NVR vs DVR: Which Security Camera System is Better?

Any reason to pick IP over analog from a security perspective:

No. There is no security advantage of IP over analog for an offline recording system. Every security property that matters favors analog:

• No firmware to exploit ✓
• No command channel ✓
• No local network ✓
• No bidirectional communication ✓
• Physical access to cable gives nothing useful ✓

IP has zero security advantages over analog. IP has feature advantages (resolution, compression, SD cards, audio) but security is entirely analog's domain.

How much easier to attack IP vs analog via cable:

This is the precise question. Let me be exact:

Analog camera removed, coax cable exposed:

What attacker has access to:

• Raw analog video signal — they can watch the video feed
• 12V DC power wire — they can short it, cut it, or use it to try to damage power supply
• No network access whatsoever
• Cannot reach DVR command interface
• Cannot reach other cameras
• Cannot delete recordings
• Cannot modify DVR settings
• Cannot push malicious firmware to anything

Tools needed to do any of the above:

• Watch video: BNC connector and a monitor — trivial
• Short power: wire cutters — trivial
• Everything else: impossible regardless of tools

IP camera removed, ethernet cable exposed:

What attacker has access to:

• Full local network connection via PoE switch
• Can scan network and find all cameras and NVR IP addresses
• Can attempt to exploit camera firmware on any camera
• Can attempt to exploit NVR firmware
• Can attempt to delete recordings on NVR
• Can attempt to modify NVR settings
• Can attempt to push malicious firmware to cameras or NVR
• Can attempt to disable cameras remotely
• All of the above accessible from one cable

Tools needed:

• Laptop with PoE injector (~$20) and basic network tools
• Nmap for network scanning (free)
• Published CVE exploit tools (freely available for Hikvision/Dahua/Reolink)
• Knowledge level: intermediate — not expert

The difficulty comparison:

Attack	Analog coax	IP ethernet
Watch camera feed	Trivial	Trivial
Disable one camera	Cut cable	Remote command via network
Disable all cameras	Cut 8 cables individually	One command from one port
Access DVR/NVR	Impossible via coax	Possible via network
Delete recordings	Impossible via coax	Possible if NVR credentials known or exploitable
Modify settings	Impossible via coax	Possible via network
Push malicious firmware	Impossible via coax	Possible via published CVEs
Affect other cameras	Impossible via coax	Possible via shared network

Difficulty rating:

• Analog: attacking DVR via coax = essentially impossible
• IP: attacking NVR via ethernet = intermediate skill level, freely available tools

From what ive understood so far is that analog is the top security choice (due to the port from the cameras just physically not being able to accept any form of communication as it just acts as an analog sensor port) and ip is the convenience choice mainly but also adds protection against wiretapping. but that's it (as each camera being its own computer with exploitable firmware makes it an attack vulnerability to the whole system x however many cameras you have and however many different models you have each with separate different firmwares)

so using analog cameras to feed their own hdtvi splitters then from those splitters, feed separate systems (either an offline dvr for recording that cant be tampered with, or an online nvr connected to the analog cameras via analog to ip encoders, or preferably both via multiple offline dvrs hidden around your house for redundancy and safety purposes and the "decoy" that is actually connected to the internet for remote viewing which is preferably an nvr for better update support atm)

the alternative was an ip poe system that goes from offline poe cameras to a switch, then that switch feeds an offline nvr. the same switch also feeds a pi or something that can take the RTSP streams from the cameras and convert them to SRT, which then feeds a diy data diode (ethernet to fiber dual node converter but only plug in a single node cable for send and put a piece of tape over the receive side). then from the other side of that data diode a secondary online pi that takes from SRT streams for home assistant or whatever your preference for remote viewing and notifications as well as a backup redundant offsite cloud save
the downside being that if a camera is ripped off its mounting spot it can be used to manipulate your entire system including the offline "airgapped side"

both systems would have surge protectors/ground loop isolators/fiber adapters/individual line fuses to ensure the system cant just be easily fried all together from a single camera point with a taser or equivalent

anything im missing? or not considering? or literally anything?

EDIT:
apparently SRT wont work on a data diode?
found this instead
The most secure, protected option for streaming video over a DIY single-fiber data diode is MPEG-TS over UDP paired with Forward Error Correction (FEC) and Pre-Shared Key AES Encryption.

