# Weird traffic coming out of my camera traffic

**URL:** <https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793>\
**Category:** Cameras\
**Tags:** android\
**Created:** [November 30, 2019, 2:51pm UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793 "2019-11-30T14:51:22Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![fidelito17](https://avatars.discourse-cdn.com/v4/letter/f/e56c9b/32.png) [@fidelito17](https://forums.wyze.com/u/fidelito17)\
**Post date:** [November 30, 2019, 2:51pm UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/1 "2019-11-30T14:51:22Z")

</div>

Hi,

I been analyzing the two cameras I have and they are going to this  
[maigreatjob.com:10001](http://maigreatjob.com:10001)  
[code.weekendpartycancel5.com:10001](http://code.weekendpartycancel5.com:10001)

Does anyone know why it needs to go there? Thats the main weird traffic that I see but there is others.

I was hoping this cameras when I bought them would be more secure than the others. Looks like all the cameras will need to be on an isolated network with no outbound traffic.

---

<div class="post-metadata">

**Author:** ![fidelito17](https://avatars.discourse-cdn.com/v4/letter/f/e56c9b/32.png) [@fidelito17](https://forums.wyze.com/u/fidelito17)\
**Post date:** [November 30, 2019, 3:09pm UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/2 "2019-11-30T15:09:31Z")

</div>

Don’t get me wrong, but I do love the product and bought two more cameras. They are very good cameras but seeing what the traffic is doing got me concern.

---

<div class="post-metadata">

**Author:** ![nerdland](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/nerdland/32/11816_2.png) [@nerdland](https://forums.wyze.com/u/nerdland)\
**Post date:** [December 1, 2019, 7:02am UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/3 "2019-12-01T07:02:37Z")

</div>

Very weird. I’ve never seen any reports of that.

---

<div class="post-metadata">

**Author:** ![Newshound](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/newshound/32/71715_2.png) [@Newshound](https://forums.wyze.com/u/Newshound)\
**Post date:** [December 1, 2019, 7:07am UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/4 "2019-12-01T07:07:36Z")

</div>

Can you show us what is indicating this to you?

---

<div class="post-metadata">

**Author:** ![xhozt](https://avatars.discourse-cdn.com/v4/letter/x/e68b1a/32.png) [@xhozt](https://forums.wyze.com/u/xhozt)\
**Post date:** [December 1, 2019, 8:39am UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/5 "2019-12-01T08:39:14Z")

</div>

Got a Wireshark log ? 🙂

---

<div class="post-metadata">

**Author:** ![GuitarMan](https://avatars.discourse-cdn.com/v4/letter/g/d9b06d/32.png) [@GuitarMan](https://forums.wyze.com/u/GuitarMan)\
**Post date:** [December 1, 2019, 2:53pm UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/6 "2019-12-01T14:53:57Z")

</div>

What are you using to see the traffic?

---

<div class="post-metadata">

**Author:** ![tomp](https://sea2.discourse-cdn.com/wyze/user_avatar/forums.wyze.com/tomp/32/4837_2.png) [@tomp](https://forums.wyze.com/u/tomp)\
**Post date:** [December 1, 2019, 3:22pm UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/7 "2019-12-01T15:22:45Z")

</div>

When I (probably not so wisely) access these sites neither loads or responds.

---

<div class="post-metadata">

**Author:** ![wayneluke](https://avatars.discourse-cdn.com/v4/letter/w/50afbb/32.png) [@wayneluke](https://forums.wyze.com/u/wayneluke)\
**Post date:** [December 1, 2019, 4:37pm UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/8 "2019-12-01T16:37:52Z")

</div>

According to the required ports list. Port 10001 is needed for P2P streaming of live cameras. This would be connecting to other temporary servers on the peer to peer network. Since these networks are as hoc, you never really know where the connection is going to go.

> **[What ports are necessary for Wyze Cams to operate?](https://support.wyze.com/hc/en-us/articles/360031479511-What-ports-are-necessary-for-Wyze-Cams-to-operate-)**
>
> In most cases, home users will not need to manually change ports. If you are on a business/enterprise network your IT department can manually open the ports needed.
> Here is a list of the necessary ...

