Sends real packets. Use it only on hosts you run or have permission to test.
A real protocol reply came back. An RTSP server answered OPTIONS, ONVIF WS-Discovery returned a match, or an HTTP listener named itself. A 401 counts: refusing you is still answering you.
The port answered without identifying itself, or stayed silent where silence proves nothing. That is what a camera behind a login looks like from outside, and also what a hundred other things look like.
Refused or dropped. The address is reachable and nothing responded on that port. Read as nothing there, not as nothing anywhere.
RTSP OPTIONS on 554. A single RTSP request over TCP. A camera answers with a
Server header naming itself, often down to the model. A 401 Unauthorized
is still a confirmation: only an RTSP server sends it.
ONVIF WS-Discovery Probe on 3702/UDP. A SOAP probe for
NetworkVideoTransmitter. A match returns scopes, which usually carry the hardware
model verbatim, for example onvif://www.onvif.org/hardware/DS-2CD2042WD. WS-Discovery
is designed for multicast on a local segment, so a unicast probe from outside going unanswered
rules out very little.
HTTP HEAD on the web ports. The Server header and the
WWW-Authenticate realm name the vendor more often than the page body does, and a HEAD
never fetches a frame or logs in.
Only the ports in the bar are touched. A camera on a different port, behind a relay, behind a vendor cloud tunnel or behind a CDN answers nothing here and is still there.
Silence is never upgraded to a detection. A dropped UDP datagram and a device that ignores unicast discovery produce the same empty result, and UDP probes are not retransmitted, so run it twice before believing a silent ONVIF row.
A confirmed RTSP or ONVIF reply says a camera-shaped service is reachable from the public internet. It says nothing about where the lens points, whether it is recording, or who is watching.