Because your single-fiber cable physically prevents a return path, standard two-way handshakes fail. This specific configuration provides robust security and stability:

1. The Core Streaming Protocol

• MPEG-TS over UDP: This is a pure "fire-and-forget" unidirectional protocol. The camera-side encoder blindly pushes video packets across the single fiber node without expecting or needing an acknowledgment (ACK) from the receiving node.

1. Error Correction (The "Protection" against Packet Loss)

• SMPTE ST 2022-1 FEC: Because the receiver cannot ask the encoder to retransmit a dropped packet, you must enable Forward Error Correction on the encoder. FEC appends mathematical redundancy data to the video stream. If a photon drops or a packet is corrupted across your DIY fiber link, the receiver uses this redundancy data to rebuild the missing video frames natively.

1. Stream Security (Data Confidentiality)

• Static AES-128/256 Encryption: Since dynamic key exchanges (like TLS/DTLS) require a bidirectional handshake, you must use static Pre-Shared Key (PSK) encryption. The video payload is encrypted at the encoder using a hardcoded key, pass-through across the one-way fiber link, and decrypted on the receiving node using the matching key.

Summary of the Setup Architecture

• Encoder Side (Transmitter): Configured to output a raw udp:// or rtp:// stream with FEC enabled and AES encryption turned on.
• Receiver Side (NVR/VMS): Configured with a matching listening port and the identical static AES key to decrypt and ingest the stream.

NVR vs DVR: Which Security Camera System is Better?

Any reason to pick IP over analog from a security perspective:

No. There is no security advantage of IP over analog for an offline recording system. Every security property that matters favors analog:

• No firmware to exploit ✓
• No command channel ✓
• No local network ✓
• No bidirectional communication ✓
• Physical access to cable gives nothing useful ✓

IP has zero security advantages over analog. IP has feature advantages (resolution, compression, SD cards, audio) but security is entirely analog's domain.

How much easier to attack IP vs analog via cable:

This is the precise question. Let me be exact:

Analog camera removed, coax cable exposed:

What attacker has access to:

• Raw analog video signal — they can watch the video feed
• 12V DC power wire — they can short it, cut it, or use it to try to damage power supply
• No network access whatsoever
• Cannot reach DVR command interface
• Cannot reach other cameras
• Cannot delete recordings
• Cannot modify DVR settings
• Cannot push malicious firmware to anything

Tools needed to do any of the above:

• Watch video: BNC connector and a monitor — trivial
• Short power: wire cutters — trivial
• Everything else: impossible regardless of tools

IP camera removed, ethernet cable exposed:

What attacker has access to:

• Full local network connection via PoE switch
• Can scan network and find all cameras and NVR IP addresses
• Can attempt to exploit camera firmware on any camera
• Can attempt to exploit NVR firmware
• Can attempt to delete recordings on NVR
• Can attempt to modify NVR settings
• Can attempt to push malicious firmware to cameras or NVR
• Can attempt to disable cameras remotely
• All of the above accessible from one cable

Tools needed:

• Laptop with PoE injector (~$20) and basic network tools
• Nmap for network scanning (free)
• Published CVE exploit tools (freely available for Hikvision/Dahua/Reolink)
• Knowledge level: intermediate — not expert

The difficulty comparison:

Attack	Analog coax	IP ethernet
Watch camera feed	Trivial	Trivial
Disable one camera	Cut cable	Remote command via network
Disable all cameras	Cut 8 cables individually	One command from one port
Access DVR/NVR	Impossible via coax	Possible via network
Delete recordings	Impossible via coax	Possible if NVR credentials known or exploitable
Modify settings	Impossible via coax	Possible via network
Push malicious firmware	Impossible via coax	Possible via published CVEs
Affect other cameras	Impossible via coax	Possible via shared network

Difficulty rating:

• Analog: attacking DVR via coax = essentially impossible
• IP: attacking NVR via ethernet = intermediate skill level, freely available tools

