Both matter the moment a site has more than one brand of camera, or when new software has to work with cameras you already own. Both also create security responsibilities that are easy to overlook.
What RTSP does
RTSP stands for Real Time Streaming Protocol. It is a way for a camera to offer a live video stream at a network address, and for a client such as a recorder, a viewer or analytics software to connect and watch it. The client sends commands like play and stop, and the camera sends back the video.
In practice, an RTSP address looks like a web address with a path that identifies a particular stream. Most cameras expose more than one stream, often a high-resolution main stream for recording and a lighter sub-stream for live viewing on weak connections. The exact address format varies by manufacturer, which is one reason RTSP alone can be fiddly when you mix brands.
RTSP does one job. It does not describe what the camera can do, tell software how to move a PTZ lens, or report that motion was detected.
What ONVIF does
ONVIF is an industry standard for how network video products talk to each other. It is not a video format. It defines a common way to:
- Discover cameras on a network without typing addresses by hand.
- Read capabilities, such as available streams, resolutions and whether the camera has PTZ or audio.
- Configure basic settings from compatible software.
- Control pan, tilt and zoom through a common command set.
- Receive events, such as motion or tampering, in a standard form.
When ONVIF software asks a camera for its video, the camera typically hands back an RTSP address. The two work together. ONVIF is the conversation about what the camera is and what it can do. RTSP is the pipe the video travels through.
ONVIF vs RTSP at a glance
| RTSP | ONVIF | |
|---|---|---|
| What it is | A streaming protocol | An interoperability standard |
| Main job | Deliver live video | Discovery, configuration, control, events |
| Carries video | Yes | Usually by pointing to an RTSP stream |
| PTZ control | No | Yes, through a common command set |
| Event data | No | Yes, in a standard form |
| Setup effort | Manual address per camera | Often automatic discovery |
| Typical risk | Unencrypted streams, weak credentials | Exposed services, inconsistent implementation |
Why profiles matter
ONVIF is organized into profiles. Each profile groups a set of features, for example streaming, access control, or analytics metadata. A camera can support one profile and not another, and a recorder can do the same.
This is where buyers get caught. A spec sheet that says "ONVIF compliant" tells you very little by itself. What matters is which profile, and whether the features you rely on, such as PTZ presets or event notifications, work in the exact combination of camera and software you plan to run. Makers also implement the same profile with different levels of completeness, so two compliant products can still disagree on details.
Treat ONVIF as a strong starting point rather than a guarantee. Ask for the supported profiles in writing, and test one camera with your software before ordering many.
Mixing cameras and software
The practical value of these standards shows up in a few common situations:
- Adding new software to existing cameras. If the cameras support ONVIF, the software can usually discover them and pull streams without replacing hardware.
- Replacing a failed camera with a different model. A standards-based system lets you swap in another brand without rebuilding the whole setup.
- Feeding video to analytics or a monitoring center. Analytics tools generally need a stable stream, and a monitoring operation needs reliable PTZ control and events to respond quickly.
- Avoiding lock-in. Open standards give you more choice later, though they do not remove it entirely, because some advanced features stay proprietary.
Where a camera supports only a proprietary interface, you may still reach it through its own tools. Expect more integration work and a higher chance that some features will not carry over. Storage choices interact with this too, and our guide to cloud vs local video storage covers where the video ends up after it leaves the camera.
Security considerations
Open standards make cameras easier to connect, and that includes connecting the wrong people. The security risks are mostly about configuration.
- Change default credentials. Default usernames and passwords on cameras are widely known. Set strong, unique passwords on every device.
- Do not expose cameras directly to the internet. Opening a port to a camera's streaming or management service invites automated scanning. Use a firewall, and use a VPN or a managed gateway for remote access.
- Encrypt where you can. A basic RTSP stream may travel unencrypted on the local network. Enable encrypted options if the camera and software support them, and keep cameras on a separate network segment from business systems.
- Turn off services you do not use. Disable discovery, remote access features and old protocols that are not needed after setup.
- Keep firmware current. Camera makers publish fixes for known weaknesses, and an unpatched camera is an easy target.
- Limit accounts. Give integrations their own limited accounts rather than sharing the administrator login.
Our broader guide to security camera cybersecurity goes deeper on network design, account hygiene and firmware. Hardware origin is a separate question, covered in our NDAA-compliant security cameras buyer's guide.
A short checklist before you integrate
- List every camera model and the profiles it supports.
- Confirm the software supports the same profiles and the features you need.
- Test discovery, live video, PTZ and event delivery on one camera.
- Confirm which stream the software pulls, main or sub, and the bandwidth it needs.
- Document the credentials and network path for each device.
- Decide in advance who patches firmware and how often.
How VDS fits
VDS builds its own mobile surveillance units, which come as a complete package: a 5MP PTZ with 25x optical zoom plus three 8MP wide-angle cameras, AI detection for people, vehicles, loitering, objects and license plates, and a 24/7 US-based security operations center. The hardware is NDAA Section 889 compliant, and you can read more on our cybersecurity page. If you run existing cameras and want to understand how they could fit alongside a monitored deployment, talk to our team and bring your equipment list.