Hanwha).
• Encryption by Archiver, the video must go to it to get encrypted.
• Encryption by the unit will allow multicast video stream from the unit.
• Encryption in transit only, archived video not encrypted, no certificate needed

The certificate needed for this feature must contain a public\

private key.
• See admin guide section Creating custom certificate requests for Security Center for
more info.
• You can (should) install a certificate with just the public key on the archiver.
• You must have the private key in the certificate installed on the clients.
ARCHIVER AND AUXILIARY ARCHIVER

Archiver Encryption – in transit and at rest by

archiver
Symmetric
key

Unicast Only TCP\Unicast\Multicast

RTP video stream SRTP video stream

Symmetric
Symmetric
key key Symmetric
Generated every minute key
RTP video stream SRTP video stream

Playable
RTSP secure coms video

Fusion stream
cv cv
Archiver Security Desk
Public key
Private
Pub lic\
Public key key keys
private

Storage
ARCHIVER AND AUXILIARY ARCHIVER

Archiver Encryption – in transit and at rest by

unit
Symmetric
key

TCP\Udp\Multicast
TCP\Udp\Multicast SRTP video stream
cv
Public key Symmetric key Symmetric
SRTP video stream Generated every minute
SRTP video stream
key

HTTPS

TLS secure coms Playable

RTSP secure coms video

Fusion stream
cv cv Security Desk
Archiver
Public key
Private
Pub lic\
Public key key keys
private

Storage
ARCHIVER AND AUXILIARY ARCHIVER

Archiver Encryption – in transit from Archiver

Symmetric
key

Unicast Only TCP\Unicast\Multicast

RTP video stream SRTP video stream

Symmetric
Symmetric key
key
Generated every minute
RTP video stream SRTP video stream

Playable
Symmetric video
RTSP secure coms
key

RTP video stream

Archiver Security Desk

Storage
ARCHIVER AND AUXILIARY ARCHIVER

Watermarking

Creating the watermark

• We compute a hash of all the video
frames in the file and combine the hash
of each consecutive frames
• We encrypt this combined hash value in
the G64 file using the private WM key;
• We encrypt the public WM key, then
encrypted using the Arc private key and
then store this in the G64 file

We can think of watermarking

as a digital signature
ARCHIVER AND AUXILIARY ARCHIVER

FOA and Redundant Archiving

It is common to use one server to
back up multiple Archivers roles. If
the FOA cannot handle all of them at
once, configure the archiving priority.
When enabling redundant archiving
• All servers associated with the archiver role will
record, cannot have one of them in standby
• Multicast streams will be requested if possible
• Cannot use end-to-end encryption (encryption
from the unit)
ARCHIVER AND AUXILIARY ARCHIVER

Auxiliary Archiver

Only one role which does the actual recording, no agents.

Key differences between the Archiver and the Auxiliary Archiver
• No command and control
• Different archiving pipeline architecture (slower than the archiver)
• Does not directly support encryption but will record the encrypted video from an
Archiver
• Can be a source for archive transfers but not a destination
ARCHIVER AND AUXILIARY ARCHIVER

SQL and retention

When should I switch from SQL Express to standard for my

Archiver?
• SQL performance is not really a factor, but DB size is (max 10GB for Express)

SQL latency should be kept as low as possible and never be

over 10ms.
On a typical setup, you will fill roughly 2000 camera days for
each 1GB of DB size. As a rule of thumb, stay under 10K
camera days.
ALTERNATE STORAGE

Cloud Archive – Old plugin

The plugin is installed on archivers

where you want to push video to the
cloud.
• Identifies the video archives that must be
uploaded to the cloud.
• Encrypts the archives with the configured
password.
• Automatically uploads the archives to the
cloud and removes it from local storage.
• Downloads archives from the cloud when
playback requests are received.
• Decrypts archives for playback by Security
Desk.
ALTERNATE STORAGE

Cloud Archive – Old plugin

Your network must provide a guaranteed uplink that is 30%

greater than the video throughput recorded by the archivers.
• If your system has one Archiver that records 100 Mbps of video, your network must
provide a guaranteed uplink to the cloud of at least 130 Mbps.