From what ive understood so far is that analog is the top security choice (due to the port from the cameras just physically not being able to accept any form of communication as it just acts as an analog sensor port) and ip is the convenience choice mainly but also adds protection against wiretapping. but that's it (as each camera being its own computer with exploitable firmware makes it an attack vulnerability to the whole system x however many cameras you have and however many different models you have each with separate different firmwares)

so using analog cameras to feed their own hdtvi splitters then from those splitters, feed separate systems (either an offline dvr for recording that cant be tampered with, or an online nvr connected to the analog cameras via analog to ip encoders, or preferably both via multiple offline dvrs hidden around your house for redundancy and safety purposes and the "decoy" that is actually connected to the internet for remote viewing which is preferably an nvr for better update support atm)

the alternative was an ip poe system that goes from offline poe cameras to a switch, then that switch feeds an offline nvr. the same switch also feeds a pi or something that can take the RTSP streams from the cameras and convert them to SRT, which then feeds a diy data diode (ethernet to fiber dual node converter but only plug in a single node cable for send and put a piece of tape over the receive side). then from the other side of that data diode a secondary online pi that takes from SRT streams for home assistant or whatever your preference for remote viewing and notifications as well as a backup redundant offsite cloud save
the downside being that if a camera is ripped off its mounting spot it can be used to manipulate your entire system including the offline "airgapped side"

both systems would have surge protectors/ground loop isolators/fiber adapters/individual line fuses to ensure the system cant just be easily fried all together from a single camera point with a taser or equivalent

anything im missing? or not considering? or literally anything?

EDIT:
apparently SRT wont work on a data diode?
found this instead
The most secure, protected option for streaming video over a DIY single-fiber data diode is MPEG-TS over UDP paired with Forward Error Correction (FEC) and Pre-Shared Key AES Encryption.

Because your single-fiber cable physically prevents a return path, standard two-way handshakes fail. This specific configuration provides robust security and stability:

1. The Core Streaming Protocol

• MPEG-TS over UDP: This is a pure "fire-and-forget" unidirectional protocol. The camera-side encoder blindly pushes video packets across the single fiber node without expecting or needing an acknowledgment (ACK) from the receiving node.

1. Error Correction (The "Protection" against Packet Loss)

• SMPTE ST 2022-1 FEC: Because the receiver cannot ask the encoder to retransmit a dropped packet, you must enable Forward Error Correction on the encoder. FEC appends mathematical redundancy data to the video stream. If a photon drops or a packet is corrupted across your DIY fiber link, the receiver uses this redundancy data to rebuild the missing video frames natively.

1. Stream Security (Data Confidentiality)

• Static AES-128/256 Encryption: Since dynamic key exchanges (like TLS/DTLS) require a bidirectional handshake, you must use static Pre-Shared Key (PSK) encryption. The video payload is encrypted at the encoder using a hardcoded key, pass-through across the one-way fiber link, and decrypted on the receiving node using the matching key.

Summary of the Setup Architecture

• Encoder Side (Transmitter): Configured to output a raw udp:// or rtp:// stream with FEC enabled and AES encryption turned on.
• Receiver Side (NVR/VMS): Configured with a matching listening port and the identical static AES key to decrypt and ingest the stream.

EditEdit since it didnt allow pictures to be posted:
Pros and cons of NVR and DVR systems

When comparing NVR vs DVR security systems, key differences in their operational designs can lead to distinct advantages and disadvantages. While both systems serve the same purpose, understanding these differences can help teams select the best solution for their needs. 

NVR systems

Advantages 

• Easier installation: No cables are required with wireless NVR, meaning large sites or those with complicated existing infrastructure can easily accommodate security cameras in any location. Networks using ethernet cables won’t suffer the same signal loss issues as coaxial installations, while still being easier to install due to a much smaller and thinner cable design. 
• Higher video and audio quality: Unlike analog systems, IP cameras produce digital data and are capable of transmitting HD video and audio signals simultaneously over one secure internet connection. 
• Smart features and integrations: Internet connectivity allows IP cameras to integrate a number of additional security features, such as NVR software analytics, motion sensors and object detection tools, as well as remote access controls like PTZ camera technology and remote viewing.

Disadvantages

• Higher costs: Although NVR systems can be less time-consuming to install, necessary hardware and software devices are often much more expensive than comparable DVR systems, primarily as the technology used is far newer and in higher demand. 
• Compatibility issues: Unlike DVR systems, IP cameras and NVR recorders produced by different manufacturers are not always compatible. Using ONVIF NVR can help, but some manufacturers still rely on proprietary protocols, limiting interoperability. 
• Cybersecurity risks: Transmitting all data via an internet connection can expose NVR and IP devices to cybersecurity risks, meaning admins will be required to regularly monitor network security and implement protections such as encryption and multi-factor authentication.

