Enumerating these tools identifies which product is present and its version, which drives configuration review and advisory matching. Endpoint evidence such as processes, services, installed files, package inventory, registry entries, and application data is authoritative. Network evidence comes from outbound connections, DNS, proxy, and firewall logs for vendor relay infrastructure. TeamViewer normally connects outward on TCP/UDP 5938 with fallbacks to TCP 443 or 80; AnyDesk uses outbound TCP 80, 443, or 6568 and UDP 50001–50003 for local discovery. These destination ports are not general inbound service fingerprints.
# on a host: identify the client and version from processes/installed files
tasklist | findstr /i 'teamviewer anydesk splashtop' # Windows
# from network telemetry, correlate destinations and process identity rather than scanning ports
Subtopics#
- Service detection: identifying the product by port and traffic.
- Version detection: determining the client version.