Teamviewer listening on port 80 and 5938 by default, why

remote desktop

So I had port 5938 exposed to the world accidently. No foul.
No one seemed to be able to establish a session it according to the teamviewer logs.
But netstat show some random (non teamviewer) IP connecting directly to 5938 .

I blocked incoming 80 and 5938 . I am still able to connect to that system. Incoming and Outgoing teamviewer connections still work.

What is the point of having 80 and 5938 open by default for Teamviewer?
also, why would I be seeing random IP's with established connections on port 5938 ?
does teamviewer use some sort of p2p networking?

Best Answer

First off... Teamviewer can be a major pain! Especially inside a corporate environment. As we found out, Teamviewer is constantly making connections back to their servers. If you trace the IP's you found, you will more then likely find that they are owned by Teamviewer and originate in Germany.

If you completely cut your machine off from the Internet, you will see that your Teamviewer will never get a 9 digit ID. It will either error out, or if you have "Incoming LAN connections" set to "accept" it will show your computers IP address.

The Teamviewer software requires a connection back to their servers in order to generate that 9 digit ID.

These are some of the observations I have made anyway since using this software.