gstatic.com (a google domain) Connections On Stock Graphene OS On Startup

llama420

other8026 Its not available in the app list, I'll try to find a way to it.

thmf

llama420 it's under different name. Look for RemoteProvisioner.
Here's what it is:
Remote key provisioning

other8026

llama420 Settings > Apps > All apps > 3 dots in top right corner > show system > RemoteProvisioner

llama420

other8026

thmf

Thank you. I found it, but shows no network permissions, or any permissions for that matter.

thmf

llama420 That's strange. Mine has network and (understandably) sensors allowed.

llama420

thmf May be because I was throwing a bunch of adb commands at it. I'll try another reinstall and see if anything changes.

llama420

thmf Reinstalled, got network permissions and sensors back. Disabled network, logs show google:

2025-07-28 01:57:46.439 INFO TcpConnection: 10.0.0.2:60162 -> 142.250.69.99:443 Close
2025-07-28 01:57:46.638 INFO TcpConnection: 10.0.0.2:60178 -> 142.250.69.99:443 Open
2025-07-28 01:57:46.639 INFO TcpConnection: 10.0.0.2:60184 -> 142.250.69.99:443 Open
2025-07-28 01:57:47.065 INFO TcpConnection: 10.0.0.2:60178 -> 142.250.69.99:443 Close
2025-07-28 01:57:47.073 INFO TcpConnection: 10.0.0.2:60184 -> 142.250.69.99:443 Close
2025-07-28 01:57:47.185 INFO TcpConnection: 10.0.0.2:60198 -> 142.250.69.99:443 Open
2025-07-28 01:57:47.185 INFO TcpConnection: 10.0.0.2:60214 -> 142.250.69.99:443 Open
2025-07-28 01:57:47.626 INFO TcpConnection: 10.0.0.2:60214 -> 142.250.69.99:443 Close
2025-07-28 01:57:47.626 INFO TcpConnection: 10.0.0.2:60198 -> 142.250.69.99:443 Close
2025-07-28 01:57:56.585 INFO TcpConnection: 10.0.0.2:35144 -> 172.96.172.37:443 Close

New adb shell dumpsys netstats returned:

llama@PC:~/Documents/Light_Files/Troubleshooting/Monitor_Android_Connections$ adb shell dumpsys netstats
Directory:
/data/misc/apexdata/com.android.tethering/netstats
Configs:
netstats_combine_subtype_enabled=false
netstats_store_files_in_apexdata=true
netstats_import_legacy_target_attempts=1
platform legacy stats import attempts count=1
platform legacy stats import successes count=1
platform legacy stats import fallbacks count=0
enable_network_stats_event_logger: true
netstats_fastdatainput_target_attempts=0
FastDataInput successes=0
FastDataInput fallbacks=0
trafficstats.service.cache.isenabled=true
trafficstats_cache_expiry_duration_ms=1000
trafficstats_cache_max_entries=400
trafficstats.client.cache.config=TrafficStatsRateLimitCacheConfig{isCacheEnabled: false, expiryDurationMs: 1000, maxEntries: 400}
Active interfaces:
iface=tun0 ident=[{type=17, ratType=COMBINED, metered=true, defaultNetwork=true, oemManaged=OEM_NONE, subId=-1}]
Active UID interfaces:
iface=tun0 ident=[{type=17, ratType=COMBINED, metered=true, defaultNetwork=true, oemManaged=OEM_NONE, subId=-1}]
All wifi interfaces:

All mobile interfaces:

Top openSession callers:
{uid=1000,package=android}=18
{uid=1000,package=com.android.settings}=8

Poll counts per reason:
DUMPSYS: 0
FORCE_UPDATE: 1
GLOBAL_ALERT: 0
NETWORK_STATUS_CHANGED: 2
OPEN_SESSION: 8
PERIODIC: 1
RAT_CHANGED: 0
REG_CALLBACK: 2
REMOVE_UIDS: 0
UPSTREAM_CHANGED: 1