If you’re really worried, you can block the port at the router level. You will not be able to live stream the cameras from outside your network.

---

<div class="post-metadata">

**Author:** ![fidelito17](https://avatars.discourse-cdn.com/v4/letter/f/e56c9b/32.png) [@fidelito17](https://forums.wyze.com/u/fidelito17)\
**Post date:** [December 2, 2019, 1:23am UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/9 "2019-12-02T01:23:18Z")

</div>

Hi,

I was seeing the traffic on the router and I am going to isolate it by putting the camera on its on isolated network.

---

<div class="post-metadata">

**Author:** ![esvanoe](https://avatars.discourse-cdn.com/v4/letter/e/439d5e/32.png) [@esvanoe](https://forums.wyze.com/u/esvanoe)\
**Post date:** [December 3, 2019, 2:17am UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/10 "2019-12-03T02:17:45Z")

</div>

In the lists of ports though it states it needs to be TCP/10001 and is for “local live streaming”

This is the camera initiating a connection to 3 different remote servers of unknown ownership streaming my video out on UDP. Also, definitely not local. That doesn’t match up to the port chart Wyze has mapped out.

I have broken access to the outbound connection and it breaks the apps streaming. I need to do a pcap here tomorrow and see how the video is going out, but hopefully not unencrypted UDP video stream through a random server.

---

<div class="post-metadata">

**Author:** ![esvanoe](https://avatars.discourse-cdn.com/v4/letter/e/439d5e/32.png) [@esvanoe](https://forums.wyze.com/u/esvanoe)\
**Post date:** [December 3, 2019, 2:31am UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/11 "2019-12-03T02:31:04Z")

</div>

Interestingly after a couple minutes all my cams came back online, and seemed to start communicating on UDP port 10240 to random IP addresses now, with the bulk of my video stream going out to a remote server on TCP 21047 it looks like, at least thats the biggest amount of data on any given socket…

These cameras work well, but man the networking backend is a tad funky and concerning.

---

<div class="post-metadata">

**Author:** ![esvanoe](https://avatars.discourse-cdn.com/v4/letter/e/439d5e/32.png) [@esvanoe](https://forums.wyze.com/u/esvanoe)\
**Post date:** [December 3, 2019, 2:32am UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/12 "2019-12-03T02:32:57Z")

</div>

![57 PM](https://us1.discourse-cdn.com/wyze/original/2X/9/91d569777882b3b125917af6162d68a167793e17.png)

---

<div class="post-metadata">

**Author:** ![wayneluke](https://avatars.discourse-cdn.com/v4/letter/w/50afbb/32.png) [@wayneluke](https://forums.wyze.com/u/wayneluke)\
**Post date:** [December 3, 2019, 4:23am UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/13 "2019-12-03T04:23:32Z")

</div>

> [@esvanoe](#):
>
> In the lists of ports though it states it needs to be TCP/10001 and is for “local live streaming”

It actually says:

TCP: 10001 | P2P streaming connection | Local live streaming over WiFi

There are three columns. P2P connections are done through a third-party that Wyze contracts with.

---

<div class="post-metadata">

**Author:** ![esvanoe](https://avatars.discourse-cdn.com/v4/letter/e/439d5e/32.png) [@esvanoe](https://forums.wyze.com/u/esvanoe)\
**Post date:** [December 3, 2019, 10:55pm UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/14 "2019-12-03T22:55:24Z")

</div>

Even if that is so, the chart is inaccurate. It lists the port as TCP, not UDP. It doesn’t say anything about a failover port either.

I am aware there are three columns, but it states that “what it does” is p2p and “what it’s used for” is local live streaming over wifi. If it’s local live streaming over wifi, why is it sending udp streams remotely to the internet?

