Thanks for sharing. I spent many hours trying to figure this out when the HFW3200S came on scene and gave up. Just checked back--first time in several months--and your URL did the trick. 
  
http://IP:9989/onvif/media_service/snapshot?channel=1&subtype=0 
  
Older HDB3200C continue to work with: 
http://IP/onvif/media_service/snapshot 
  
  
Thanks again.