TCP 5938
Synopsis
- TCP port 5938 is officially assigned to TeamViewer remote control.
- TeamViewer (including TeamViewer Host, QuickSupport, and Tensor) primarily uses outbound TCP 5938 to connect to TeamViewer’s routing/relay servers (e.g., *.teamviewer.com) for remote access and screen sharing; if blocked, it can fall back to 443 or 80.
- Many enterprise firewall configurations explicitly allow outbound TCP 5938 to enable TeamViewer connectivity; the client may also use UDP 5938 for performance.
- Real-world example: an employee running TeamViewer QuickSupport on Windows or macOS will establish an outbound TCP 5938 session to TeamViewer’s cloud to let a helpdesk technician connect.
- Security note: Threat actors have abused legitimate TeamViewer to maintain unauthorized remote access (e.g., the TeamSpy campaign), so unexpected outbound traffic to TCP 5938 can be an indicator of misuse.
Observed activity
Last 30 days
Detailed chart