It uses an UDP multicast, the VPN network can be configured to allow it and it will work. Regardless of what previous comments wrote. I managed to do it via zerotier.
Not all VPN tunnels allow it, you need to have access to VPN configurations.
It sends UDP packet
0x3c, 0x3f, 0x78, 0x6d, 0x20, 0x76, 0x65,
0x72, 0x73, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x31,
0x2e, 0x30, 0x22, 0x20, 0x65, 0x6e, 0x63, 0x6f,
0x64, 0x69, 0x6e, 0x67, 0x3d, 0x22, 0x75, 0x74,
0x66, 0x2d, 0x38, 0x22, 0x3f, 0x3e, 0x3c, 0x50,
0x72, 0x6f, 0x62, 0x65, 0x3e, 0x3c, 0x55, 0x75,
0x69, 0x64, 0x3e, 0x37, 0x34, 0x46, 0x31, 0x45,
0x44, 0x33, 0x37, 0x2d, 0x35, 0x45, 0x38, 0x32,
0x2d, 0x34, 0x33, 0x45, 0x38, 0x2d, 0x39, 0x41,
0x36, 0x31, 0x2d, 0x36, 0x36, 0x46, 0x43, 0x44,
0x33, 0x32, 0x39, 0x32, 0x36, 0x45, 0x32, 0x3c,
0x2f, 0x55, 0x75, 0x69, 0x64, 0x3e, 0x3c, 0x54,
0x79, 0x70, 0x65, 0x73, 0x3e, 0x69, 0x6e, 0x71,
0x75, 0x69, 0x72, 0x79, 0x3c, 0x2f, 0x54, 0x79,
0x70, 0x65, 0x73, 0x3e, 0x3c, 0x2f, 0x50, 0x72,
0x6f, 0x62, 0x65, 0x3e
to
239.255.255.250 on port 37020
response by cameras are on dynamic port.
Even if you dont manage the Discovery which is what i wrote above, you can do a multithreaded /capabilities ISAPI hit on range of addresses, the responses turn on the list and use SADP SDK do to the rest of the stuff SADP can do via port 8000 look at the attachment bellow