Recent poll events:
2025-07-28T01:58:41.821040 - Poll(flags=1, PollEvent{reason=NETWORK_STATUS_CHANGED})
2025-07-28T01:57:44.349516 - Poll(flags=1, PollEvent{reason=NETWORK_STATUS_CHANGED})
2025-07-28T01:56:38.366613 - Poll(flags=3, PollEvent{reason=OPEN_SESSION})
2025-07-28T01:56:38.357899 - Poll(flags=3, PollEvent{reason=OPEN_SESSION})
2025-07-28T01:56:38.333149 - Poll(flags=3, PollEvent{reason=OPEN_SESSION})
2025-07-28T01:56:38.313081 - Poll(flags=3, PollEvent{reason=OPEN_SESSION})
2025-07-28T01:56:31.130395 - Poll(flags=3, PollEvent{reason=OPEN_SESSION})
2025-07-28T01:56:31.121672 - Poll(flags=3, PollEvent{reason=OPEN_SESSION})
2025-07-28T01:56:02.249376 - Poll(flags=3, PollEvent{reason=PERIODIC})
2025-07-28T05:55:22.147681 - Poll(flags=3, PollEvent{reason=OPEN_SESSION})
2025-07-28T05:55:22.104560 - Poll(flags=3, PollEvent{reason=OPEN_SESSION})
2025-07-28T05:55:17.377586 - Poll(flags=1, PollEvent{reason=UPSTREAM_CHANGED})
2025-07-28T05:55:15.647847 - Poll(flags=3, PollEvent{reason=FORCE_UPDATE})
2025-07-28T05:55:15.463366 - Poll(flags=3, PollEvent{reason=REG_CALLBACK})
2025-07-28T05:55:15.460311 - Poll(flags=3, PollEvent{reason=REG_CALLBACK})

Stats Providers:
OffloadController Xt:
NetworkStats: elapsedRealtime=0
BpfCoordinator Xt:
NetworkStats: elapsedRealtime=0
ImsPhoneCallTracker Xt:
NetworkStats: elapsedRealtime=0
ImsPhoneCallTracker Xt:
NetworkStats: elapsedRealtime=0

Stats Observers:
RequestInfo from pid/uid:1357/1000(android) for DataUsageRequest [ requestId=1, networkTemplate=NetworkTemplate: matchRule=MOBILE, matchSubscriberIds=[], matchWifiNetworkKeys=[], thresholdInBytes=0 ] accessLevel:3
RequestInfo from pid/uid:1357/1000(android) for DataUsageRequest [ requestId=2, networkTemplate=NetworkTemplate: matchRule=WIFI, matchSubscriberIds=[], matchWifiNetworkKeys=[], thresholdInBytes=0 ] accessLevel:3

Dev stats:
Pending bytes:
History since boot:
Xt stats:
Pending bytes: 129514
History since boot:
ident=[{type=17, ratType=COMBINED, metered=true, defaultNetwork=true, oemManaged=OEM_NONE, subId=-1}] uid=-1 set=ALL tag=0x0
NetworkStatsHistory: bucketDuration=3600
st=1753678800 rb=113427 rp=178 tb=16087 tp=151 op=0

InterfaceMapHelper:
BPF map status:
IfaceIndexNameMap: OK
BPF map content:
IfaceIndexNameMap:
ifaceIndex=49 ifaceName=tun0
ifaceIndex=2 ifaceName=dummy0

BPF map status:
mCookieTagMap: OK
mUidCounterSetMap: OK
mAppUidStatsMap: OK
mStatsMapA: OK
mStatsMapB: OK
mIfaceStatsMap: OK

BPF map content:
mCookieTagMap:
mUidCounterSetMap:
uid=10133 set=1
uid=1001 set=1
uid=10144 set=1
uid=1073 set=1
uid=10165 set=1
uid=1068 set=1
uid=10113 set=1
uid=10150 set=1
uid=10143 set=1
uid=1027 set=1
uid=10141 set=1
uid=10139 set=1
uid=10145 set=1
uid=10163 set=1
uid=1000 set=1
mAppUidStatsMap:
uid rxBytes rxPackets txBytes txPackets
10060 4956 11 1095 13
1051 14323 30 5111 34
1000 92907 119 8928 87
10068 360 9 200 5
1021 881 9 609 9
0 0 0 584 11
mStatsMapA:
ifaceIndex ifaceName tag_hex uid_int cnt_set rxBytes rxPackets txBytes txPackets
2 dummy0 0x0 0 0 0 0 56 1
mStatsMapB:
ifaceIndex ifaceName tag_hex uid_int cnt_set rxBytes rxPackets txBytes txPackets
mIfaceStatsMap:
ifaceIndex ifaceName rxBytes rxPackets txBytes txPackets
2 dummy0 0 0 392 7
49 tun0 113427 178 16135 152

SkDestroyListener logs:

