1

Earlier, I accessed my modem to check out the IPs in my network. The network was configured with DHCP (with a considerable time to expire), and I didn't recognize 3 or 4 of IPs: most of them were smartphones.

So, I disabled DHCP and configured to allow just the devices that I knew using MAC address. Feeling more secure, I saw the wifi clients, and I found this (results over a couple hours):

Information by the modem

The red indicated points are my Android smartphone, and others are other devices that I recognized. On the first row, my smartphone is not used. On the second row, I have sent some messages. On the third row, I have just navigated to the Play Store, without download anything. On the fourth row, I received just a few messages and I was not using the smartphone. Meanwhile, my parents were using their phones, and you can see the discrepancy of how much traffic their phones received and sent and how much traffic my phone received and sent.

I don't know if this traffic has been always like this, but I noticed it just now. I have not rooted my Android. I download apps only in from the Play Store and I don't see any suspicious content when I'm using my phone.

So, what it can be?

All of this traffic in the screenshot occurred after a factory reset on my Android (actually this is the reason why I did the factory reset).

UPDATE

I have installed Packet Capture on my android and did some scans. In one hour, 629 captures occurred (TCP connection). I'm thinking this is a lot, but I will appreciate if someone tell if it is not. (I have not installed CA to SSL decryption, because I thought that I needed just known the destination of the packages.)

Almost all the captures are from ports 80, 443 and 5228, and all of them to Google (1e100.net), Facebook or SoftLayer Technologies (in domain sl-reverse.com)

So far, I have five questions:

  1. What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)
  2. WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?
  3. The port 5222 are not SSL, but I can't read anything in the log (the characters do not make sense). Is this safe? Can a program decrypt this?
  4. In a data log, I saw "host: check.googlezip.net". Is this legitimate?
  5. Are all these captures normal? It saw a lot of TCP connections.

UPDATE 2

Thank you to vidarlo from answered some of my questions, but I have a new problem. I used Packet Capture again and I noticed that it do some captures, but it not list what this captures are, showing to me a blank log. This make sense with the fact that my android is sending a lot of packets (like the print in this post). Well, what it can be? Remembering that I have reset this phone. I should use another program to scan it? I didn't root my android and I don't want to do this.

UPDATE 3

The question is still unsolved, the phone keeps receiving and sending a lot of packets. Any recommendations?

  • The only odd thing that I noticed in my phone is that often I have to click more than one time to the click be registered – Mycroft Feb 17 at 14:30
  • 1
    The language in the print is portuguese. Pacote = packet (or package, i don't know) Taxa = rate Economia de energia = energy saving Tempo expirado = I don't know how to translate this because I don't know what it is :( – Mycroft Feb 17 at 14:34
  • 2
    "Tempo expirado" sounds like a timeout. 300 seconds or 5 minutes – schroeder Feb 17 at 20:43
  • Smart phones are constantly sending and receving packets, so your packet count fears are unfounded. – Don Simon Feb 28 at 21:41
  • @DonSimon I know, but look at the difference between data transference in my smartphone and in anothers. – Mycroft Mar 1 at 0:10
1

What's is Dalvik/2.1.0? (I saw this in a capture data by port 80)

Dalvik is a Java VM. The fact that your phone still uses Dalvik pretty much means it's old, and probably insecure.

WhatsApp are using ports 80 and 5222. I can read the data of this port (I saw Dalvik/2.1.0 in a log of WhatsApp). Is this port safe and normal to use?

Port 80 is normal WWW. Port 5222 is somwhat well known, but not standardized like port 80. Communication to this port is not unormal, and does not indicate any problems.

The port 5222 are not SSL, but I can't read anything in the log (the characters are not make sense). Is this safe? Can a program decrypt this?

Impossible to say without more knowledge about what you had. It may be binary data, encrypted or cleartext, or it may be anything else.

In a data log, I saw "host: check.googlezip.net". Is this legitimate? Are all these captures normal? It seen a lot of TCP connection.

What you see is more or less normal. Modern smartphones has a lot of processes running, and tend to be rather chatty.

The biggest worry should be that you're running Android <5, which is ancient and is more or less guaranteed to have security problems. Apart from that, I wouldn't think twice about any of the things you saw.

  • The second more higher numbers in my screenshot is a newer smartphone than my and receive and send less packages. Why? – Mycroft Feb 18 at 15:38
  • Impossible to say without at least complete package logs and evaluation of the phones and software of the phones in question. – vidarlo Feb 18 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.