Return to Question

Earlier, I accessed my modem to check out the IPs in my network. The network was configured with DHCP (with a considerable time to expire), and I didn't recognize 3 or 4 of IPs: most of them were smartphones.

So, I disabled DHCP and configured to allow just the devices that I knew using MAC address. Feeling more secure, I saw the wifi clients, and I found this (results over a couple hours):

The red indicated points are my Android smartphone, and others are other devices that I recognized. On the first row, my smartphone is not used. On the second row, I have sent some messages. On the third row, I have just navigated to the Play Store, without download anything. On the fourth row, I received just a few messages and I was not using the smartphone. Meanwhile, my parents were using their phones, and you can see the discrepancy of how much traffic their phones received and sent and how much traffic my phone received and sent.

I don't know if this traffic has been always like this, but I noticed it just now. I have not rooted my Android. I download apps only in from the Play Store and I don't see any suspicious content when I'm using my phone.

So, what it can be?

All of this traffic in the screenshot occurred after a factory reset on my Android (actually this is the reason why I did the factory reset).

UPDATE

I have installed Packet Capture on my android and did some scans. In one hour, 629 captures occurred (TCP connection). I'm thinking this is a lot, but I will appreciate if someone tell if it is not. (I have not installed CA to SSL decryption, because I thought that I needed just known the destination of the packages.)

Almost all the captures are from ports 80, 443 and 5228, and all of them to Google (1e100.net), Facebook or SoftLayer Technologies (in domain sl-reverse.com)

So far, I have five questions:

1. What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)
2. WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?
3. The port 5222 are not SSL, but I can't read anything in the log (the characters do not make sense). Is this safe? Can a program decrypt this?
4. In a data log, I saw "host: check.googlezip.net". Is this legitimate?
5. Are all these captures normal? It saw a lot of TCP connections.

UPDATE 2

Thank you to vidarlo from answered some of my questions, but I have a new problem. I used Packet Capture again and I noticed that it do some captures, but it not list what this captures are, showing to me a blank log. This make sense with the fact that my android is sending a lot of packets (like the print in this post). Well, what it can be? Remembering that I have reset this phone. I should use another program to scan it? I didn't root my android and I don't want to do this.

Earlier, I accessed my modem to check out the IPs in my network. The network was configured with DHCP (with a considerable time to expire), and I didn't recognize 3 or 4 of IPs: most of them were smartphones.

So, I disabled DHCP and configured to allow just the devices that I knew using MAC address. Feeling more secure, I saw the wifi clients, and I found this (results over a couple hours):

The red indicated points are my Android smartphone, and others are other devices that I recognized. On the first row, my smartphone is not used. On the second row, I have sent some messages. On the third row, I have just navigated to the Play Store, without download anything. On the fourth row, I received just a few messages and I was not using the smartphone. Meanwhile, my parents were using their phones, and you can see the discrepancy of how much traffic their phones received and sent and how much traffic my phone received and sent.

I don't know if this traffic has been always like this, but I noticed it just now. I have not rooted my Android. I download apps only in from the Play Store and I don't see any suspicious content when I'm using my phone.

So, what it can be?

All of this traffic in the screenshot occurred after a factory reset on my Android (actually this is the reason why I did the factory reset).

UPDATE

I have installed Packet Capture on my android and did some scans. In one hour, 629 captures occurred (TCP connection). I'm thinking this is a lot, but I will appreciate if someone tell if it is not. (I have not installed CA to SSL decryption, because I thought that I needed just known the destination of the packages.)

Almost all the captures are from ports 80, 443 and 5228, and all of them to Google (1e100.net), Facebook or SoftLayer Technologies (in domain sl-reverse.com)

So far, I have five questions:

1. What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)
2. WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?
3. The port 5222 are not SSL, but I can't read anything in the log (the characters do not make sense). Is this safe? Can a program decrypt this?
4. In a data log, I saw "host: check.googlezip.net". Is this legitimate?
5. Are all these captures normal? It saw a lot of TCP connections.

UPDATE 2

Thank you to vidarlo from answered some of my questions, but I have a new problem. I used Packet Capture again and I noticed that it do some captures, but it not list what this captures are, showing to me a blank log. This make sense with the fact that my android is sending a lot of packets (like the print in this post). Well, what it can be? Remembering that I have reset this phone. I should use another program to scan it? I didn't root my android and I don't want to do this.

UPDATE 3

The question is still unsolved, the phone keeps receiving and sending a lot of packets. Any recommendations?

