Trace Verkada local streaming through the camera private address

Trace the approved client-to-camera network path before widening rules to fix a cloud-only viewing session.

Source facts

Verkada local streaming sends the camera feed directly to the viewing device instead of proxying it through the cloud. The client must reach the camera’s private address, and the documentation requires bidirectional TCP/UDP port 4100 connectivity without an intervening proxy. Command uses a camera-specific DNS name that resolves to the camera’s private IPv4 address. If the client cannot establish that local connection, viewing may remain remote. H.265 client support can also distinguish available standard- and high-quality local streams.

Source: Verkada Help — Local Streaming on Verkada Cameras.

Applicability

Applies to Verkada Command local streaming, including routed client networks with approved camera reachability. This is a streaming-path diagnosis, not permission to open a camera VLAN to all endpoints.

DSE recommendation

DSE recommends tracing one authorized viewer-to-camera path before widening firewall rules. Record the resolved private address, client network, relevant rule, and whether a proxy is present. Use the camera’s actual Command metadata when checking address consistency. If local viewing is an operational requirement, approve a specific viewer group and network path; keep cloud viewing behavior separate in the acceptance record. Evaluate codec support only after basic reachability is established.

Verification

Open a test camera from the intended workstation and inspect the local/remote streaming indicator. Compare DNS resolution and connection attempts with the camera’s private address. Repeat from an authorized routed network and a remote connection so the team can recognize a path change without assuming the camera failed.

Official reference

Verkada Help — Local Streaming on Verkada Cameras. Reviewed October 15, 2026.