 

DVR systems

Advantages

• Cost-effective: DVR systems use analog cameras, which are typically more affordable than modern IP models. Opting for a DVR (vs NVR) for security cameras in older buildings can reduce costs, as it often eliminates the need for new hardware or wiring.
• Wider compatibility: Operating a digital video recorder for security camera systems allows teams to install devices produced by different manufacturers with no compatibility issues. Some devices can even be configured to provide DVR for IP cameras, which enables businesses to operate a hybrid network rather than carry out a costly rip-and-replace system upgrade.
• Cybersecurity protection: Choosing a camera DVR recorder is ideal for high-security installations like data centers and storage facilities, as all data is sent via an analog connection, preventing hackers from intercepting footage and protecting against cybercrime, which reports indicate has increased by 38% globally in 2022.

Disadvantages 

• Complex installation: Coaxial cables can be difficult to install in some sites, especially those with tight spaces and sharp corners, due to a thick and bulky casing design. 
• Design constraints: Using standard coaxial cables requires that each camera is installed near to its own dedicated power source. Signal degradation must also be considered in deployments using cable runs over 1,640 feet (500 meters) in length. 
• Limited video and audio quality: Even in optimal CCTV DVR systems, the video quality of analog cameras is significantly lower than that of modern IP cameras. Additionally, audio can only be captured by installing separate RCA connections for a limited number of cameras. While it’s possible to use a DVR with IP cameras, these newer cameras are designed to work more efficiently with NVRs.

Which security system is right for you?

Choosing between NVR vs DVR security systems is a crucial decision for business and property owners. While both types of security camera recorders offer distinct advantages in different scenarios, factors such as cost, ease of installation, usability and scalability will ultimately influence the decision. To help clarify the differences between NVR and DVR security systems, here’s an overview:

Healthcare facilities

CCTV systems in healthcare facilities must address additional needs compared to typical commercial installations. In addition to helping security staff detect and respond to threats, these healthcare security systems must be designed to protect sensitive data, such as Protected Health Information (PHI), from exposure. 

DVR security cameras can be effective in healthcare environments, as their lack of internet connectivity mitigates the threat of cyber-attacks. However, choosing a DVR security system means camera operators need to be present at all times in on-site CCTV control rooms.

A good solution may be to use both NVR and DVR security systems in different areas. For example, DVR cameras may be used in offices and server rooms where PHI is most likely to be visible, while NVR cameras can be used to cover busy areas like entrances, corridors and waiting rooms, where video analytics tools and remote viewing capabilities will be beneficial.

Government and critical infrastructure

High-risk environments like utility installations and government security system installations require highly secure CCTV systems. In many cases, these systems cannot be connected to the cloud or the public internet, making it difficult to benefit from IP security cameras safely.

Analog cameras and digital video recorders are often preferred in these environments due to their lack of internet connectivity and low-latency operation. Some facilities may develop DVR security systems with added remote-viewing capabilities supported by extra hardware.

It’s also possible to develop NVR security systems that work over a local closed network, allowing cameras and network video recorders to communicate with each other but not the wider internet. If these systems are used in high-risk environments, sophisticated cybersecurity solutions like encryption and endpoint threat detection software will be needed.

Schools and campuses

Similarly to healthcare and government facilities, school CCTV systems must be highly secure to protect sensitive student information. DVR security systems can be effective for this reason, as they help to mitigate data breaches by operating within a closed system.

DVR systems can also be cost-effective for schools, as many school buildings are older and more likely to have the existing infrastructure that supports analog cameras. However, if new wiring infrastructure is needed, installing Ethernet cables may be easier and more beneficial.

Installing a new NVR security system allows schools to use modern IP cameras with advanced features and remote viewing capabilities. The management platforms for NVR systems are also highly user-friendly, featuring customizable dashboards and controls designed for ease of use by less experienced operators.

NVR vs DVR: Which Security Camera System is Better?

Any reason to pick IP over analog from a security perspective:

No. There is no security advantage of IP over analog for an offline recording system. Every security property that matters favors analog:

• No firmware to exploit ✓
• No command channel ✓
• No local network ✓
• No bidirectional communication ✓
• Physical access to cable gives nothing useful ✓

IP has zero security advantages over analog. IP has feature advantages (resolution, compression, SD cards, audio) but security is entirely analog's domain.

How much easier to attack IP vs analog via cable:

This is the precise question. Let me be exact:

Analog camera removed, coax cable exposed:

What attacker has access to:

• Raw analog video signal — they can watch the video feed
• 12V DC power wire — they can short it, cut it, or use it to try to damage power supply
• No network access whatsoever
• Cannot reach DVR command interface
• Cannot reach other cameras
• Cannot delete recordings
• Cannot modify DVR settings
• Cannot push malicious firmware to anything

Tools needed to do any of the above:

• Watch video: BNC connector and a monitor — trivial
• Short power: wire cutters — trivial
• Everything else: impossible regardless of tools

IP camera removed, ethernet cable exposed:

What attacker has access to:

• Full local network connection via PoE switch
• Can scan network and find all cameras and NVR IP addresses
• Can attempt to exploit camera firmware on any camera
• Can attempt to exploit NVR firmware
• Can attempt to delete recordings on NVR
• Can attempt to modify NVR settings
• Can attempt to push malicious firmware to cameras or NVR
• Can attempt to disable cameras remotely
• All of the above accessible from one cable

Tools needed:

• Laptop with PoE injector (~$20) and basic network tools
• Nmap for network scanning (free)
• Published CVE exploit tools (freely available for Hikvision/Dahua/Reolink)
• Knowledge level: intermediate — not expert

The difficulty comparison:

Attack	Analog coax	IP ethernet
Watch camera feed	Trivial	Trivial
Disable one camera	Cut cable	Remote command via network
Disable all cameras	Cut 8 cables individually	One command from one port
Access DVR/NVR	Impossible via coax	Possible via network
Delete recordings	Impossible via coax	Possible if NVR credentials known or exploitable
Modify settings	Impossible via coax	Possible via network
Push malicious firmware	Impossible via coax	Possible via published CVEs
Affect other cameras	Impossible via coax	Possible via shared network

Difficulty rating:

• Analog: attacking DVR via coax = essentially impossible
• IP: attacking NVR via ethernet = intermediate skill level, freely available tools

From what ive understood so far is that analog is the top security choice (due to the port from the cameras just physically not being able to accept any form of communication as it just acts as an analog sensor port) and ip is the convenience choice mainly but also adds protection against wiretapping. but that's it (as each camera being its own computer with exploitable firmware makes it an attack vulnerability to the whole system x however many cameras you have and however many different models you have each with separate different firmwares)

so using analog cameras to feed their own hdtvi splitters then from those splitters, feed separate systems (either an offline dvr for recording that cant be tampered with, or an online nvr connected to the analog cameras via analog to ip encoders, or preferably both via multiple offline dvrs hidden around your house for redundancy and safety purposes and the "decoy" that is actually connected to the internet for remote viewing which is preferably an nvr for better update support atm)

the alternative was an ip poe system that goes from offline poe cameras to a switch, then that switch feeds an offline nvr. the same switch also feeds a pi or something that can take the RTSP streams from the cameras and convert them to SRT, which then feeds a diy data diode (ethernet to fiber dual node converter but only plug in a single node cable for send and put a piece of tape over the receive side). then from the other side of that data diode a secondary online pi that takes from SRT streams for home assistant or whatever your preference for remote viewing and notifications as well as a backup redundant offsite cloud save
the downside being that if a camera is ripped off its mounting spot it can be used to manipulate your entire system including the offline "airgapped side"

both systems would have surge protectors/ground loop isolators/fiber adapters/individual line fuses to ensure the system cant just be easily fried all together from a single camera point with a taser or equivalent

anything im missing? or not considering? or literally anything?

EDIT:
apparently SRT wont work on a data diode?
found this instead
The most secure, protected option for streaming video over a DIY single-fiber data diode is MPEG-TS over UDP paired with Forward Error Correction (FEC) and Pre-Shared Key AES Encryption.

Because your single-fiber cable physically prevents a return path, standard two-way handshakes fail. This specific configuration provides robust security and stability:

1. The Core Streaming Protocol

• MPEG-TS over UDP: This is a pure "fire-and-forget" unidirectional protocol. The camera-side encoder blindly pushes video packets across the single fiber node without expecting or needing an acknowledgment (ACK) from the receiving node.

1. Error Correction (The "Protection" against Packet Loss)

• SMPTE ST 2022-1 FEC: Because the receiver cannot ask the encoder to retransmit a dropped packet, you must enable Forward Error Correction on the encoder. FEC appends mathematical redundancy data to the video stream. If a photon drops or a packet is corrupted across your DIY fiber link, the receiver uses this redundancy data to rebuild the missing video frames natively.