NetworkStatsFactory logs:
Top distinct tag counts in UidTagSets:
1000=2
1021=1
1051=1
10060=1

Possible culprits notably don't include com.android.rkpdapp:

adb shell cmd package list packages --uid 10068
package:com.android.providers.downloads.ui uid:10068
package:com.android.providers.media uid:10068
package:com.android.soundpicker uid:10068
package:com.android.providers.downloads uid:10068
package:com.android.mtp uid:10068

adb shell cmd package list packages --uid 1000
package:com.android.localtransport uid:1000
package:com.google.pixel.camera.services uid:1000
package:android uid:1000
package:com.android.dynsystem uid:1000
package:com.google.pixel.iwlan uid:1000
package:com.android.inputdevices uid:1000
package:com.android.qns uid:1000
package:com.google.android.iwlan uid:1000
package:com.android.location.fused uid:1000
package:com.android.settings uid:1000
package:com.android.DeviceAsWebcam uid:1000
package:com.android.keychain uid:1000
package:com.android.server.telecom uid:1000
package:com.android.providers.settings uid:1000

adb shell cmd package list packages --uid 10060
package:app.seamlessupdate.client uid:10060

other8026

This report is being taken seriously despite the way it's been reported.

People really need to stop being rude to one another. If certain members are repeatedly rude, I will consider suspending them for a day or two.

@llama420 I've already said this once to you and you even admitted to coming off as abrasive. Even if your report is true, you cannot keep acting this way in our community. Please hold tight while this is looked into further.

Sigismund

other8026 People really need to stop being rude to one another

I really don't see how my comment came out "rude" given the way the OP responds.. I mean deleting posts just because you tell OP his attitude is crap is a bit overreacting, but hey if that's how you want to moderate who am I to argue.

llama420

other8026 I've been cool with you man, it's this Sigismund dude that's annoying me and has been rude to me. Never wanted to be rude to you. I apologize to you for being abrasive in my original post, but the discussion afterwards should be focused on the actual issue rather than petty arguments over how it was brought up.

GrapheneOS

@llama420 It appears you have either "Attestation key provisioning" or "Widevine provisioning" configured to use "Google server" instead of "GrapheneOS proxy". To rule out any kind of strange issue with the user interface, try setting both to "Google server" and back to "GrapheneOS proxy" and reboot your device.

llama420

GrapheneOS It is all default options. All Graphene proxies. Reinstalled and reproduced a few times now.

DeletedUser495

llama420 if you have managed to reproduce then show us your findings in a manner average user would understand or drop it.

llama420

DeletedUser495 I have. What more do you want? I have a pcap now but just can't see how to post it up.

llama420

DeletedUser495 I even explained how to reproduce it yourself in a manner you can understand.

llama420

Well, here's the raw pcap log since I can't seem to attach files here. Only targeted the google IP 142.250.69.99. Running this without my phone in reverse tethering shows no connections to this IP.

