It detects ports and the protocol first, then it tries various stream addresses from our list
For each brand there is a address (or more addresses) for MJPEG, RTSP and each brand has a priority rating which can be used to alter the sequence of addresses.
Once we get a valid response like 401 unauthorized or 200 OK, the detection stops and we either ask for a login or show the stream.
Known issues
Problem is that some cameras will respond with 200 or 401 to every request except for the valid one which is the main thing causing the detection to fail for some brands.
Many “noname” chinese brands are using /onvif1 and fail to get detected or also there are issues with cameras which have username and password as a parameter in the path instead of the usual un:pw@host