1. Stream Security (Data Confidentiality)

• Static AES-128/256 Encryption: Since dynamic key exchanges (like TLS/DTLS) require a bidirectional handshake, you must use static Pre-Shared Key (PSK) encryption. The video payload is encrypted at the encoder using a hardcoded key, pass-through across the one-way fiber link, and decrypted on the receiving node using the matching key.

Summary of the Setup Architecture

• Encoder Side (Transmitter): Configured to output a raw udp:// or rtp:// stream with FEC enabled and AES encryption turned on.
• Receiver Side (NVR/VMS): Configured with a matching listening port and the identical static AES key to decrypt and ingest the stream.

NVR vs DVR: Which Security Camera System is Better?

Any reason to pick IP over analog from a security perspective:

No. There is no security advantage of IP over analog for an offline recording system. Every security property that matters favors analog:

• No firmware to exploit ✓
• No command channel ✓
• No local network ✓
• No bidirectional communication ✓
• Physical access to cable gives nothing useful ✓

IP has zero security advantages over analog. IP has feature advantages (resolution, compression, SD cards, audio) but security is entirely analog's domain.

How much easier to attack IP vs analog via cable:

This is the precise question. Let me be exact:

Analog camera removed, coax cable exposed:

What attacker has access to:

• Raw analog video signal — they can watch the video feed
• 12V DC power wire — they can short it, cut it, or use it to try to damage power supply
• No network access whatsoever
• Cannot reach DVR command interface
• Cannot reach other cameras
• Cannot delete recordings
• Cannot modify DVR settings
• Cannot push malicious firmware to anything

Tools needed to do any of the above:

• Watch video: BNC connector and a monitor — trivial
• Short power: wire cutters — trivial
• Everything else: impossible regardless of tools

IP camera removed, ethernet cable exposed:

What attacker has access to:

• Full local network connection via PoE switch
• Can scan network and find all cameras and NVR IP addresses
• Can attempt to exploit camera firmware on any camera
• Can attempt to exploit NVR firmware
• Can attempt to delete recordings on NVR
• Can attempt to modify NVR settings
• Can attempt to push malicious firmware to cameras or NVR
• Can attempt to disable cameras remotely
• All of the above accessible from one cable

Tools needed:

• Laptop with PoE injector (~$20) and basic network tools
• Nmap for network scanning (free)
• Published CVE exploit tools (freely available for Hikvision/Dahua/Reolink)
• Knowledge level: intermediate — not expert

The difficulty comparison:

Attack	Analog coax	IP ethernet
Watch camera feed	Trivial	Trivial
Disable one camera	Cut cable	Remote command via network
Disable all cameras	Cut 8 cables individually	One command from one port
Access DVR/NVR	Impossible via coax	Possible via network
Delete recordings	Impossible via coax	Possible if NVR credentials known or exploitable
Modify settings	Impossible via coax	Possible via network
Push malicious firmware	Impossible via coax	Possible via published CVEs
Affect other cameras	Impossible via coax	Possible via shared network

Difficulty rating:

• Analog: attacking DVR via coax = essentially impossible
• IP: attacking NVR via ethernet = intermediate skill level, freely available tools

From what ive understood so far is that analog is the top security choice (due to the port from the cameras just physically not being able to accept any form of communication as it just acts as an analog sensor port) and ip is the convenience choice mainly but also adds protection against wiretapping. but that's it (as each camera being its own computer with exploitable firmware makes it an attack vulnerability to the whole system x however many cameras you have and however many different models you have each with separate different firmwares)

so using analog cameras to feed their own hdtvi splitters then from those splitters, feed separate systems (either an offline dvr for recording that cant be tampered with, or an online nvr connected to the analog cameras via analog to ip encoders, or preferably both via multiple offline dvrs hidden around your house for redundancy and safety purposes and the "decoy" that is actually connected to the internet for remote viewing which is preferably an nvr for better update support atm)

the alternative was an ip poe system that goes from offline poe cameras to a switch, then that switch feeds an offline nvr. the same switch also feeds a pi or something that can take the RTSP streams from the cameras and convert them to SRT, which then feeds a diy data diode (ethernet to fiber dual node converter but only plug in a single node cable for send and put a piece of tape over the receive side). then from the other side of that data diode a secondary online pi that takes from SRT streams for home assistant or whatever your preference for remote viewing and notifications as well as a backup redundant offsite cloud save
the downside being that if a camera is ripped off its mounting spot it can be used to manipulate your entire system including the offline "airgapped side"

both systems would have surge protectors/ground loop isolators/fiber adapters/individual line fuses to ensure the system cant just be easily fried all together from a single camera point with a taser or equivalent

anything im missing? or not considering? or literally anything?