1 0.000000 10.2.0.2 142.250.69.99 TCP 80 53386 → 443 [SYN] Seq=0 Win=64860 Len=0 MSS=1380 SACK_PERM TSval=842624526 TSecr=0 WS=128
2 0.039130 142.250.69.99 10.2.0.2 TCP 80 443 → 53386 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1360 SACK_PERM TSval=1145659709 TSecr=842624526 WS=256
3 0.039200 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=1 Ack=1 Win=64896 Len=0 TSval=842624566 TSecr=1145659709
4 0.070852 10.2.0.2 142.250.69.99 TLSv1.3 589 Client Hello (SNI=www.gstatic.com)
5 0.108987 142.250.69.99 10.2.0.2 TCP 72 443 → 53386 [ACK] Seq=1 Ack=518 Win=64768 Len=0 TSval=1145659779 TSecr=842624598
6 0.131534 142.250.69.99 10.2.0.2 TLSv1.3 1420 Server Hello, Change Cipher Spec
7 0.131586 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=518 Ack=1349 Win=66944 Len=0 TSval=842624658 TSecr=1145659801
8 0.131605 142.250.69.99 10.2.0.2 TCP 124 443 → 53386 [PSH, ACK] Seq=1349 Ack=518 Win=64768 Len=52 TSval=1145659801 TSecr=842624598 [TCP PDU reassembled in 12]
9 0.131605 142.250.69.99 10.2.0.2 TCP 1420 443 → 53386 [ACK] Seq=1401 Ack=518 Win=64768 Len=1348 TSval=1145659801 TSecr=842624598 [TCP PDU reassembled in 12]
10 0.131620 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=518 Ack=1401 Win=66944 Len=0 TSval=842624658 TSecr=1145659801
11 0.131675 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=518 Ack=2749 Win=69760 Len=0 TSval=842624658 TSecr=1145659801
12 0.169178 142.250.69.99 10.2.0.2 TLSv1.3 160 Application Data
13 0.169227 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=518 Ack=2837 Win=69760 Len=0 TSval=842624696 TSecr=1145659839
14 0.190423 10.2.0.2 142.250.69.99 TLSv1.3 136 Change Cipher Spec, Application Data
15 0.272788 142.250.69.99 10.2.0.2 TCP 72 443 → 53386 [ACK] Seq=2837 Ack=582 Win=64768 Len=0 TSval=1145659943 TSecr=842624717
16 0.272808 10.2.0.2 142.250.69.99 TLSv1.3 320 Application Data
17 0.311036 142.250.69.99 10.2.0.2 TCP 72 443 → 53386 [ACK] Seq=2837 Ack=830 Win=64768 Len=0 TSval=1145659981 TSecr=842624800
18 0.319619 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
19 0.319665 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
20 0.319696 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=830 Ack=4885 Win=74496 Len=0 TSval=842624846 TSecr=1145659989
21 0.319752 142.250.69.99 10.2.0.2 TLSv1.3 205 Application Data
22 0.319752 142.250.69.99 10.2.0.2 TCP 72 443 → 53386 [FIN, ACK] Seq=5018 Ack=830 Win=64768 Len=0 TSval=1145659989 TSecr=842624800
23 0.344035 10.2.0.2 142.250.69.99 TLSv1.3 96 Application Data
24 0.344997 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [FIN, ACK] Seq=854 Ack=5019 Win=76544 Len=0 TSval=842624872 TSecr=1145659989
25 0.380864 142.250.69.99 10.2.0.2 TCP 72 443 → 53386 [ACK] Seq=5019 Ack=855 Win=64768 Len=0 TSval=1145660051 TSecr=842624871
26 0.387195 10.2.0.2 142.250.69.99 TCP 80 53392 → 443 [SYN] Seq=0 Win=64860 Len=0 MSS=1380 SACK_PERM TSval=842624914 TSecr=0 WS=128
27 0.425116 142.250.69.99 10.2.0.2 TCP 80 443 → 53392 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1360 SACK_PERM TSval=1145660095 TSecr=842624914 WS=256
28 0.425136 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=1 Ack=1 Win=64896 Len=0 TSval=842624952 TSecr=1145660095
29 0.434193 10.2.0.2 142.250.69.99 TLSv1.3 589 Client Hello (SNI=www.gstatic.com)
30 0.472930 142.250.69.99 10.2.0.2 TCP 72 443 → 53392 [ACK] Seq=1 Ack=518 Win=64768 Len=0 TSval=1145660141 TSecr=842624961
31 0.495261 142.250.69.99 10.2.0.2 TLSv1.3 1420 Server Hello, Change Cipher Spec
32 0.495313 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=518 Ack=1349 Win=66944 Len=0 TSval=842625022 TSecr=1145660165
33 0.495326 142.250.69.99 10.2.0.2 TCP 1420 443 → 53392 [PSH, ACK] Seq=1349 Ack=518 Win=64768 Len=1348 TSval=1145660165 TSecr=842624961 [TCP PDU reassembled in 35]
34 0.495341 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=518 Ack=2697 Win=69760 Len=0 TSval=842625022 TSecr=1145660165
35 0.495354 142.250.69.99 10.2.0.2 TLSv1.3 212 Application Data
