This method is typically sent as an initial capability check by scanners or reconnaissance tooling to discover supported methods and confirm the presence of a live RTSP endpoint before attempting further interaction. Often associated with discovery-stage behavior rather than direct exploitation, but repeated or automated usage may indicate pre-attack reconnaissance against cameras, NVRs, or media streaming services.