Earlier, I accessed my modem to check out the IPs in my network. The network was configured with DHCP (with a considerable time to expire), and I didn't recognize 3 or 4 of IPs: most of them were smartphones.

So, I disabled DHCP and configured to allow just the devices that I knew using MAC address. Feeling more secure, I saw the wifi clients, and I found this (results over a couple hours):

The red indicated points are my Android smartphone, and others are other devices that I recognized. On the first row, my smartphone is not used. On the second row, I have sent some messages. On the third row, I have just navigated to the Play Store, without download anything. On the fourth row, I received just a few messages and I was not using the smartphone. Meanwhile, my parents were using their phones, and you can see the discrepancy of how much traffic their phones received and sent and how much traffic my phone received and sent.

I don't know if this traffic has been always like this, but I noticed it just now. I have not rooted my Android. I download apps only in from the Play Store and I don't see any suspicious content when I'm using my phone.

So, what it can be?

All of this traffic in the screenshot occurred after a factory reset on my Android (actually this is the reason why I did the factory reset).

UPDATE

I have installed Packet Capture on my android and did some scans. In one hour, 629 captures occurred (TCP connection). I'm thinking this is a lot, but I will appreciate if someone tell if it is not. (I have not installed CA to SSL decryption, because I thought that I needed just known the destination of the packages.)

Almost all the captures are from ports 80, 443 and 5228, and all of them to Google (1e100.net), Facebook or SoftLayer Technologies (in domain sl-reverse.com, when I'm using WhatsApp). Another port, 5222, have occurred when I'm using WhatsApp, but to Google or Facebook.

So far, I have five questions:

1. What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)
2. WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?
3. The port 5222 are not SSL, but I can't read anything in the log (the characters do not make sense). Is this safe? Can a program decrypt this?
4. In a data log, I saw "host: check.googlezip.net". Is this legitimate?
5. Are all these captures normal? It saw a lot of TCP connections.

UPDATE 2

Thank you to vidarlo from answered some of my questions, but I have a new problem. I used Packet Capture again and I noticed that it do some captures, but it not list what this captures are, showing to me a blank log. This make sense with the fact that my android is sending a lot of packets (like the print in this post). Well, what it can be? Remembering that I have reset this phone. I should use another program to scan it? I didn't root my android and I don't want to do this.

Earlier, I accessed my modem to check out the IPs in my network. The network was configured with DHCP (with a considerable time to expire), and I didn't recognize 3 or 4 of IPs: most of them were smartphones.

So, I disabled DHCP and configured to allow just the devices that I knew using MAC address. Feeling more secure, I saw the wifi clients, and I found this (results over a couple hours):

The red indicated points are my Android smartphone, and others are other devices that I recognized. On the first row, my smartphone is not used. On the second row, I have sent some messages. On the third row, I have just navigated to the Play Store, without download anything. On the fourth row, I received just a few messages and I was not using the smartphone. Meanwhile, my parents were using their phones, and you can see the discrepancy of how much traffic their phones received and sent and how much traffic my phone received and sent.

I don't know if this traffic has been always like this, but I noticed it just now. I have not rooted my Android. I download apps only in from the Play Store and I don't see any suspicious content when I'm using my phone.

So, what it can be?

All of this traffic in the screenshot occurred after a factory reset on my Android (actually this is the reason why I did the factory reset).

UPDATE

I have installed Packet Capture on my android and did some scans. In one hour, 629 captures occurred (TCP connection). I'm thinking this is a lot, but I will appreciate if someone tell if it is not. (I have not installed CA to SSL decryption, because I thought that I needed just known the destination of the packages.)

Almost all the captures are from ports 80, 443 and 5228, and all of them to Google (1e100.net), Facebook or SoftLayer Technologies (in domain sl-reverse.com)

So far, I have five questions:

1. What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)
2. WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?
3. The port 5222 are not SSL, but I can't read anything in the log (the characters do not make sense). Is this safe? Can a program decrypt this?
4. In a data log, I saw "host: check.googlezip.net". Is this legitimate?
5. Are all these captures normal? It saw a lot of TCP connections.

UPDATE 2

Thank you to vidarlo from answered some of my questions, but I have a new problem. I used Packet Capture again and I noticed that it do some captures, but it not list what this captures are, showing to me a blank log. This make sense with the fact that my android is sending a lot of packets (like the print in this post). Well, what it can be? Remembering that I have reset this phone. I should use another program to scan it? I didn't root my android and I don't want to do this.

Earlier, I accessed my modem to check out the IPs in my network. The network was configured with DHCP (with 24h to expire), and I didn't recognize 3 or 4 of IPs: most of them were smartphones, but one of the IPs has the name "unknown". I used nmap to scan this device and I discovered that "unknown" was from ZHI Yuan Electronics, but I don't have any devices from them.

