If you look after more than a handful of IP cameras you’ve probably had this one come in. The client says the recordings are fine, the camera is a decent 4MP unit, but the picture attached to the motion alert email is a smudgy little thing where you honestly can’t tell a person from a coat on a hook. In my experience it’s almost never a broken camera. The snapshot came from the substream, or the bitrate is starved, or the keyframe timing is unlucky. If the image already exists and you can’t recapture it, a blur remover will claw back some legibility, but the proper fix is figuring out which stream your recorder or app is pulling the still from in the first place.
Table of Contents
Think of the main stream as the “real” video. It’s encoded at the full resolution you picked, so 1080p, or 2560×1440 on a typical 4MP camera, or 3840×2160 on the 8MP ones, normally in H.264 or H.265 at a few megabits per second. That’s what the NVR writes to disk, and it’s what you’ll be glad you have when somebody asks for a readable face or plate three weeks later.
All the details live here. The price is bandwidth, storage, and decode load, because showing a whole wall of main streams at once will keep a recorder’s CPU or GPU pretty busy. That load is the only reason cameras bother with a second stream at all.
The substream is the camera running a second, much smaller encode in parallel. You’ll usually see something like 640×360, 640×480 or 704×480 (D1), at a few hundred kbps. Multi-view grids on the NVR use it, phone apps on mobile data use it, and plenty of motion detection engines run on it too, since decoding sixteen 4MP streams just to draw a 4×4 grid would be a waste.
Small is the whole point of it. Which is great right up until someone grabs a still from it, because a 640×360 frame blown up to fill a laptop screen is going to look soft, it doesn’t matter how nice the lens is.
I check the substream first, every single time. A lot of NVR and VMS software (Blue Iris is the one people complain about most on the forums) runs motion detection on the substream to keep CPU down, and depending on the settings the alert image gets taken from that same tiny stream. Phone apps do it too when you hit the snapshot button during live view.
When the substream isn’t the culprit, it’s usually one of these. A 4MP main stream crammed into 1 Mbps CBR, which looks okay on a static scene and falls apart the moment anyone walks through. A long I-frame interval, where a frame grabbed just before the next keyframe carries smeary compression leftovers, and the H.265 “smart codec” modes make this worse because they stretch the interval on quiet scenes. Night shutter speed is another one, the camera slows the shutter to collect light and a person walking by turns into a streak, which is motion blur and has nothing to do with streams. And then there’s IR focus shift, where a varifocal lens focused during the day goes slightly soft once the IR-cut filter flips at night.
First stop is the snapshot source. Dig through the NVR or VMS settings for wherever alert images or snapshots are configured and switch them to the main stream if the option is there. Pulling stills yourself over HTTP or ONVIF? Then double-check you’re hitting the main channel and not channel 2. On Hikvision for instance the ISAPI picture call on 101 hands you a main stream still and 102 gives you the substream one.
Next, let the main stream breathe. For 4MP in H.265 I’d start around 3–4 Mbps VBR, roughly double that for H.264, and adjust for how busy the scene actually is. Setting the I-frame interval equal to the frame rate, so one keyframe a second, also makes random grabs look a lot cleaner.
Nights need their own tweak. Cap the max shutter at 1/30 s or faster for doors and walkways and live with a bit more grain, it’s a far better trade than ghost people. If the day picture is sharp and the IR picture isn’t, refocus the varifocal at night.
One small warning. If you decide to raise the substream resolution for better motion detection, watch the recorder’s CPU for a few days afterwards, since keeping things light was the whole reason for the substream.
Sometimes the incident is over and that blurry alert image is all there is. A deblurring tool can firm up edges and get some readability back from soft or slightly smeared frames, often enough to make out a jacket color or what kind of car it was.
Be realistic about it though. No software can pull out detail the substream never stored, so a face that’s 12 pixels wide is staying unidentifiable, and a sharpened number plate might show characters that look crisp and still aren’t trustworthy. When it matters, go to the main stream recording for that exact timestamp, and that’s the best argument I know for recording the main stream around the clock.
Blurry snapshots from IP cameras are rarely a hardware fault. Most of the time the alert or app is grabbing the substream, and low bitrate, long keyframe intervals and slow night shutters pile on top. Point your snapshots at the main stream, give it bitrate, sort out night settings, and keep a deblurring tool around for the odd image you can’t take again.
Want to discover more useful information? Browse our blog for additional guides, tips, and insights designed to help you learn something new and make more informed decisions.
Unlock freebies for your creative projects. Explore a curated selection of fonts, graphics, and more - all absolutely free. Don't miss out, claim yours now!
Claim Free Freebies
