After some hours of network tracing. I found out how the Webcam works:
It has multiple TCP Ports open:
Port 80 = Web Interface. All commands to control the webcam (pan&tilt…) are http requests.It also handles the authentication
Port 5000 = Stream initialization.
Port 5001 = Streaming Port, sends the video packets
Port 500 = documented as ipview port. But ipview pro does not connect to this port !
dynamic Port = UPnp Mediaserver port
The following sequence is used to start the video streaming:
1) connect to port 80 and authenticate (http authentication)
2) connect to port 5000, send a init sequence and disconnect
3) connect to port 5001, send a start sequence and receive the video stream (with a cellvision header in each packet)