Motion search is not supported by Archivers installed

with Cloud Archives.
Archiver and Aux. Archiver statistics shown in Config Tool are
not accurate.
If the on-premise Archiver or Auxiliary Archiver database is
lost, access to cloud archives will be lost.
ALTERNATE STORAGE

Cloud Storage – New core functionality

Video is recorded locally by the

Archiver in accordance with your local
retention policy.
After a configurable period in local
storage, video archives are uploaded
to the cloud. In the cloud, video
archives are assigned to an access tier
based on your cloud retention policy.
When needed, specific video archives
are retrieved from the cloud and
streamed by the Cloud Playback role
to client stations.
ALTERNATE STORAGE

Cloud Storage – Limitations

Beware of limitations and

of how the single playback
role will affect video
routing.
ALTERNATE STORAGE

Edge storage

Typically, camera edge storage are done

on flash cards. Those cards are
notoriously easy to burn out.
Playback done directly from edge
storage will add latency to the archiver
queries. They are off by default
Stream transport
MEDIA ROUTER & REDIRECTORS

Media Router

The Media Router is the brain for all stream

redirection
• It stores all available streams locations in the
DB.
• Knows all redirectors, networks and routes.
• Makes all the decisions regarding the network
path and transport protocols
• Must be reachable by all redirectors, stream
sources and stream consumers.
MEDIA ROUTER & REDIRECTORS

Media Router

The video does not go through the

MR.
The Media Router assigns the
multicast address for each stream the
first time it’s registered.
The RTSP requests are made on port
554 (default) and are secured by
default (TLS).
MEDIA ROUTER & REDIRECTORS

Redirectors

Redirectors are added, removed or

configured from the Media Router
role properties tab.
Each Genetec Server can potentially
run a Redirector (only one per
server).
Redirectors are automatically created
on servers where Archiver roles are
running and cannot be removed.
MEDIA ROUTER & REDIRECTORS

Redirectors

The RTSP channel (TCP port 560) is

used for the command and control of
the stream and for playback streams.
• When Media Router secure comms is selected, the
rtsp channel is secured (TLS).

Live video will be redirected using port

5004 and is not encrypted on the
channel.
MEDIA ROUTER & REDIRECTORS

Redirectors – Bandwidth Control

You can control the redirection usage

in 2 ways:
• By limiting the amount of
concurrent Live and Playback
streams
• By limiting the overall bandwidth
used by Live or Playback streams
MEDIA ROUTER & REDIRECTORS

Redirectors – Redirection Strategy

Redirection strategy is used to

prioritized one network connection
(network card-port) over another
for Live, Playback or Export.
• In the picture to the right, the
Live video would first try to go
out on the first network
configuration before falling back
the second in case of failure.
NETWORKS\ROUTES\TUNNELS

Network and routes

The network task in the configtool is used to define the network

topology on which Security Center is operating. It’s used to
configure the following things:
• Networks
• Routes
• Servers
NETWORKS\ROUTES\TUNNELS

Network and routes - Networks

The network entities represent

different IP ranges of the LAN/WAN.
Each network entity defines the
network capabilities of that range.
• TCP, UDP (TCP), Multicast(TCP,UDP)

Every application connecting with an

IP from that range will be seen as
belonging to that network and
supporting its capabilities.
Applications outside of all the
configured range will fall into the
default network.
NETWORKS\ROUTES\TUNNELS

Network and routes - Routes

Routes represent the possible

paths between networks and
the network capabilities
supported by them.
Routes between parent and
child networks are created
automatically and cannot be
removed.
The lowest capability between
the source network, destination
network and route will be used
NETWORKS\ROUTES\TUNNELS

Network and routes - Servers

All Genetec servers of the

system will be automatically
added to the network view.
Redirectors running on a server
in a given network will only use
that network’s capabilities and
the configured routes
capabilities to redirect the
streams.
NETWORKS\ROUTES\TUNNELS

Network and routes – Server Proxy

Configuring a server as a Proxy

will affect 2 things :
• Server to server
• In this scenario, any server from a
different network that needs to talk to a
server on a network with a proxy will go
through that proxy server unless the
destination server has a public address.

• Video redirection
• Whenever a redirector is used (live and
playback have different requirements for
using a redirector) to redirect video from
and to a different network, the ones
configured as proxy will be used.
NETWORKS\ROUTES\TUNNELS

Network and routes – Server Public Address

Configuring a server with a public

address will affect server to
server communication and video
redirection the same way:
• Any server\redirector communicating with
another server\redirector using a public
address and on a different network will use
that public address to communicate\redirect
unless there is an explicit route between the
2 networks with the parameter use private
address configured.
NETWORKS\ROUTES\TUNNELS

Network and routes – Route selection

For live video

• Will select the least busy redirector in all needed networks
• Live streams are only sent once between 2 networks
• Video will take the closest redirector from the destination

For playback
• Will take the closest redirector possible from the source

If no routes are found for either Live or Playback, the request will
default back to a direct connection to the source in TCP.
NETWORKS\ROUTES\TUNNELS

Network and routes – Common mistakes

Customer issues happen when using a public address, a proxy or both.
• Using a public address on a server
• Servers on different local networks will get served the public address which may be unreachable
for the local network. Use private address in the routes to solve this.

• Using a public address on a server that is on the same network as

other servers and is not a proxy.
• Applications connecting from outside of the network using the public address can be redirected to
the other servers without a public IP.