EDIT:
apparently SRT wont work on a data diode?
found this instead
The most secure, protected option for streaming video over a DIY single-fiber data diode is MPEG-TS over UDP paired with Forward Error Correction (FEC) and Pre-Shared Key AES Encryption.

Because your single-fiber cable physically prevents a return path, standard two-way handshakes fail. This specific configuration provides robust security and stability:

1. The Core Streaming Protocol

• MPEG-TS over UDP: This is a pure "fire-and-forget" unidirectional protocol. The camera-side encoder blindly pushes video packets across the single fiber node without expecting or needing an acknowledgment (ACK) from the receiving node.

2. Error Correction (The "Protection" against Packet Loss)

• SMPTE ST 2022-1 FEC: Because the receiver cannot ask the encoder to retransmit a dropped packet, you must enable Forward Error Correction on the encoder. FEC appends mathematical redundancy data to the video stream. If a photon drops or a packet is corrupted across your DIY fiber link, the receiver uses this redundancy data to rebuild the missing video frames natively.

3. Stream Security (Data Confidentiality)

• Static AES-128/256 Encryption: Since dynamic key exchanges (like TLS/DTLS) require a bidirectional handshake, you must use static Pre-Shared Key (PSK) encryption. The video payload is encrypted at the encoder using a hardcoded key, pass-through across the one-way fiber link, and decrypted on the receiving node using the matching key.

Summary of the Setup Architecture

• Encoder Side (Transmitter): Configured to output a raw udp:// or rtp:// stream with FEC enabled and AES encryption turned on.
• Receiver Side (NVR/VMS): Configured with a matching listening port and the identical static AES key to decrypt and ingest the stream.

NVR vs DVR: Which Security Camera System is Better?

Any reason to pick IP over analog from a security perspective:

No. There is no security advantage of IP over analog for an offline recording system. Every security property that matters favors analog:

• No firmware to exploit ✓
• No command channel ✓
• No local network ✓
• No bidirectional communication ✓
• Physical access to cable gives nothing useful ✓

IP has zero security advantages over analog. IP has feature advantages (resolution, compression, SD cards, audio) but security is entirely analog's domain.

How much easier to attack IP vs analog via cable:

This is the precise question. Let me be exact:

Analog camera removed, coax cable exposed:

What attacker has access to:

• Raw analog video signal — they can watch the video feed
• 12V DC power wire — they can short it, cut it, or use it to try to damage power supply
• No network access whatsoever
• Cannot reach DVR command interface
• Cannot reach other cameras
• Cannot delete recordings
• Cannot modify DVR settings
• Cannot push malicious firmware to anything

Tools needed to do any of the above:

• Watch video: BNC connector and a monitor — trivial
• Short power: wire cutters — trivial
• Everything else: impossible regardless of tools

IP camera removed, ethernet cable exposed:

What attacker has access to:

• Full local network connection via PoE switch
• Can scan network and find all cameras and NVR IP addresses
• Can attempt to exploit camera firmware on any camera
• Can attempt to exploit NVR firmware
• Can attempt to delete recordings on NVR
• Can attempt to modify NVR settings
• Can attempt to push malicious firmware to cameras or NVR
• Can attempt to disable cameras remotely
• All of the above accessible from one cable

Tools needed:

• Laptop with PoE injector (~$20) and basic network tools
• Nmap for network scanning (free)
• Published CVE exploit tools (freely available for Hikvision/Dahua/Reolink)
• Knowledge level: intermediate — not expert

The difficulty comparison:

Attack	Analog coax	IP ethernet
Watch camera feed	Trivial	Trivial
Disable one camera	Cut cable	Remote command via network
Disable all cameras	Cut 8 cables individually	One command from one port
Access DVR/NVR	Impossible via coax	Possible via network
Delete recordings	Impossible via coax	Possible if NVR credentials known or exploitable
Modify settings	Impossible via coax	Possible via network
Push malicious firmware	Impossible via coax	Possible via published CVEs
Affect other cameras	Impossible via coax	Possible via shared network

