[Q] Data traffic to svc.spd.samsungdm.com - AT&T, Rogers, Bell, Telus Samsung Galaxy S III

Hi. I hope this is the appropriate forum...
I have an i747 running stock AT&T firmware. Un-rooted.
Over the last few weeks, I've noticed that my battery drain has increased and often my phone will be warm when I'm not near WIFI suggesting that the radio is active. I've also noticed that when I'm not connected to WIFI, the 4G/LTE icon at the top often indicates that there's data activity in progress.
So I set up a sniffer on my firewall to monitor the phone's data traffic when on WIFI. Here's what I found:
Within seconds of enabling WIFI on the phone, it appears that there are a handful of DNS requests. Most are for google apps (mtalk.google.com and a few others). Those aren't surprising. Then there are a number of lookups for svc.spd.samsungdm.com which maps to a pair of servers in the amazon cloud.
Immediately following that is a back-and-forth stream of HTTPS traffic to these samsungdm.com servers. I've been monitoring for the last 30 minutes while my phone has sat idle on the table with the screen turned off and this back-and-forth traffic has not stopped.
Google doesn't turn up much info about this domain. Any ideas what this is and why it's so chatty?

I know this is an old thread, but I just recently started to investigate this issue as well. I have found that those servers are related to SELinux policy updates within the Touchwiz framework. A packet is sent to the server to initiate a request through TLSv1.2, the servers exchange keys and then a packet is sent to see if the policies are up-to-date or not. If not, i'm assuming that policies are then sent directly to the device over https(port 443). If you have auto update on for SELinux policies, then you will most likely see a good amount of battery drain.
I started to look into this issue because if you can attempt to get your device to download a malformed security policy, then you could possibly bypass SELinux and Samsung KNOX as well. I'm not totally sure but it sure would help out a lot.

Related

Multiple Serious Issues On O2 XDA IIs

I have had an XDA IIs for a week and the thing is *riddled* with bugs. A few that come to mind:
Add a new profile to connection manager and then add a 'modem' to that connection. Go and fiddle elsewhere for a while. Often when you come back to change the settings for that connection the 'modem' has dissapeared. (its still there, a soft reset will cause it to re-appear).
Take the unit out of range of your wifi while running an app that does nots of network activity, and you will have to do a soft reset in order to restore network connectivity. This occurs mainly with skype
WiFi Reception is **attrocious** my laptop will tell me that I have a full signal and the XDA IIs will barely register when at the same location. Even holding the damned thing 1 ft from the base station does not cause the signal indicator to head to maximum.
When you use bluetooth, for network access, all the stuff in connection manager gets reset.
Often, after setting connection manager to always use certain profiles, and then encountering a problem, you head into connection manager and find that your selections never stuck
VPN connections do not always stick when set, they dissapear from the menu.
I have tried for ages and failed to make a VPN connection over anything GPRS, WiFi etc. VPN was one of the reasons that I bought the device (access to home and work networks), but it just does not work. Additionally, the instructions with the unit offer no help about how to get it working.
The bundled O2 active stuff is very flaky. Take the end programs applet - it often crashes its self while trying to force an app that is 'not responding' to stop. The built in 'stop app' applet (which they burried in settings) seems to work but...
Getting an app in a not responding state is well easy - just use it normally! Messenger prog is the worst. Usually requires use of 'end now' option
IMAP support is very very bad. Its quite common for an IMAP server to not store mail folders in the root. In decent clients you can specify the root imap folder, not in pocket outlook, it ends up pulling the entire dir struct from your home dir!! I rebuilt the imap daemon on my linux box to compile in a default root folder. This solved the previous problem, but the imap support is not suitable for use away from wifi cause its so damned slow. It does not just look for new messages, and there is no way to tell it to do this. Also, when you send an item it ends up in the default sent items, not the imap sent items. Imho, the main reason to use imap is to keep your emails intact (be able to see what you sent from the mobile device from a desktop).
Outlook 2K3 on the desktop has the same issue btw, but at least that supports rules so you can put it right.
Billy wrote pocket outlook for connecting to an exchange server, which, I suspect only 50% of the devices purchaced will ever do. Pocket Oulook *always* starts pointing at the exchange folder structure, not your POP3/IMAP account, and there is no way to config this. Unessesary taps required. Why can I not DELETE the default exchange folders if I dont need them?
There are a load more issues as well... I currently do around 10 soft resets/day. My basis is that a wait of more than 10 secs means that the device has crashed. Perhaps if I was willing to wait 5 mins all the time for it to get its arse into gear then the number of soft resets could be reduced!
I shall have to create me a site with XDA IIs bugs on it. I suspect that most of these issues are also present on other devices using windows mobile 2003 so it aint just gonna be the XDA. MS will likely fix them, and then O2 will take years to make the fixes available to its customers.
To be honest, I wish I had stuck with a symbian based device.
Has *anyone* managed to get a IPSEC/PPTP VPN connection running either via wifi or GPRS???
Has anyone managed to get skype PPC working **reliably** Mine works OK if I sit next to the AP, but I might as well use the PC version if I have to do that. Moving further away causes skype to give up due to lack of bandwidth. WiFi also locks (no network access period) even though the PPC still indicates that it has a single from the AP. The only fix for this is yet another soft reset.
Some other stuff:
Refuses to connect to a network that is not broadcasting the SSID. In general, when you want to add a new box, you can set AP to broadcast SSID, it will then find the network, after it has connected, you can hide the SSID. For future connections from 'pre-registered' boxes, no SSID is required. Not so for the XDA IIs, refuses to connect to a base station that is not broadcasting an SSID, or in some cases, creates a new connection with the name "" (i.e nothing) (which again refuses to connect).
Right, now, if you have 2 wifi networks listed in PPC settings, it will sometimes sit there for ever failing to connect, do a soft reset and it connects.
Another one: you have two connections in the 'configure wireless networks' dialogue, one is 'connecting' other is 'unavailable'. The one that is connecting is obviously not gonna connect despite 100% correct settings, so I select 'remove' it does not dissapear!!!
If I had written this software, the user would see a dialogue box thus 'This network is connecting/connected, are you sure you wish to remove its settings?' Selecting yes, would either terminate the connection attempt, or terminate the connection and then remove the damned setting with no further agro!
In network settings, I often get some *stupid* status info. It sometimes says that my home network is 'available' when I am at work. Clearly it isn't, wifi does not travel 10 miles!
And some more:
Sometimes bluetooth fails to start complaining about insufficient driver space. I write windows KMD's all the time, I suspect its somet daft like a lack of available stack space, or stack recursion. Soft reset cures
Also, sometimes when I try to start bluetooth, I get a daft message saying that the licence for the bluetooth stack has expired!!! It then starts BT and all is OK.
All pretty in-excusable bugs for post beta software. This is MS's 4th attempt now at a mobile operating system and its still a bag of sh1te!
A PDA is supposed to be a productivity tool, not something that you have to put 4 hours into to save yourself an hour. When I pull the damned thing out I want it to do **exactly** what it says on the box.
Bugs in software are inevitable, but this just was not even tested - there are *obvious* bugs that should have been detected in QA and delayed the relrease date. I suspect most users will trip over these issues in the first few hours of use. The workaround for most is a soft reset - the blooming reset switch will be worn out in a week!
My advice: AVOID until they fix some of the bugs. Does O2/MS have a route for bug submissions? I'll write these up as formal bug reports with reproducers and send them off.
If it were not for the appeal of skype/skypeout (only with 10 metres of base station otherwise wifi dies, reset required!) then it would have gone back by now. Not of merchantisable quality imho.
I write C/CPP/Java software for a living, if I let something this bad out the door I'd loose my damned job!
And some more:
- If you reconfig your shortcuts (so you can find stuff!) Then the applets 'camera' and 'O2' always seem to copy themselves back out into the root of StartMenu-->Programs again.
Go into the find applet and get it to do a search that takes some time. Wait for it to get going and then click stop. PDA hangs. It does come back eventually (2-3 mins later), but remains sluggish until you do a soft reset. Trying to suspend while its hung just switches the backlight off!
Wish there was some kind of formal bug raising email address or somet.
Nigel
Agree with you
Got the Orange m2000 variant and have same issues!
wifi has week signal (got 3 overlapping base stations in one open plan office) and can only get 25% signal.
can get vpn connection to work but after a few mins gets bored and drops!
phone reception is poor
bluetooth keeps crashing
going to send back to orange and get a new nokia 6230 and dell pda. cant rely on phone which crashes 10 times a day
Richard
how did you get the VPN to connect at all??
My WiFi connection is marked as 'connects to work' which means that the VPN profiles setup under 'work' should be offered to me. I would expect that after I have wifi up and running, clicking the icon at the top would show:
'Work - Wifi'
Unfortunately, it refuses to show anything other than 'The Internet - Wifi'. If I could get it to connect to wifi using the 'work' profile then perhaps it would show me by VPN connections underneath so that I could connect these too, but it **refuses** to do so.
BBB
(BuggedBeyondBelief)
Nigel
More issues
Hi
I have been adding new bugs to my original post as I find them. Here's a couple more:
Sometimes (no real causer for this) When the WLan auto disables its self (set to 5 mins), I will head into the Wireless Lan manager, tick the 'Wireless lan ON' box and click OK.
It still stays disabled!!!
I then head back into the wireless Lan manager, and find that my tick did not stick, same result if I try again. The only way to get the Wlan back is to restart the damned thing.
Additionally, if I go into tools-->network cards from the wireless lan manager, it says that the Wlan is 'connected' it IS NOT connected!!!
This problem shows its self more when the 'Wireless lan Manager-->Settings Tab-->Auto Turn off WLAN if not connected' option is ticked but it will also do it without this.
Seems to be partially caused by poor wifi signal and having previously run an app that hammered the network.
Sack of [email protected]!
Nigel
u seem to be having a mare!
I've no probs with WiFi at all, none of the issues U raise have occurred, WiFi works fine all over my house (I'm tapping this in upstairs & my router is downstairs) & I've got the settings set for best battery life rather than strongest signal. In the hotels I've stayed in recently I've also had faultless WiFi!
A couple of the users @ work have had trouble wiv GPRS overriding WiFi but I put this down to TNBTK!!
I've also seen the lost modem settings problem(also cured by soft reset).
Bluetooth performance has been a touch hit & miss but fiddling in the advanced settings seem to help!!
I've not tried VPN as I'm actively moving us away from this @ work towas web based services. Just a thought though, isn't "connecting to the internet" what you'd expect to see? surely you are using an internet gateway to VPN onto your network?
One other issue I've had is a logon problem with MS sharepoint, I'm hoping to cure that next week by playing about with authentication on the server.
I'v got a route in to some technical contacts at O2 so I'll ask bout the bug reporting for U tomorrow.
Hi
Aye, fun and games at the moment, just like my hardware to do what it says on the box!
Have you tried Skype? I have a feeling that you too will suffer the wifi lock-up problems if you give skype a go at the extreme of your wifi reception. I dont think its skype's fault though, but rather just the XDA not liking what skype gets up to! I am not gonna complain if it drops the wifi connection, its the lock-up that requires the reboot that winds me up.
Most of the time, my wifi is OK as well. Many of the problems I have had are related to use of skype, and having setup the auto-off wifi setting (which is now off again).
You have an XDA IIs? Perhaps mine has old firmware? I certainly dont believe that this is hardware related. I intend to come up with some repeaters for the problems I have, at the moment, they just occur 'when they feel like it'.
>A couple of the users @ work have had trouble wiv GPRS overriding WiFi >but I put this down to TNBTK!!
I have had this with bluetooth, but not with wifi. I think this connection occurs while on bluetooth when using ports that are not passed by default by ICS on the windows host box.
>I've also seen the lost modem settings problem(also cured by soft >reset).
This one really winds me up cause there is no way such a bug should have got past QA.
>Bluetooth performance has been a touch hit & miss but fiddling in the >advanced settings seem to help!!
Apart from the stupid messages about kernel space when trying to start BT, and the daft popup box saying that the BT stack license has expired, the BT on the XDA IIs is one of the more stable implementations that I have seen. You would think that since BT is now around 5 years old, it would be 100% stable these days.
>I've not tried VPN as I'm actively moving us away from this @ work >towas web based services. Just a thought though, isn't "connecting to >the internet" what you'd expect to see? surely you are using an internet >gateway to VPN onto your network?
It seems that there are two main connection methods in PPC, work, and Internet. The Proxy and VPN settings are not available when connected using a profile that is associated with 'internet' they are only available when connected through a 'work' profile. Again, the documentation is very lacking in the manual. O2's idea of a 'work' connection is WAP to O2 active!! A 'work' connection can be made to allow internet connections by checking the checkbox under proxy servers.
The various guides that I have found all suggest using the same profile for 'work' and 'internet', and setting the checkbox under proxies to allow internet access.
The layout of the whole connections applet in PPC is just a mess - completely unintuative!
Anyway, whatever the correct method, I've tried the lot and cant get the VPN to connect!!
>I'v got a route in to some technical contacts at O2 so I'll ask bout the >bug reporting for U tomorrow.
Cheers!
Nigel
Just got a reply from O2 About Above Bugs!
Hi
Ammused the hell out of me since its obviously a standard reply! There are not hardware problems, they are software problems so exchanging the hardware when the software remains the same aint gonna help!!
Nutters....!
I like the unit, I dont want to return it, I just want then to be aware of, and then fix the bugs and release new firmware promptly. O2's idea, is that if user sends in a bug report that refers to the *software* the unit runs, offer said user a new unit with same software - must cost them a bl00dy fortune!!
See O2's reply below:
Dear Nigel,
Thank you for contacting O2 Customer Service.
Please accept my sincere apologies for any inconvenience that may have
been caused by this matter and thank you for your patience.
I am sorry to know your handset has become faulty within 14 days of
purchase. However, we if you wish to get a new phone, please return your
faulty phone in it`s original packaging using the returns label
provided. If you do not have the original packaging please reply to this email
and I will arrange for a jiffy bag to be sent out to you. Returning
your order is free as the postage is prepaid, however can I ask you
obtain proof of postage as this will assist us greatly in the unlikely event
that your order does not reach our warehouse.
Any money you have paid for your order will be refunded once we have
received your order, however this process may take upto 21 working days.
After this you can order a new phone. There are two ways to order a
product from O2 Online:
You can order directly from our website by clicking on the link below:
http://shop.o2.co.uk/shop/
Alternatively, you can contact our sales team on 0870 225 7879. Who are
available Monday to Friday between 8:30am and 9:00pm and at weekends
between 10:00am and 6:00pm. Calls are charged at National Rate.
Please ensure you have your credit or debit card at hand when ordering.
Before placing your order, please spend a few moments familiarising
yourself with our Online Mobile Terms and Conditions, accessible via the
following link:
http://shop.o2.co.uk/cgi-bin/o2uk/jsp/otherPages/Info.jsp?infoPage=Terms:Shop
Isn't it time to see what you can do with O2.
However, you can also visit your nearest O2 store to get your phone
repaired.
On visiting your local O2 store please take with you proof of purchase.
You should have received this when you originally placed your online
order, if you have not retained this then please contact us again
requesting "proof of purchase".
You can find your nearest store by calling 0800 22 44 77 or by clicking
on the link below:
http://www.o2.co.uk/business/buy/storefinder/0,,130,00.html
dont seems to have the problems you have stated additional i have very good signals over the macdonalds.... (a free wifi service for now) in Singapore and tried with hotels wifi do not seem to have any problems... even installed WiFiForum a Wifi sniffer compitable with IIs and seriously speaking... after installing the WiFiForum i seem to have better phone signals... the best sniffer ever.... For VPN never tried... note: i have pocket skype and it works flawless.... dont get the "locked to network" problem
problems?
sounds like a bad unit. I'm new at this and am really wanting the blue angel early next year but reading a lot of bad press. I still have my sharp gx 1 and am looking for a good upgrade, the blue angel seems to have just the features I want...but so many bugs I'm seeing. from yellow tinged screens to connection and software problems. Thing is...is it a new product issue, or a design issue in general, and does anyone know when these bugs will be fixed? I really don't want to jump and buy one on contract and then have problems...don't know what to do. suggestions?
wifi signal
If you will take down the wifi speed of the access point from mixed a + b to just a, it will improve the signal for the XDA and the coverge will be stronger.
Very very few AP's have A and B. A works on 5.4GHz. B and G is the usual combination since they are both on 2.4GHz. I get no increases in performance by switching my AP to B only, and besides, doing such a thing means that access via my laptop gets well slow!
Modern devices should be able to work with multimode AP's with zero issues. Unfortunately, it seems that not one manufacturer of WiFi gear can read, they all interpret the standards as they see fit (I believe on purpose) thus locking you into their AP and their client side cards if you want a reliable network. WiFi has been around for eons, it should work by now, its hardly rocket science.
And as for the abortion that is bluetooth....!
Nigel
Nigel,
Don't know if this is going to be useful or not - but I've managed to get VPN working on the IIs after reflashing with the newer i-mate ROM.
O2 seem to do some wacky setup that defines your 'work' connection as a connection to their O2 Active WAP service - this seems to screw up VPN connections somehow.
Anyway, it's pretty easy to setup once you start with a clean-ish ROM - but if you have problems/questions let me know.
Also, with regards to wifi - does you unit get a better signal when docked/connected to the mains? I'm not quite sure that the power-saving options are being implemented properly on the IIs's...
Chris.
Okay got bored reading your essay but that bit about the network cards dissapearing when u added a new connection is true! I could only get it to show once I hard reseted and also it used to turn on for a short while when I turned wifi on.... on the Wi fi strength meter I believe its a graphical fault rather than a strength problem also the strength will be affected by other thins i.e. more than one person using the wifi point. I have sent my XDA IIs back to my company in detest about the dissapearing network cards! and I got told in anouther post bluetooth is shot! and an update while be made (Cause i can't connect or see virtually any blutooth devices in range when my mates phone detects 20+) Oh and anouther thing about Wi Fi Strength... Your phone is small and theres less power so naturally u will not be able to pick up as strong as a laptop will in regards to the signal thats why they say blutooth only extends upto 10 meters on mobiles but upto 100 meters on a PC thats deliberate due to power consumption and stuff
Check out this wifi scanner it finds hotspots really quick and shows the signal strength and stuff I use it but be sure to EXit from it before using wi-fi as for sum reason it stops u using wifi untill u exit.. its still a quality tool tho and its freeware! I picked up sumones wifi router in there home (it was 3 floors up) from nearly 150 houses away!!!! Naturally i couldnt connect tho
Click here to download it I found 16 Wifi Points in my local ASDA! and 20 from work to home (1 mile)
XDA VPN woes
Chriscole
I'm a newbie and piloting the xda IIs for the bosses so forgive my naivety. I have had no joy with the VPN setup to connect to the email servers because like you, the wap gprs keeps getting in the way. i am at a loss how to get the VPN setup tp connect using the mobile gprs instaed. Anychance you could post the steps you applied to get this feature to work for others benefit? Also wher can i get i-mate Rom.
Answer gratefully anticipated.
olori :?
I'm a newbie here and after playing one of the games on my xda IIs it freezes and i have to do a soft reset. I've only had it 4 days not sure i want to try anything else on it
VPN and GPRS
Just a thought. I've tried several times over the last couple of years on several platforms to get a VPN connection over GPRS on O2 and I've always failed. Could it be that O2 block the socket on mobile.o2.co.uk? What I'm trying to point out is that this is not an XDA specific problem. I've tried using a laptop, a Clie PEG UX 50, and iPaq 5450 and an old palm VX over time and I've always failed.
I would definately recommend updating to the latest O2 ROM ...... BUT ...... make sure you use corporate mode (code 0506) so that the rubbish O2 software doesn't get installed.
Still testing but it seems far more stable.
bugs
Is there any way to take the o2 stuff off after the new ROM has been installed?
If you don't mind reinstalling any additional software/ringtones etc then you could just do a hard reset to get onto corporate.
Otherwise a search on this forum should reveal how to edit the registry so that the O2 rubbish doesn't load on startup.

Mystery outgoing SSL traffic. Lots of it

Few days ago I installed the new Kernel that fixes the network counters from here http://forum.xda-developers.com/showthread.php?t=1468626 (thanks to ardatdat).
Immediately I noticed that the traffic is counting up way too quickly. I looked at my bills to see if this is new, and realized that since I got the phone, my monthly traffic was consistently at 200-400MB per month, even though I can explain maybe 30MB per month (I have access to wifi pretty much anywhere I go).
So, started digging. In the last 3 days there's been 25MB down and 50MB up. With all the testing I was doing, I can explain maybe 10 down and 5 up. So, using the TrafficCounter app, I found that a system app called "Task Manager" is responsible for the traffic (attached screencap displays traffic over 4 hours).
It doesn't slowly count up. Instead, it will stay at the same mark, then all of a sudden change by 2.2MB. Every time. So it looks like it packages something and sends it off. The most interesting thing? It only does it when on 3G. If I'm connected to WIFI, it's silent. Like it doesn't want me to see what it's doing.
So, installed Shark, and made a traffic capture. I was able to capture the outgoing SSL stream that was exactly 2.18MB. Destination IP 74.125.226.65 resolves to yyz06s07-in-f1.1e100.net. Browsing there gives google's front page......
Checked the TCP stream, right before the transfer, there's a DNS lookup for android.clients.google.com, which responds with that IP address.
Checking SSL Cert gives me *.google.com cert. Same one as for all of their sites
So it turns out every 3 or so hours there's a 2.2MB transfer from my phone to the google servers via encrypted channel.
Looking further, my wife's and my mother's androids are showing just as much data on their bills, they got Nexus S and Galaxy S. While I can see my wife using so much data, it's doubtful my mom has even figured out how to consume so much traffic.
Anyone else notice this?
What is the purpose of it? If it's legitimate, how can they justify using so much of my limited monthly bandwidth?
You've checked the "keep my phone backed up to my google account" button on setup. You can re-run the setup to uncheck that option, but until then it'll continue to send those big packages, and it prefers the 3G connection. I've taken to leaving my WIFI on and connected at all times. With a measly 200MB/month plan (AT&T can blow me for un-grandfathering my unlimited data), a 15MB backup nightly was killing me...
L4T
If it is the sync feature using all this data, you can disable the automatic sync from Settings > Accounts and Sync. It doesn't appear there's any way to tell it to only sync on Wifi, but I'm sure most of the data monitoring apps out there can stop apps from using mobile data. Onavo, for instance, claims to have this feature, but I haven't had cause to use it yet.
Lookin4Trouble said:
You've checked the "keep my phone backed up to my google account" button on setup. You can re-run the setup to uncheck that option, but until then it'll continue to send those big packages, and it prefers the 3G connection. I've taken to leaving my WIFI on and connected at all times. With a measly 200MB/month plan (AT&T can blow me for un-grandfathering my unlimited data), a 15MB backup nightly was killing me...
L4T
Click to expand...
Click to collapse
Thanks, that was it! Didn't expect that setting there. It's upsetting that there's no way to configure that feature - such as how often to send data, to only send incrementals, or such an advanced setting as upload only when connected to WIFI.
Problem with leaving wifi on all the time is the fact that it eats battery a lot. If my wifi is on all the time, the battery life is about 40% shorter
kvantum said:
Thanks, that was it! Didn't expect that setting there. It's upsetting that there's no way to configure that feature - such as how often to send data, to only send incrementals, or such an advanced setting as upload only when connected to WIFI.
Problem with leaving wifi on all the time is the fact that it eats battery a lot. If my wifi is on all the time, the battery life is about 40% shorter
Click to expand...
Click to collapse
No problem, could you append [SOLVED] to your original post?
Thanks
L4T

[Q] Wrong ARP WiFi annoucements with JB ROMs

I've got a significant problem with my DHD when running any of the latest JB releases I've tested -- the problem appears with the JellyTime, codefireX, pipelinerard's CM and also the AOKP ROM's I've tested, even on a clean install (complete wipe of everything but the radio, install only the ROM; gapps not needed to cause the issue). The problem is however not manifest in IceColdSandwich, so I suspect something is broken in the way JB uses the WiFi network compared to how ICS did it. Maybe that triggers a bug somehow in the radio or misses some important radio settings?
To some/many people, it may not be immediately visible, but if you have this problem and use your phone on a large network, you might get banned/kicked off the network if they use rules similar to what e.g. Princeton recently implemented. You may also experience this as intermittent network problems with some hosts being unavailable from time to time.
Here is what happens:
Whenever the phone sleeps (i.e. the screen is off), it sends out bogus ARP message every 15.1 seconds (give and take 10mS or so). The message typically announces "IP x.y.z.v is at MAC ii:ii:ii:ii:ii:ii:ii" where the MAC address is the one of the phone and the IP addresses seems to come from some predetermined list and/or the routers IP -- or it might be 0.0.0.0.
On my network, when using one of the AP's, it will send out seemingly "real" IP addresses that will clog up the main router, trigger additional traffic to poll the ARP addresses and eventually cause misfunction and loss of connectivity also for other clients on the network -- it will however heal itself after some minutes, when the ARP cache times out, just to reappear again later randomly.
On the other AP it will always announce an IP of 0.0.0.0, which is obviously incorrect -- but doesn't cause any direct malfunction.
From time to time, I've also seen incorrectly formatted ARP packages.
I've debugged this with wireshark and pcap's on my network (as I started to wonder about more frequent network problems after using this phone).
I've also tried running tcpdump on the phone itself, and have inspected the pcap from the locally captured file. That pcap does NOT contain the ARP messages, so somehow somewhere deep down the kernel or in the radio, ARP messages are triggered to be sent out (i.e. below the capture interface).
To see if you have this problem, you need to run wireshark on another device and check for traffic from your phone's MAC address. It is easy to see if you know what to look for. You cannot know if you have this problem unless you check for it -- but you might suffer weird connectivity issues from time to time also on other devices/PC's, depending on the rest of your network components, that are not immediately discernable as related to the phone.
Technically this looks similar to ARP spoofing/flooding, with similar symptoms.
Does anyone have any ideas how to fix this? I think this requires someone with kernel/network knowledge, and it is likely related to how parts of the legacy parts (binaries) are being used.
I'm initialy trying to figuring out what runs every 15 seconds on the phone, and would then like to start tracing/bisect ICS vs JB code here.
Would also be nice if someone else could confirm this -- even though the specific symptoms apparently depend on certain WiFi related parameters.
Any ideas?
For reference, I'm using the latest radio 12.69.60.29_26.17.14.11_M. But as ICS does not have this problem, it might not be related to the radio version directly.

Switching APN causes steady battery drain and excessive RILJ_ACK_WL wakelocks?

I have an S9 (SM-G960F), UK SIM-free unlocked, running the latest OTA Android 10, One UI 2.5, Baseband G960FXXUCFTJ1, Kernel 4.9.118-19869059, Build number QP1A.190711.020.G960FXXSCFTK2.
My network, Three UK, runs two APNs - the main one "three.co.uk" is a CG-NAT APN which almost all users use by default. There is a second APN, "3internet", primarily used by dongles but which is also available for general use.
The main benefit of "3internet" is that it assigns a publicly accessible IP address from Three's public IP pool, with no CG-NAT (dual NAT) - allowing you to directly access your device from the Internet. For example, you can run kWS Server and access content directly on the device's public IP assigned to the 3G/4G modem. A publicly accessible IP also reduces issues with SIP/VoIP services, which I use a lot.
A while back, I started noticing excessive battery drain - between 5 and 8% per hour, even in deep sleep. I tolerated it for a week or so while trying to figure out the root cause. Eventually I did full cache partition wipes and factory resets, and initially the device was fine, until I restored a backup from Samsung cloud. Suspecting a rogue app stuck in a sync loop, I factory reset again -- this time restoring just bare minimum of apps from Google Cloud. Interestingly, this did not restore the battery drain. I then went through the phone's settings and restored my usual customisations, including the second APN. I didn't immediately make it active.
The other week, I needed to use the "3internet" APN, so I made it active. I subsequently noticed that after switching to the "3internet" APN, battery usage suddenly increases to a steady amount, even when the device is in deep sleep. Whoah, a simple change of APN is causing battery drain?!
Examing Android battery usage screen and BetterBatteryStats for any indicative wakelocks, at first I thought it might be an app update causing issues. Things like WhatsApp and Instagram appeared to be using a higher than normal amount of battery while running backgrounded. However, doing a full delete-cache-delete-storage-then-uninstall to completely remove all questionable apps made no difference.
I could literally sit and watch my battery consumption steadily decrease, a straight diagonal line on the battery usage screen.
Changing my APN back to "three.co.uk" resulted in the battery consumption graph curving back to a flat line - nearly zero consumption in deep sleep, as it was before. In fact, even less than I was experiencing before (2-3% was normal, though I also uninstalled Facebook Lite and Instagram during this latest testing, which I've found can account for around 2% battery usage per hour).
I didn't even think to test switching between APNs to check for battery drain until I read some threads on xda, some on Reddit, but it was a forum thread concerning a South African telco - discussing possible kernel issues associated with different APNs and the symptom of excessive RILJ_ACK_WL wakelocks - which inspired me to try changing APNs on my device.
In my case, the phone was logging thousands of RILJ (Radio Interface Layer client-side socket) wakelocks during deep sleep. Once the APN was reverted to the 'default' APN - wakelocks decreased along with battery drain.
So far, changing the APN to "3internet" reliably causes the battery drain to resume. Changing it back to "three.co.uk" stops the excessive battery drain. I can observe this by changing the APN then letting the device deep sleep, then review the battery usage graph. It seems really counterintuitive, but the evidence speaks for itself I think.
Is this a Samsung-specific kernel issue, a Google location service issue or some other Android subsystem issue? Is it perhaps caused by some network-level incompatibility of how the mobile network has configured this specific APN, or is it simply a bug when any combination of multiple APNs is used on this device?
Has anyone else experienced this issue and been able to determine the exact reason for this scenario causing battery drain?
Further reading I gathered along the way...
Telkom confirms smartphone battery drain problems on LTE
Telkom does legit drain my battery quicker I had idle drain of 4.1% on my MTN Sim I have an idle drain of 0.38% Using Moto G5+ No Data Connection No or Unknown Signal these two had 100% usage on Telkom and 0.3% on MTN RILJ_ACK_WL Partial Walkelock Count 1093 on Telkom...
mybroadband.co.za
Battery drain due to RILJ. (Solved!)
Hi everybody, I have seen quite a number of users get troubled and complain about high battery drain in JB roms. Most of them have used BetterBattery or other applications and found that RILJ seems to be the culprit. But I haven't seen anyone...
forum.xda-developers.com
Android 4.4 RIL software framework
This paper mainly analyzes the command interaction process between Android 4.4 RIL's telephone and modem, but this paper does not focus on telephone.Telephone involves many specific business logic contents, including sim, dail, sms, network, etc., which will be studied and analyzed in the...
programming.vip
Android Radio Layer Interface
Android Radio Layer Interface Summary Background RIL stack overview RIL daemon (rild) Example: RIL with Mc39i on versatile Example: RIL with HUAWEI E169 on...
www.slideshare.net
christopherwoods said:
I have an S9 (SM-G960F), UK SIM-free unlocked, running the latest OTA Android 10, One UI 2.5, Baseband G960FXXUCFTJ1, Kernel 4.9.118-19869059, Build number QP1A.190711.020.G960FXXSCFTK2.
My network, Three UK, runs two APNs - the main one "three.co.uk" is a CG-NAT APN which almost all users use by default. There is a second APN, "3internet", primarily used by dongles but which is also available for general use.
The main benefit of "3internet" is that it assigns a publicly accessible IP address from Three's public IP pool, with no CG-NAT (dual NAT) - allowing you to directly access your device from the Internet. For example, you can run kWS Server and access content directly on the device's public IP assigned to the 3G/4G modem. A publicly accessible IP also reduces issues with SIP/VoIP services, which I use a lot.
A while back, I started noticing excessive battery drain - between 5 and 8% per hour, even in deep sleep. I tolerated it for a week or so while trying to figure out the root cause. Eventually I did full cache partition wipes and factory resets, and initially the device was fine, until I restored a backup from Samsung cloud. Suspecting a rogue app stuck in a sync loop, I factory reset again -- this time restoring just bare minimum of apps from Google Cloud. Interestingly, this did not restore the battery drain. I then went through the phone's settings and restored my usual customisations, including the second APN. I didn't immediately make it active.
The other week, I needed to use the "3internet" APN, so I made it active. I subsequently noticed that after switching to the "3internet" APN, battery usage suddenly increases to a steady amount, even when the device is in deep sleep. Whoah, a simple change of APN is causing battery drain?!
Examing Android battery usage screen and BetterBatteryStats for any indicative wakelocks, at first I thought it might be an app update causing issues. Things like WhatsApp and Instagram appeared to be using a higher than normal amount of battery while running backgrounded. However, doing a full delete-cache-delete-storage-then-uninstall to completely remove all questionable apps made no difference.
I could literally sit and watch my battery consumption steadily decrease, a straight diagonal line on the battery usage screen.
Changing my APN back to "three.co.uk" resulted in the battery consumption graph curving back to a flat line - nearly zero consumption in deep sleep, as it was before. In fact, even less than I was experiencing before (2-3% was normal, though I also uninstalled Facebook Lite and Instagram during this latest testing, which I've found can account for around 2% battery usage per hour).
I didn't even think to test switching between APNs to check for battery drain until I read some threads on xda, some on Reddit, but it was a forum thread concerning a South African telco - discussing possible kernel issues associated with different APNs and the symptom of excessive RILJ_ACK_WL wakelocks - which inspired me to try changing APNs on my device.
In my case, the phone was logging thousands of RILJ (Radio Interface Layer client-side socket) wakelocks during deep sleep. Once the APN was reverted to the 'default' APN - wakelocks decreased along with battery drain.
So far, changing the APN to "3internet" reliably causes the battery drain to resume. Changing it back to "three.co.uk" stops the excessive battery drain. I can observe this by changing the APN then letting the device deep sleep, then review the battery usage graph. It seems really counterintuitive, but the evidence speaks for itself I think.
Is this a Samsung-specific kernel issue, a Google location service issue or some other Android subsystem issue? Is it perhaps caused by some network-level incompatibility of how the mobile network has configured this specific APN, or is it simply a bug when any combination of multiple APNs is used on this device?
Has anyone else experienced this issue and been able to determine the exact reason for this scenario causing battery drain?
Further reading I gathered along the way...
Telkom confirms smartphone battery drain problems on LTE
Telkom does legit drain my battery quicker I had idle drain of 4.1% on my MTN Sim I have an idle drain of 0.38% Using Moto G5+ No Data Connection No or Unknown Signal these two had 100% usage on Telkom and 0.3% on MTN RILJ_ACK_WL Partial Walkelock Count 1093 on Telkom...
mybroadband.co.za
Battery drain due to RILJ. (Solved!)
Hi everybody, I have seen quite a number of users get troubled and complain about high battery drain in JB roms. Most of them have used BetterBattery or other applications and found that RILJ seems to be the culprit. But I haven't seen anyone...
forum.xda-developers.com
Android 4.4 RIL software framework
This paper mainly analyzes the command interaction process between Android 4.4 RIL's telephone and modem, but this paper does not focus on telephone.Telephone involves many specific business logic contents, including sim, dail, sms, network, etc., which will be studied and analyzed in the...
programming.vip
Android Radio Layer Interface
Android Radio Layer Interface Summary Background RIL stack overview RIL daemon (rild) Example: RIL with Mc39i on versatile Example: RIL with HUAWEI E169 on...
www.slideshare.net
Click to expand...
Click to collapse
I select this post as a candidate for the biggest TL/DR of 2020!!!!
Joking aside, the issue youre describing is explained in the first 2 paragraphs, hence why i stopped reading. Your APN that allows such access is designed for a dongle or something of the like, which is always plugged in so it doesnt care about power management. Unless you write a kernel that will observe and restrict excess draw from the radios in the phone, then its a "price you pay" situation. I had excessive draw on my OG Evo 4G back in the day because Sprint sucked here, so i used the vzw APN and i definitely noticed an increased draw from that as well. Not the same situation as youre in now, but another example of APNs messing with stuff
christopherwoods said:
I have an S9 (SM-G960F), UK SIM-free unlocked, running the latest OTA Android 10, One UI 2.5, Baseband G960FXXUCFTJ1, Kernel 4.9.118-19869059, Build number QP1A.190711.020.G960FXXSCFTK2.
My network, Three UK, runs two APNs - the main one "three.co.uk" is a CG-NAT APN which almost all users use by default. There is a second APN, "3internet", primarily used by dongles but which is also available for general use.
The main benefit of "3internet" is that it assigns a publicly accessible IP address from Three's public IP pool, with no CG-NAT (dual NAT) - allowing you to directly access your device from the Internet. For example, you can run kWS Server and access content directly on the device's public IP assigned to the 3G/4G modem. A publicly accessible IP also reduces issues with SIP/VoIP services, which I use a lot.
A while back, I started noticing excessive battery drain - between 5 and 8% per hour, even in deep sleep. I tolerated it for a week or so while trying to figure out the root cause. Eventually I did full cache partition wipes and factory resets, and initially the device was fine, until I restored a backup from Samsung cloud. Suspecting a rogue app stuck in a sync loop, I factory reset again -- this time restoring just bare minimum of apps from Google Cloud. Interestingly, this did not restore the battery drain. I then went through the phone's settings and restored my usual customisations, including the second APN. I didn't immediately make it active.
The other week, I needed to use the "3internet" APN, so I made it active. I subsequently noticed that after switching to the "3internet" APN, battery usage suddenly increases to a steady amount, even when the device is in deep sleep. Whoah, a simple change of APN is causing battery drain?!
Examing Android battery usage screen and BetterBatteryStats for any indicative wakelocks, at first I thought it might be an app update causing issues. Things like WhatsApp and Instagram appeared to be using a higher than normal amount of battery while running backgrounded. However, doing a full delete-cache-delete-storage-then-uninstall to completely remove all questionable apps made no difference.
I could literally sit and watch my battery consumption steadily decrease, a straight diagonal line on the battery usage screen.
Changing my APN back to "three.co.uk" resulted in the battery consumption graph curving back to a flat line - nearly zero consumption in deep sleep, as it was before. In fact, even less than I was experiencing before (2-3% was normal, though I also uninstalled Facebook Lite and Instagram during this latest testing, which I've found can account for around 2% battery usage per hour).
I didn't even think to test switching between APNs to check for battery drain until I read some threads on xda, some on Reddit, but it was a forum thread concerning a South African telco - discussing possible kernel issues associated with different APNs and the symptom of excessive RILJ_ACK_WL wakelocks - which inspired me to try changing APNs on my device.
In my case, the phone was logging thousands of RILJ (Radio Interface Layer client-side socket) wakelocks during deep sleep. Once the APN was reverted to the 'default' APN - wakelocks decreased along with battery drain.
So far, changing the APN to "3internet" reliably causes the battery drain to resume. Changing it back to "three.co.uk" stops the excessive battery drain. I can observe this by changing the APN then letting the device deep sleep, then review the battery usage graph. It seems really counterintuitive, but the evidence speaks for itself I think.
Is this a Samsung-specific kernel issue, a Google location service issue or some other Android subsystem issue? Is it perhaps caused by some network-level incompatibility of how the mobile network has configured this specific APN, or is it simply a bug when any combination of multiple APNs is used on this device?
Has anyone else experienced this issue and been able to determine the exact reason for this scenario causing battery drain?
Further reading I gathered along the way...
Telkom confirms smartphone battery drain problems on LTE
Telkom does legit drain my battery quicker I had idle drain of 4.1% on my MTN Sim I have an idle drain of 0.38% Using Moto G5+ No Data Connection No or Unknown Signal these two had 100% usage on Telkom and 0.3% on MTN RILJ_ACK_WL Partial Walkelock Count 1093 on Telkom...
mybroadband.co.za
Battery drain due to RILJ. (Solved!)
Hi everybody, I have seen quite a number of users get troubled and complain about high battery drain in JB roms. Most of them have used BetterBattery or other applications and found that RILJ seems to be the culprit. But I haven't seen anyone...
forum.xda-developers.com
Android 4.4 RIL software framework
This paper mainly analyzes the command interaction process between Android 4.4 RIL's telephone and modem, but this paper does not focus on telephone.Telephone involves many specific business logic contents, including sim, dail, sms, network, etc., which will be studied and analyzed in the...
programming.vip
Android Radio Layer Interface
Android Radio Layer Interface Summary Background RIL stack overview RIL daemon (rild) Example: RIL with Mc39i on versatile Example: RIL with HUAWEI E169 on...
www.slideshare.net
Click to expand...
Click to collapse
I know it's an old thread but here's what happened to me recently...
Using normal three.co.uk apn I was unable to live view my Ring doorbell or even my cctv. So I tried 3internet and using this APN everything worked perfectly fine. Shortly after changing the apn (couple of days) I noticed an increased battery drain. Like 4-5% an hour while the phone was just sitting on the table untouched. I tried all the troubleshooting including factory reset etc. But nothing was helping. The main mistake I was making was that after each factory reset I would instantly change the APN to 3internet. After changing back to three.co.uk my battery life seems to back to what it should be but... my ring doorbell live view doesn't work again. I guess I'll have to contact three and ask them wtf.
I feel like this helps to explain this issue:
https://mybroadband.co.za/news/cellular/465529-surprising-reason-air-mobile-eats-smartphone-batteries-for-breakfast-and-how-afrihost-fixed-it.html
So it's related to the APN (nothing to do with the device)
TLDR: If you have a public IP address then external internet traffic hits your device and causes it to use more battery. If you are behind carrier NAT then this external traffic never hits your device and it can enter and remain in a lower powered state

Wifi and mobile data issue after degoogling

I recently considered completely degoogling lineageos and i succeeded partly.
1. Changed the system webview to bromite webview.
2. Changed the captive portals to
https://e.foundation/net_204/
http://204.ecloud.global
3. And finally changed the timeserver to pool.ntp.org
One of these steps happened to screw up things with the wifi and mobile data.
Wifi works just fine but has a "Limited connection" label on it.
And mobile data doesnt seem to work at all.
Has anyone experienced something similar or knows the solution?
Thanks in advance for your help.
When you are on wifi, are you connecting to a router that has a custom DNS server? I get the same thing, works just fine. Scroll through your router logs and device logs to see what is times out and adjust accordingly.
I lost mobile data on a previous device (LG v20) when I moved over to LOS and was messing around with APN. Given that mobile data runs through provider's server, it might be that the server it being blocked by a content filter or similar. Also, it might be that LOS's list of default APN are not updated with current information required by your provider.
My device uses nextdns through private dns.
I was using vanilla lineageos with microg and mobile data worked fine, after these steps something seemed to have messed up. I have tried resetting APNs too, didnt work.
DNS of wifi doesnt typically affect that of LTE, but might be different in your flavor of LOS.
Look at your logs on router and device.
Private dns is DNS over TLS implementation of android, it works on both wifi and mobile data. I havent changed anything related to dns for a long time. DNS doesnt seem to be the problem.
systool sntpc -sntpRequest
I can see simple ntp client requests like this, should i be looking for something else?
I'm curious as to how many requests you are seeing. I seem to recall android should only check every few days. Hmm.
Checked logs on a rooted v20 stock N7.1 that I keep around for tv and Roku and Plex control. I wasn't able to find a ntp or sntp entry in last 7 days, the length of my log. Firewall did not report any port 123 traffic either.
Incidentally, I am using 3.android.pool.ntp.org to sync with. Not sure where that came from, I don't remember it as being such as I prefer time.nist.gov.
I don't know what could be going sideways with data other than perhaps dns not working ( does ip# work on mobile?) on mobile and degraded showing on wifi.
This may be pointless, but if wifi is turned off, are you able to send/receive a mms? I ask because mms traffic to your phone is based on IP#, but mms traffic from phone has to (typically) resolve name of mms server.
I am just about out of ideas / suggestions.
Thank you for our help mate, i fixed the issue.
Everything is back to normal after changing the captive portal to
http://captiveportal.kuketz.de
https://captiveportal.kuketz.de
The one from e foundation seemed to be the problem. This one is from a security researcher Mike Kuketz.
The captive portal wrecked mobile data too? That is surprising and interesting.
Glad to see you are up and running.
Side note, do you still see same amount of sntp activity now?
deleted

Categories

Resources