• Using a single proxy server on a network with other servers.

• All redirections will be on that proxy even if applications on a different network have access to the
other servers

• Using a server proxy as a video gateway for all video from and to
the network
NETWORKS\ROUTES\TUNNELS

Reverse Tunnel

This feature is FaaS only for now.

Only the Federation, Media Router
and Redirector communicate through
the Tunnel. Those connections are
not encrypted which means the data
must be.
The video will go through the tunnel
agents which can now be configured
to encrypt all data going through it.
FEDERATION

Federations – Security Center federation

When a SC federation role is created, a network representing

that system will automatically be created and cannot be
deleted.
All video coming from federated camera will be considered
coming from the federated network regardless of IP (That’s why
this network has no IP Range).
Video will follow the network and routes configured in both
systems to reach the Security Desk. Do not forget to configure
the routes from the federated network to route video correctly.
FEDERATION

Federations – Security Center federation

When viewing a federated camera from Security Center, the

Security Desk will request the stream from the local Media
Router who will forward it to the federated Media Router. The
video will go though the redirectors of both systems. Both MR
must be able to communicate.
Stream
consumption
SECURITY DESK

Security Desk– Network selection

The video routing and

transmission mode (TCP, UPD,
Multicast) will be determine by
which network the SD is on (Auto-
Detect by default).
The network association can be
overridden in the SD options.
SECURITY DESK

Security Desk – Live video

For live video requests, the media

player will request the default live
stream (Live). This can be
overridden in the tile (right-click).
The default Live stream can be
configured in the SD options.
Automatic stream selection will
automatically change the stream
selection base on the tile size.
SECURITY DESK

Security Desk – Playback video

For playback video requests, the

media player will request the
default playback source(Any
source). This can be overridden in
the tile (right-click).
The media player downloads video
segments ahead of time for
playback. If multiple sources can
have video, the media player will
stich the video segments together
based on who answers first.
MEDIA GATEWAY, WEB AND MOBILE SERVER

Media Gateway

The Media Gateway is used retrieve and transcode the for both
the Web Client Server and the new Mobile Server roles. Those
APIs are not public and are different from the RTSP interface
used on port 654.
The video can also be retrieve directly from the Media Gateway
using RTSP when you have the Media SDK license part.
• Ex : rtsp://[Link]:654/00000001-0000-babe-0000-0a58ecd93039/Live

The RTSP protocol implemented respects the official RFC which

means any app (like VLC) that implements it can connect to the
Media Gateway.
MEDIA GATEWAY, WEB AND MOBILE SERVER

Media Gateway

You can limit the number of streams redirected by the

Media Gateway by changing the
[Link] file:
<configuration>
<MediaGateway MaximumLiveSessionCount="10"
MaximumPlaybackSessionCount="5"></MediaGateway>
</configuration>

You can select the different video streams by

replacing the last parameter in the URL by the
desired stream name.
• Live, Remote, Recording, LowRes, HighRes

Video playback is supported by the Media Gateway

MEDIA GATEWAY, WEB AND MOBILE SERVER

Media Gateway

Before 5.8, only one Media

Gateway role can be created but
multiple agents can be added to
scale out the number of
redirected streams.
Role fail-over is supported.
The stream requests will be load
balanced on all available
servers.
MEDIA GATEWAY, WEB AND MOBILE SERVER

Media Gateway

RTSP stream request can be

(should be) protected by user
authentication.
Security Center users are used
but the password is not the same
as the Directory password and is
only valid for the Media Gateway
RTSP requests.
MEDIA GATEWAY, WEB AND MOBILE SERVER

Web Client Server

The Web Client Server role supports standard role fail-over.

However, it does not serve any web pages, it only manages it’s
agents. All web request are processed by the Web Client
Server agents.
The Web Client Server does not redirect any video. The Web
Client Server needs the Media Gateway role to redirect and or
transcode the video. The Web Client Server will automatically
add a Media Gateway agent on all servers where it runs.
The remote stream of the camera is used when a web client
requests video.
MEDIA GATEWAY, WEB AND MOBILE SERVER

Web Client Server

The video request made by the Web Client Server to the Media
Gateway are done on a private REST API (not the RTSP API) on
the default Genetec Server port (443 by default). This implies
that all video transmission will be secured in transit if the
HTTPS connection is used.
H.264 video stream will not be transcoded, but will be directly
transmitted to the player when the browser supports
H.264/avc3 in its media source extension (not the case for IE).
We fall back to MJEPG when errors occurs, if the PTZ is used
(because of latency issues) or if the source stream is not a
standard h264 stream.
MEDIA GATEWAY, WEB AND MOBILE SERVER