Difficulty rating:

• Analog: attacking DVR via coax = essentially impossible
• IP: attacking NVR via ethernet = intermediate skill level, freely available tools

From what ive understood so far is that analog is the top security choice (due to the port from the cameras just physically not being able to accept any form of communication as it just acts as an analog sensor port) and ip is the convenience choice mainly but also adds protection against wiretapping. but that's it (as each camera being its own computer with exploitable firmware makes it an attack vulnerability to the whole system x however many cameras you have and however many different models you have each with separate different firmwares)

so using analog cameras to feed their own hdtvi splitters then from those splitters, feed separate systems (either an offline dvr for recording that cant be tampered with, or an online nvr connected to the analog cameras via analog to ip encoders, or preferably both via multiple offline dvrs hidden around your house for redundancy and safety purposes and the "decoy" that is actually connected to the internet for remote viewing which is preferably an nvr for better update support atm)

the alternative was an ip poe system that goes from offline poe cameras to a switch, then that switch feeds an offline nvr. the same switch also feeds a pi or something that can take the RTSP streams from the cameras and convert them to SRT, which then feeds a diy data diode (ethernet to fiber dual node converter but only plug in a single node cable for send and put a piece of tape over the receive side). then from the other side of that data diode a secondary online pi that takes from SRT streams for home assistant or whatever your preference for remote viewing and notifications as well as a backup redundant offsite cloud save
the downside being that if a camera is ripped off its mounting spot it can be used to manipulate your entire system including the offline "airgapped side"

both systems would have surge protectors/ground loop isolators/fiber adapters/individual line fuses to ensure the system cant just be easily fried all together from a single camera point with a taser or equivalent

anything im missing? or not considering? or literally anything?

EDIT:
apparently SRT wont work on a data diode?
found this instead
The most secure, protected option for streaming video over a DIY single-fiber data diode is MPEG-TS over UDP paired with Forward Error Correction (FEC) and Pre-Shared Key AES Encryption.

Because your single-fiber cable physically prevents a return path, standard two-way handshakes fail. This specific configuration provides robust security and stability:

1. The Core Streaming Protocol

• MPEG-TS over UDP: This is a pure "fire-and-forget" unidirectional protocol. The camera-side encoder blindly pushes video packets across the single fiber node without expecting or needing an acknowledgment (ACK) from the receiving node.

2. Error Correction (The "Protection" against Packet Loss)

• SMPTE ST 2022-1 FEC: Because the receiver cannot ask the encoder to retransmit a dropped packet, you must enable Forward Error Correction on the encoder. FEC appends mathematical redundancy data to the video stream. If a photon drops or a packet is corrupted across your DIY fiber link, the receiver uses this redundancy data to rebuild the missing video frames natively.

3. Stream Security (Data Confidentiality)

• Static AES-128/256 Encryption: Since dynamic key exchanges (like TLS/DTLS) require a bidirectional handshake, you must use static Pre-Shared Key (PSK) encryption. The video payload is encrypted at the encoder using a hardcoded key, pass-through across the one-way fiber link, and decrypted on the receiving node using the matching key.

Summary of the Setup Architecture

• Encoder Side (Transmitter): Configured to output a raw udp:// or rtp:// stream with FEC enabled and AES encryption turned on.
• Receiver Side (NVR/VMS): Configured with a matching listening port and the identical static AES key to decrypt and ingest the stream.

has anyone experimented with the new solar charger for the outdoor cameras, but by sandwiching a battery expansion pack between the camera and the charger to get an extended runtime for all seasons?

Or even just sandwiching a few expansion packs together and swapping 8 batteries every so often instead

Learned the hard way that NiMH Rechargeable Batteries won't work cause they are limited to 1.2v (think they only exist as an old standard as l've started checking everything since then and realized everything says 1.5v for the most part now minus some older remotes and while the 1.2 will work on some devices, it has a shorter run time vs 1.5 but that could also be the battery chemistry and how and when the voltage drops or tapers).

But found some Rechargeable Lithium Batteries that are 1.5v by
EBL on Amazon that say they are for blink cameras

Anyone have any experience?

Also, side note, has anyone experimented with the new solar charger for the outdoor cameras, but by sandwiching a battery expansion back on between the camera and the charger to get an extended runtime for all seasons?

Or even just sandwiching a few expansion packs together and swapping 8 batteries every so often instead