So, I disabled DHCP and configured to allow just the devices that I knew using MAC address. Feeling more secure, I saw the wifi clients, and I found this (results over a couple hours):

The red indicated points are my Android smartphone, and others are other devices that I recognized. On the first row, my smartphone is not used. On the second row, I have sent some messages. On the third row, I have just navigated to the Play Store, without download anything. On the fourth row, I received just a few messages and I was not using the smartphone. Meanwhile, my parents were using their phones, and you can see the discrepancy of how much traffic their phones received and sent and how much traffic my phone received and sent.

I don't know if this traffic has been always like this, but I noticed it just now. I have not rooted my Android. I download apps only in from the Play Store and I don't see any suspicious content when I'm using my phone.

So, what it can be?

All of this traffic in the screenshot occurred after a factory reset on my Android (actually this is the reason why I did the factory reset).

UPDATE

I have installed Packet Capture on my android and did some scans. In one hour, 629 captures occurred (TCP connection). I'm thinking this is a lot, but I will appreciate if someone tell if it is not. (I have not installed CA to SSL decryption, because I thought that I needed just known the destination of the packages.)

Almost all the captures are from ports 80, 443 and 5228, and all of them to Google (1e100.net), Facebook or SoftLayer Technologies (in domain sl-reverse.com, when I'm using WhatsApp). Another port, 5222, have occurred when I'm using WhatsApp, but to Google or Facebook.

So far, I have five questions:

1. What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)
2. WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?
3. The port 5222 are not SSL, but I can't read anything in the log (the characters do not make sense). Is this safe? Can a program decrypt this?
4. In a data log, I saw "host: check.googlezip.net". Is this legitimate?
5. Are all these captures normal? It saw a lot of TCP connections.

UPDATE 2

Thank you to vidarlo from answered some of my questions, but I have a new problem. I used Packet Capture again and I noticed that it do some captures, but it not list what this captures are, showing to me a blank log. This make sense with the fact that my android is sending a lot of packets (like the print in this post). Well, what it can be? Remembering that I have reset this phone. I should use another program to scan it? I didn't root my android and I don't want to do this.

Earlier, I accessed my modem to check out the IPs in my network. The network was configured with DHCP (with a considerable time to expire), and I didn't recognize 3 or 4 of IPs: most of them were smartphones.

So, I disabled DHCP and configured to allow just the devices that I knew using MAC address. Feeling more secure, I saw the wifi clients, and I found this (results over a couple hours):

The red indicated points are my Android smartphone, and others are other devices that I recognized. On the first row, my smartphone is not used. On the second row, I have sent some messages. On the third row, I have just navigated to the Play Store, without download anything. On the fourth row, I received just a few messages and I was not using the smartphone. Meanwhile, my parents were using their phones, and you can see the discrepancy of how much traffic their phones received and sent and how much traffic my phone received and sent.

I don't know if this traffic has been always like this, but I noticed it just now. I have not rooted my Android. I download apps only in from the Play Store and I don't see any suspicious content when I'm using my phone.

So, what it can be?

All of this traffic in the screenshot occurred after a factory reset on my Android (actually this is the reason why I did the factory reset).

UPDATE

I have installed Packet Capture on my android and did some scans. In one hour, 629 captures occurred (TCP connection). I'm thinking this is a lot, but I will appreciate if someone tell if it is not. (I have not installed CA to SSL decryption, because I thought that I needed just known the destination of the packages.)

Almost all the captures are from ports 80, 443 and 5228, and all of them to Google (1e100.net), Facebook or SoftLayer Technologies (in domain sl-reverse.com, when I'm using WhatsApp). Another port, 5222, have occurred when I'm using WhatsApp, but to Google or Facebook.

So far, I have five questions:

1. What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)
2. WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?
3. The port 5222 are not SSL, but I can't read anything in the log (the characters do not make sense). Is this safe? Can a program decrypt this?
4. In a data log, I saw "host: check.googlezip.net". Is this legitimate?
5. Are all these captures normal? It saw a lot of TCP connections.

UPDATE 2

Thank you to vidarlo from answered some of my questions, but I have a new problem. I used Packet Capture again and I noticed that it do some captures, but it not list what this captures are, showing to me a blank log. This make sense with the fact that my android is sending a lot of packets (like the print in this post). Well, what it can be? Remembering that I have reset this phone. I should use another program to scan it? I didn't root my android and I don't want to do this.