Web Client Server

The video will always come from the

Media Gateway agent running on the
same machine as the Web Client Server
agent.
Load balancing is done automatically
between the Web Client Server Agents of
the same role (the one with least
connections is chosen). This implies that
the video is load balanced by web clients
connected to the Web Client Server
agent.
MEDIA GATEWAY, WEB AND MOBILE SERVER

Mobile Role

The Mobile Role supports standard role fail-over. However, it

does not talk directly with the mobile apps, it only manages it’s
agents. All mobile app request are processed by the Mobile
Role agents.
The Mobile Role agents will redirect the video to the mobile
app. However, the Mobile Role agents still need the Media
Gateway role to retrieve and transcode the video.
The Mobile Role will be in a warning state if no Media Gateway
role exist in the system.
MEDIA GATEWAY, WEB AND MOBILE SERVER

Mobile Role

The Mobile Role agent will redirect the video from the Media
Gateway on the same channel used by the mobile app. The
video stream will be on a secured channel (HTTPS) from the
Media Gateway all the way to the mobile app.
All requested video stream to the Mobile Role app will be
transcoded in MJEPG. The remote stream is used by default for
all video requests.
MEDIA GATEWAY, WEB AND MOBILE SERVER

Mobile Role

When a mobile app connects to

the role, it will get a list of all
available agents with a load score.
It will send a request to all the
agents and based on the response
and the score, it will login to the
agent.
The mobile role agent will request
the video from the media gateway
and receive it from any load
balanced Media Gateway Agent
ARCHIVE TRANSFER

Archive transfers
Archive transfer can be used to back fill
missing video or move video to a different
archiver with a longer retention capability.
Starting in 5.7, you can automatically use
the archive transfers to consolidate the
recording between a Primary Archiver and
it’s fail-over archivers (only the fail-over
archivers).
Only Archiver roles (not Auxiliary
Archivers) can be the destination of
an archive transfer.
ARCHIVE TRANSFER

Archive transfers

The duplicate archive transfer type uses

the export\playback mechanism (RTSPS)
to send the video from one archiver to
the other and is therefore encrypted in
transit.
You can control the archiver’s archive
transfer throughput in the archiver
advanced settings option dialog.
Encrypted video will be transferred with
the encryption keys in the fusion
Takeaways
TAKEAWAYS

Stream Storage

Hardware
• Beware of IOPS numbers
• Initial performance numbers will go down with fragmentation
• Keep the number of files per directory under 1000

Software
• Beware of the pre-event buffer when recording on motion or manual, chose
continuous archiving over other modes if possible
• The number of certificates used for encryption will impact performance
• Try to use fixed video file sizes for recording

Alternate Storage
• Chose the most recent Cloud Storage over the old Cloud archive plugin
TAKEAWAYS

Stream Transport

Media Router & Redirectors

• The video never goes through the media router, only through
redirectors

Networks\Routes\Tunnels
• Most of the video redirection configuration issues come from using (or
forgetting to use) a proxy\public server.
• Live and playback can take different routes to the end point

Federation
• The video route calculation is done independently in both systems and
follows the network configuration of each system.
TAKEAWAYS

Stream consumption

Security Desk
• Automatic stream selection should be used whenever possible

Media Gateway, Web and Mobile Server

• When Designing systems with Mobile Server roles or Web Client Server roles,
remember their relationship with the Media Gateway and the way the streams are
sent.
• The Media Gateway does all the video transcoding and decrypting and will be the
limiting factor in most cases.

Archive Transfer
• The archive transfer works by leveraging the video export, this will tax the source
archiver and must be considered when calculating server loads.
Where do
we go from
here
WHERE TO GO FROM HERE

For Documents

On the Elite SharePoint site in the RDSolutions document

section
• [Link]
• This presentation and other useful presentations
• Performance numbers per version
• Network diagrams

SDL, Custom Solutions Portal, BOSS

• [Link]
• [Link]
• [Link]

TechDoc Hub, User Guides (Administrator Guide), Hardening

guide
WHERE TO GO FROM HERE

For Help

For software configuration questions

• RDSolutions@[Link]
• Learning Crew

For design, hardware, technology questions

• RDSolutions@[Link]

For camera integration questions

• Alexandra Scarlat

For Security questions

• Boss@[Link]
Questions
In a Network far far away

© Genetec Inc., 2017. Genetec, Genetec Clearance, Omnicast, Synergis, AutoVu, Federation, Stratocast, Sipelia, Citywise, the Genetec Logo, the Mobius Strip Logo,
the Genetec Clearance Logo, the Omnicast Logo, the Synergis Logo, the AutoVu Logo, and the Stratocast Logo are trademarks of Genetec Inc., and may be
registered or pending registration
in several jurisdictions. Other trademarks used in this document may be trademarks of the manufacturers or vendors of the respective products.