Phone sending many packets

Question

Earlier, I accessed my modem to check out the IPs in my network. The network was configured with DHCP (with a considerable time to expire), and I didn't recognize 3 or 4 of IPs: most of them were smartphones.

So, I disabled DHCP and configured to allow just the devices that I knew using MAC address. Feeling more secure, I saw the wifi clients, and I found this (results over a couple hours):

The red indicated points are my Android smartphone, and others are other devices that I recognized. On the first row, my smartphone is not used. On the second row, I have sent some messages. On the third row, I have just navigated to the Play Store, without download anything. On the fourth row, I received just a few messages and I was not using the smartphone. Meanwhile, my parents were using their phones, and you can see the discrepancy of how much traffic their phones received and sent and how much traffic my phone received and sent.

I don't know if this traffic has been always like this, but I noticed it just now. I have not rooted my Android. I download apps only in from the Play Store and I don't see any suspicious content when I'm using my phone.

So, what it can be?

All of this traffic in the screenshot occurred after a factory reset on my Android (actually this is the reason why I did the factory reset).

UPDATE

I have installed Packet Capture on my android and did some scans. In one hour, 629 captures occurred (TCP connection). I'm thinking this is a lot, but I will appreciate if someone tell if it is not. (I have not installed CA to SSL decryption, because I thought that I needed just known the destination of the packages.)

Almost all the captures are from ports 80, 443 and 5228, and all of them to Google (1e100.net), Facebook or SoftLayer Technologies (in domain sl-reverse.com)

So far, I have five questions:

1. What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)
2. WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?
3. The port 5222 are not SSL, but I can't read anything in the log (the characters do not make sense). Is this safe? Can a program decrypt this?
4. In a data log, I saw "host: check.googlezip.net". Is this legitimate?
5. Are all these captures normal? It saw a lot of TCP connections.

UPDATE 2

Thank you to vidarlo from answered some of my questions, but I have a new problem. I used Packet Capture again and I noticed that it do some captures, but it not list what this captures are, showing to me a blank log. This make sense with the fact that my android is sending a lot of packets (like the print in this post). Well, what it can be? Remembering that I have reset this phone. I should use another program to scan it? I didn't root my android and I don't want to do this.

UPDATE 3

The question is still unsolved, the phone keeps receiving and sending a lot of packets. Any recommendations?

Answer 1

What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)

Dalvik is a Java VM. The fact that your phone still uses Dalvik pretty much means it's old, and probably insecure.

WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?

Port 80 is normal WWW. Port 5222 is somwhat well known, but not standardized like port 80. Communication to this port is not unormal, and does not indicate any problems.

The port 5222 are not SSL, but I can't read anything in the log (the characters are not make sense). Is this safe? Can a program decrypt this?

Impossible to say without more knowledge about what you had. It may be binary data, encrypted or cleartext, or it may be anything else.

In a data log, I saw "host: check.googlezip.net". Is this legitimate? Are all these captures normal? It seen a lot of TCP connection.

What you see is more or less normal. Modern smartphones has a lot of processes running, and tend to be rather chatty.

The biggest worry should be that you're running Android <5, which is ancient and is more or less guaranteed to have security problems. Apart from that, I wouldn't think twice about any of the things you saw.