---

<div class="post-metadata">

**Author:** ![wayneluke](https://avatars.discourse-cdn.com/v4/letter/w/50afbb/32.png) [@wayneluke](https://forums.wyze.com/u/wayneluke)\
**Post date:** [December 3, 2019, 10:57pm UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/15 "2019-12-03T22:57:47Z")

</div>

The documentation in general is short on technical details.

Personally, if I had a problem with the traffic, I would block the outgoing port at my router. See what breaks and if I can live without it. I doubt that Wyze is going to get very technical on this with a consumer camera. It would be over the head of most people.

---

<div class="post-metadata">

**Author:** ![WyzeTao](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@WyzeTao](https://forums.wyze.com/u/WyzeTao)\
**Post date:** [January 3, 2020, 8:44pm UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/16 "2020-01-03T20:44:41Z")

</div>

I am not aware of any known connection between Wyze and [maigreatjob.com](http://maigreatjob.com) or [weekendpartycancel5.com](http://weekendpartycancel5.com). The port 10001 is used by TUTK camera SDK to communicate to TUTK servers. If you keep seeing the problem, can you share out the server IP which resolved to migreatjob and weekendpartycancel5? I wonder if it was because of tools accidentally resolving IP address to a DNS. I know their server IPs could change due to multiple reasons.

Once I get the IP I can check and confirm with TUTK.

---

<div class="post-metadata">

**Author:** ![esvanoe](https://avatars.discourse-cdn.com/v4/letter/e/439d5e/32.png) [@esvanoe](https://forums.wyze.com/u/esvanoe)\
**Post date:** [January 3, 2020, 9:04pm UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/17 "2020-01-03T21:04:59Z")

</div>

I tried this, and the cameras started communicating on a failover UDP port (10240) instead of 10001 as indicated in my firewall logs I posted here a few weeks ago.

---

<div class="post-metadata">

**Author:** ![moog09](https://avatars.discourse-cdn.com/v4/letter/m/b9e5f3/32.png) [@moog09](https://forums.wyze.com/u/moog09)\
**Post date:** [January 28, 2020, 2:21am UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/18 "2020-01-28T02:21:17Z")

</div>

Found the same connection to maigreatjob from my cam pan today 🤔  
I’m unable to ping it or resolve its IP, but according to [https://inspector.cs.princeton.edu/share/9ed03725991a0703](https://inspector.cs.princeton.edu/share/9ed03725991a0703)  
[maigreatjob.com](http://maigreatjob.com) IP is 208.115.109.242 , located in the US

---

<div class="post-metadata">

**Author:** ![WyzeTao](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@WyzeTao](https://forums.wyze.com/u/WyzeTao)\
**Post date:** [January 28, 2020, 2:47am UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/19 "2020-01-28T02:47:55Z")

</div>

Hi, this is confirmed to be one P2P server that is provided by ThroughTek (TUTK) for Wyze camera connections. I guess the IP was likely previously used by [maigreatjob.com](http://maigreatjob.com). Let me contact ThroughTek to see if they can change the IP. They are in Lunar New Year break for now. I will follow up once they get back next week. I can confirm it is a known server IP. Thanks!

---

<div class="post-metadata">

**Author:** ![WyzeTao](https://avatars.discourse-cdn.com/v4/letter/w/90db22/32.png) [@WyzeTao](https://forums.wyze.com/u/WyzeTao)\
**Post date:** [February 13, 2020, 8:16am UTC](https://forums.wyze.com/t/weird-traffic-coming-out-of-my-camera-traffic/73793/20 "2020-02-13T08:16:36Z")

</div>

An update on IP 208.115.109.242. First it is confirmed to be a TUTK server. Secondly, we worked with TUTK and their data center to remove the false association of [maigreatjob.com](http://maigreatjob.com). I checked on [Reverse DNS Lookup - WhatIsMyIP.com®](https://www.whatismyip.com/reverse-dns-lookup/) and [IP Location Lookup - Instantly Locate an IP Location](https://dnschecker.org/ip-location.php). Both of them don’t show [maigreatjob.com](http://maigreatjob.com). Thanks!
