7

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of them was doing it.

The weird thing was that my tablet still making connections to somewhere. So, I used an sniffer application (Wi.cap) to check it and yes, I found them. A few of them were ARP, ICMP and DNS connections. No problem with them. Nevertheless, I found a LOT of connections about a "WLCTL" protocol with 1 or 2KB of data. The source and the destination were MAC address. The destination is my tablet (I checked it), but I don't know what is that source that begins with "7A". Even, the source and the destination have the SAME address, except for the FIRST byte. (source begins with "7A" and destination, my tablet, begins with "78")

enter image description here

I tried to find more information, but I didn't find anything. I'm stuck, so this is my question:

How can I find what process/application is doing these connections?

I think that, knowing this, I can fix the problem...

Improve this question
1
  • Ya may want to check my other answer on detection of rouge Android processes, specifically the stuff related to netstat & ls commands for finding the pid and related executable... and what could go wrong if you've been popped with extra-bad malware.
    – S0AndS0
    Commented Dec 9, 2016 at 4:12

1 Answer 1

Reset to default
1

WLCTL (Web Listener Control) Utility is a UNIX utility, so I would recommend getting some sort of terminal emulator app and run the command "top" or "htop" to display the running processes, once you sort through the necessary normal processes and isolate the one that is sending out these packets, you can run the command "pidof [process name] " without the brackets and apostrophes and the output should be a number which uniquely identifies the process. From here its a simple command "kill [process id number]" again without the brackets or apostrophes.

Improve this answer
2
  • 1
    This relies on the malware not having rootkit-like defenses.
    – Deer Hunter
    Commented Dec 7, 2014 at 8:14
  • Well, the problem was that: how to know what process is making what connections? The step "isolate the one that is sending these packages" says nothing about how to resolve this. Remember that there are a lot of process running, not only Android's process and the problematic. There are a lot of applications installed and uninstall one by one does not seem a efficient solution.
    – user62051
    Commented Dec 15, 2014 at 0:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .