I have a Wyze Cam V2 with firmware version 4.9.4.28. My network security configuration allows for GeoIP blocking, and as such, I do not allow access to and from my network to specific countries. I have noticed, however, that my Wyze Cam is constantly and consistently attempting connections to 39.97.173.52 (appears to be a Chinese address) over UDP 10001. I only noticed this due to my GeoIP blocking, so I have not had a chance to capture the network traffic long enough to determine what other connections, both successfully or unsuccessfully, are occurring. Even before I go that route, can someone validate that this traffic is “normal”, and even so, is there anything that can be done to eliminate the traffic from attempting overseas connections?
After doing a packet capture from my gateway, I noticed that the camera attempts UDP 10001 connections to the following IPs:
198.16.72.106
39.97.173.52
216.244.86.74
103.16.26.75
My security configuration was only keying in on 39.97.173.52, as it is in China.
I will tag some devs on your post so they can address your concerns.
We limit all the streaming traffic within North America servers except for camera registration, which we intend to fix it in the next release. Do you remember what you were using in the app that could cause connecting to foreign IPs?
I haven’t done anything except set it up per the camera’s instructions. My network is pretty locked down, so if it is not supposed to be attempting outbound to the address I noted, I too would be interested in knowing what is going on. I actually received two more cameras today, so I can let you know if the same issue occurs.
I believe this this the heartbeat to connect to servers of our connections service. We will check with our service provider and get back on this. Thanks!
We will check with our service provider and get back on this. Thanks!
It’s been 29 days. Is there any updates on this? Thanks
I’m seeing Cam Pan (ver 4.10.3.60) with sensor bridge (ver 0.0.0.30) attempting to connect to 210.61.216.106 (Taiwan) and 120.24.153.33 (China).
That’s weird as I also track all connectivity attempts from/to any devices in my networks and I’ve only seen wyze connect to domestic/us aws nodes with an occasional hit to ones in Canada. The only other anomaly was actually today when one of the cams attempted to access an isp connection point in Miami which did not come back as aws so I blocked it when I got the alert. I’ve never had any of the 4 wyze cams I’m running try to connect to China (but every single one of my 24 dahau and hikvision ip cams immediately try multiple ports at multiple ip’s all in China as soon as they power up) 
I ran my camera on a separate wireless network which is connected through a PC with two NICs and logged the connections from the camera for a short period of time. The following are all the servers that it connected to.
DestinationAddress DestinationPort Connections WhoisOrganization
129.6.15.29 123 4 National Institute of Standards and Technology (NIST)
52.218.209.137 443 6 Amazon Technologies Inc. (AT-88-Z)
34.208.107.136 8443 6 Amazon Technologies Inc. (AT-88-Z)
34.211.38.141 8443 2 Amazon Technologies Inc. (AT-88-Z)
52.25.151.84 8443 4 Amazon Technologies Inc. (AT-88-Z)
52.89.157.200 8883 2 Amazon Technologies Inc. (AT-88-Z)
192.99.8.134 10001 4 OVH Hosting, Inc. (HO-2)
207.244.91.206 10001 4 Leaseweb USA, Inc. (LU)
23.82.8.76 10001 4 Nobis Technology Group, LLC (NTGL)
114.67.85.205 10240 4 Beijing Jingdong 360 Degree E-commerce Co., Ltd.
198.16.70.58 10240 4 FDCservers.net (FDCSE)
50.7.98.242 10240 4 FDCservers.net (FDCSE)
I’m running the latest firmware which is 4.9.4.37. The camera is a WYZE Cam v2.
Someone from WYZE, please explain what these servers are. In particular, I would like to know what the Chinese server is being used for, but, also the other non-Amazon servers. What are ports 10001 and 10240 used for?
Note, the Android app connects to the same Chinese server that the camera does.
Hey byakhee99 - would you mind telling me what you’re using to get that data and graph it? That looks super useful.
@b1c22f43f5f7e1b761a2 It is called Scrutinizer and even the free version is very powerful.
But to feed it with network traffic data you have to have a Netflow capable device on your network, like a router, firewall or Layer 3 switch.
I sure wish some info on this was posted by Wyze, Mine were connecting to Russia on 10001, not anymore (Blocked) but I will admit without more info on WHY this may be the last round of Wyze hardware purchases
We used ThroughTek (TUTK) as our P2P connection provider. They are Taiwan based and have servers worldwide including North America, Europe, Asia and China. The IPs above are their server IP worldwide. The network traffic happens during device boot time and in low frequency I assume. This is because the camera needs to initialize itself during boot time + refresh itself with the servers. I am not talking too much detail here to protect their IP. We have integrated their new API to limit camera traffic to US only starting v2 4.9.4.108 version, If you upgrade to the latest version, you will not see oversea traffic. Please let me know if you see extra oversea traffic in 4.9.4.108 or later. Thanks!
Russia? Can you post the server IP and your camera firmware version? We will investigate. Thanks!
Can you tell what your camera firmware version is? Thanks!
Second question, can you tell if this is pure camera traffic or camera + phone traffic?
I’ve noticed connection attempts to Russia as well. was happening about a month and a half ago with the latest firmware at the time.
Just earlier this evening, Romania as well. Attached a few pics from my Firewalla logs.
What is up with traffic on port 10001? Nobody from WYZE ever answered this in this thread.
There are more details at: