"Android OS" using huge amounts of wifi data (70+ GB)

irishpancake

Fluffy88 wrote: »

I agree with mass_debater, the best way to proceed with this is doing a packet capture at the access point. Following his advice, creating a hotspot on a PC which has Wireshark running and sharing the internet connection will give you all the info you need.

Earlier I suggested Fiddler2 for the same job, it might be a little easier to work with for someone unfamiliar (like me) with Wireshark as Fiddler hides all the protocol level traffic and only displays HTTP traffic.

Just have a look at the on-device Packet Capture app I suggested earlier, which gives decoded HTTP packets, Text/HEX, heuristic/strict toggle options and a save option....

basic, but perhaps all that's needed??

irishpancake

OK, just two more suggestions, then I'm done.....

This for packet capture, and creation of a pcap file for analysis.

https://play.google.com/store/apps/details?id=jp.co.taosoftware.android.packetcapture

https://www.youtube.com/watch?v=PjJbfYfDsX4

Then this for pcap analysis, amongst other things, if you want it on device...

https://play.google.com/store/apps/details?id=uk.co.opticiancms.wifiprobe

You will need to copy the pcap file from iPacketCapture, there is a sharing option, to the WiFispect folder, for me it's here:

/sdcard/Wi-Fi Probe/

otherwise you could upload to your laptop to wireshark, or other analyser.

yllw.ldbttr

Thanks lads, when I have a few hours over the weekend I will give the above a try, as I said, not sure how to do it so may take me some time.

Interestingly, and I'm not sure if this make it better or worse, I was in a friend's house for half an hour today and connected to their wifi.

I was only there half an hour but there seemed to be no huge data usage by Android OS, no more than 5-10 MB in half an hour where usually I'm seeing 400 - 750 MB per hour.

Not sure what to make of that to be honest.

Thargor

Did you try the simple router reset at home like I suggested? Might even be worth startig agan with a factory reset on that or borrowing another router...

yllw.ldbttr

Thargor wrote: »

Did you try the simple router reset at home like I suggested? Might even be worth startig agan with a factory reset on that or borrowing another router...

Yes, did a factory reset on the eircom router and I have two other access points in the house as well, reset both of those too in case it was an internal network problem.

mass_debater

yllw.ldbttr wrote: »

Yes, did a factory reset on the eircom router and I have two other access points in the house as well, reset both of those too in case it was an internal network problem.

Describe how you have the access points setup. Are they actual access points or have you used routers and disabled DHCP. Can more than one access point signal be picked up from the same locations in the house. I suspect you may be creating a broadcast storm

yllw.ldbttr

mass_debater wrote: »

Describe how you have the access points setup. Are they actual access points or have you used routers and disabled DHCP. Can more than one access point signal be picked up from the same locations in the house. I suspect you may be creating a broadcast storm

Eircom DSL router in utility room.
Wifi off. DHCP on.
Ethernet to a cabinet in the attic at one end of the house. Within that cabinet there's a 5 Ghz wifi router (I think it's a Securifi Almond+ if I recall correctly). DHCP switched off. It's effectively in bridging mode. Broadcasting 5Ghz and 2.4 Ghz wifi.
Ethernet from there to another router at other end of the house which is setup same, wifi on (2.4 Ghz only) DHCP off.
Approx 35 devices in the house connected at any one time. Permanent devices are given static ip outside of the DHCP range. Mobile devices DHCP. Phone uses wifi manager to switch to strongest wifi where there is a predefined differential in strength and max once every 10 mins only.
Both access points have a separate unique SSID.

mass_debater

yllw.ldbttr wrote: »

Eircom DSL router in utility room.
Wifi off. DHCP on.
Ethernet to a cabinet in the attic at one end of the house. Within that cabinet there's a 5 Ghz wifi router (I think it's a Securifi Almond+ if I recall correctly). DHCP switched off. It's effectively in bridging mode. Broadcasting 5Ghz and 2.4 Ghz wifi.
Ethernet from there to another router at other end of the house which is setup same, wifi on (2.4 Ghz only) DHCP off.
Approx 35 devices in the house connected at any one time. Permanent devices are given static ip outside of the DHCP range. Mobile devices DHCP. Phone uses wifi manager to switch to strongest wifi where there is a predefined differential in strength and max once every 10 mins only.
Both access points have a separate unique SSID.

Ok, so you're not roaming on the same SSID, may not be the issue then so. I presume it's all a one subnet. Not sure what you can try maybe disable 5ghz, see if you have the same issues with 2.4ghz only. Then do the reverse, disable 2.4ghz, see if you can narrow it down

irishpancake

yllw.ldbttr wrote: »

Thanks lads, when I have a few hours over the weekend I will give the above a try, as I said, not sure how to do it so may take me some time.

Interestingly, and I'm not sure if this make it better or worse, I was in a friend's house for half an hour today and connected to their wifi.

I was only there half an hour but there seemed to be no huge data usage by Android OS, no more than 5-10 MB in half an hour where usually I'm seeing 400 - 750 MB per hour.

Not sure what to make of that to be honest.

That's why I asked about other wifi hotspots, hotel, airport, etc.

It makes it better, cos now you know it's just when you are connected to your home BB, with this particular device and whatever apps/processes are specific to it, and not when on Mobile Data or Wifi elsewhere, and you have changed nothing on your device.....

(presumably it still happens when in Aeroplane mode, with Wifi then turned on, eliminating any possible Mobile Data...)

and your other Android, Nexus Tablet?, does not experience this phenomenon on the same network....

Having said all the above, I don't fheckin know.....weird!!

Have a nice weekend, I'm off to listen to Westmeath hammer Fermanagh

EDIT: Disgraced...congrats to Fermanagh....

yllw.ldbttr

Update.


Average hourly consumption was in the 500-600 MB region.
Weirdly, the last hour spiked at 2GB, and the only thing I noticed is that I casted three youtube videos to a Chromecast device. I have three of them in the house.

Coincidence? Maybe not. But I'm going to disconnect all of them for a few hours tomorrow and see if that makes any difference.

Clutching at straws... I know I need to do a traffic analysis but I'm a bit suspicious of installing a fake cert on my phone and I'm not technically capable of the proxy and wireshark methodology. Need to set aside some time to figure out how to do it but I'm struggling to get a few hours kid / wife free.

irishpancake

yllw.ldbttr wrote: »

Update.


Average hourly consumption was in the 500-600 MB region.
Weirdly, the last hour spiked at 2GB, and the only thing I noticed is that I casted three youtube videos to a Chromecast device. I have three of them in the house.

Coincidence? Maybe not. But I'm going to disconnect all of them for a few hours tomorrow and see if that makes any difference.

Clutching at straws... I know I need to do a traffic analysis but I'm a bit suspicious of installing a fake cert on my phone and I'm not technically capable of the proxy and wireshark methodology. Need to set aside some time to figure out how to do it but I'm struggling to get a few hours kid / wife free.

Man, you don't gotta house, you gotta Data Centre, you may be "The Cloud"....

:P

yllw.ldbttr

Small update but I tested today connecting to both a wifi hotspot (another android device) and a hotel wifi connection.
Android OS behaved normally on both connections, no large data consumption.

So, this issue involves something particular to my phone/ Google account AND my home wifi.

yllw.ldbttr

Ok, 9 pages later and if this actually has sorted it I'm gonna feel like a serious idiot for deleting 4 years of Google photos etc.

Set a static ip on my device.
Did that for both access points in the house.

30 mins later and 'Android os' has transferred no data.


If this fixes it does anyone know how I can unroot the device? I need 'Good For Enterprise' for my work email and it will not permit access from a rooted device.


Thanks again for all your help. I will update again in 24 hours if the solution is still valid.
I've no comprehension of why this happened I am just glad that it is (hopefully) sorted.

irishpancake

yllw.ldbttr wrote: »

Ok, 9 pages later and if this actually has sorted it I'm gonna feel like a serious idiot for deleting 4 years of Google photos etc.

Set a static ip on my device.
Did that for both access points in the house.

30 mins later and 'Android os' has transferred no data.


If this fixes it does anyone know how I can unroot the device? I need 'Good For Enterprise' for my work email and it will not permit access from a rooted device.


Thanks again for all your help. I will update again in 24 hours if the solution is still valid.
I've no comprehension of why this happened I am just glad that it is (hopefully) sorted.

Great, and congrats....I did suggest, but not with any great hope

irishpancake wrote: »

or just take the sim out!!

or put the phone in aeroplane mode, then reconnect wifi....to ensure no radio is operating.

I'd also give the phone a static IP, one outside your router's DHCP IP pool.

And note your phones MAC address.

Maybe use a public DNS, like Googles, instead of your providers.

For wireshark.....

Solution for GFE, maybe.... Xposed modules, worth doing anyway!!

See this:

http://repo.xposed.info/module/com.phantasm.xposed.gfesecuritypatcher

yllw.ldbttr

irishpancake wrote: »

Great, and congrats....I did suggest, but not with any great hope



Solution for GFE, maybe.... Xposed modules, worth doing anyway!!

See this:

http://repo.xposed.info/module/com.phantasm.xposed.gfesecuritypatcher

On the ball, you did too, I apologise I must have missed it.
I'm still absolutely lost as to why this happens, but I accept I may never know the reason.

Will give that apk a shot, is it just a standard app install?

yllw.ldbttr

irishpancake wrote: »

Solution for GFE, maybe.... Xposed modules, worth doing anyway!!

See this:

http://repo.xposed.info/module/com.phantasm.xposed.gfesecuritypatcher

Seems to only work up to Good v 2.7.1 although based on the play store comments Good has problems with 5.0.x which could be my issue.


Anyway, thanks all, end thread.

Thargor

Plenty of apps out there to hide root, on a phone atm but I think they're alloed on the app store so just search.

irishpancake

yllw.ldbttr wrote: »

On the ball, you did too, I apologise I must have missed it.
I'm still absolutely lost as to why this happens, but I accept I may never know the reason.

Will give that apk a shot, is it just a standard app install?

No apology needed at all, it was good craic.....:D

It was just a shot in the dark really, but glad it worked out so far....it is still a puzzle!!

You need to have the xposed framework installed for any module to work, and there are so many in the repository.....

I'm not sure of your Android version, but there will be a suitable xposed framework here, at the XDA support forum.

Also, for your device, there is info here.....OnePlusOne specific stuff.

http://www.oneplushub.net/2015/03/xposed-framework-for-oneplus-one.html

and here:

http://www.oneplushub.net/2015/04/xposed-for-lollipop.html