36 0.495365 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=518 Ack=2837 Win=72448 Len=0 TSval=842625022 TSecr=1145660165
37 0.536094 10.2.0.2 142.250.69.99 TLSv1.3 136 Change Cipher Spec, Application Data
38 0.616794 142.250.69.99 10.2.0.2 TCP 72 443 → 53392 [ACK] Seq=2837 Ack=582 Win=64768 Len=0 TSval=1145660287 TSecr=842625063
39 0.616805 10.2.0.2 142.250.69.99 TLSv1.3 320 Application Data
40 0.655117 142.250.69.99 10.2.0.2 TCP 72 443 → 53392 [ACK] Seq=2837 Ack=830 Win=64768 Len=0 TSval=1145660325 TSecr=842625144
41 0.663553 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
42 0.663578 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=830 Ack=3861 Win=75136 Len=0 TSval=842625190 TSecr=1145660333
43 0.663587 142.250.69.99 10.2.0.2 TCP 448 443 → 53392 [PSH, ACK] Seq=3861 Ack=830 Win=64768 Len=376 TSval=1145660333 TSecr=842625144 [TCP PDU reassembled in 45]
44 0.663593 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=830 Ack=4237 Win=77824 Len=0 TSval=842625190 TSecr=1145660333
45 0.663746 142.250.69.99 10.2.0.2 TLSv1.3 786 Application Data, Application Data
46 0.695447 10.2.0.2 142.250.69.99 TLSv1.3 96 Application Data
47 0.695472 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [FIN, ACK] Seq=854 Ack=4952 Win=80000 Len=0 TSval=842625222 TSecr=1145660334
48 0.727452 10.2.0.2 142.250.69.99 TCP 80 53404 → 443 [SYN] Seq=0 Win=64860 Len=0 MSS=1380 SACK_PERM TSval=842625254 TSecr=0 WS=128
49 0.733212 142.250.69.99 10.2.0.2 TCP 72 443 → 53392 [ACK] Seq=4952 Ack=855 Win=64768 Len=0 TSval=1145660403 TSecr=842625222
50 0.764776 142.250.69.99 10.2.0.2 TCP 80 443 → 53404 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1360 SACK_PERM TSval=1145660435 TSecr=842625254 WS=256
51 0.764796 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=1 Ack=1 Win=64896 Len=0 TSval=842625292 TSecr=1145660435
52 0.768349 10.2.0.2 142.250.69.99 TLSv1.3 589 Client Hello (SNI=www.gstatic.com)
53 0.805209 142.250.69.99 10.2.0.2 TCP 72 443 → 53404 [ACK] Seq=1 Ack=518 Win=64768 Len=0 TSval=1145660475 TSecr=842625295
54 0.833680 142.250.69.99 10.2.0.2 TLSv1.3 1420 Server Hello, Change Cipher Spec
55 0.833734 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=518 Ack=1349 Win=66944 Len=0 TSval=842625360 TSecr=1145660503
56 0.833765 142.250.69.99 10.2.0.2 TCP 124 443 → 53404 [PSH, ACK] Seq=1349 Ack=518 Win=64768 Len=52 TSval=1145660503 TSecr=842625295 [TCP PDU reassembled in 60]
57 0.833765 142.250.69.99 10.2.0.2 TCP 1420 443 → 53404 [ACK] Seq=1401 Ack=518 Win=64768 Len=1348 TSval=1145660503 TSecr=842625295 [TCP PDU reassembled in 60]
58 0.833783 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=518 Ack=1401 Win=66944 Len=0 TSval=842625361 TSecr=1145660503
59 0.833839 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=518 Ack=2749 Win=69760 Len=0 TSval=842625361 TSecr=1145660503
60 0.871030 142.250.69.99 10.2.0.2 TLSv1.3 160 Application Data
61 0.871079 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=518 Ack=2837 Win=69760 Len=0 TSval=842625398 TSecr=1145660541
62 0.880823 10.2.0.2 142.250.69.99 TLSv1.3 136 Change Cipher Spec, Application Data
63 0.964718 142.250.69.99 10.2.0.2 TCP 72 443 → 53404 [ACK] Seq=2837 Ack=582 Win=64768 Len=0 TSval=1145660635 TSecr=842625408
64 0.964780 10.2.0.2 142.250.69.99 TLSv1.3 323 Application Data
65 1.007599 142.250.69.99 10.2.0.2 TCP 72 443 → 53404 [ACK] Seq=2837 Ack=833 Win=64768 Len=0 TSval=1145660677 TSecr=842625492
66 1.016987 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
67 1.017050 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
68 1.017051 142.250.69.99 10.2.0.2 TLSv1.3 153 Application Data
69 1.017087 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=833 Ack=4885 Win=74496 Len=0 TSval=842625544 TSecr=1145660687
70 1.017809 142.250.69.99 10.2.0.2 TCP 72 443 → 53404 [FIN, ACK] Seq=4966 Ack=833 Win=64768 Len=0 TSval=1145660688 TSecr=842625492
71 1.029101 10.2.0.2 142.250.69.99 TLSv1.3 96 Application Data
72 1.030316 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [FIN, ACK] Seq=857 Ack=4967 Win=74496 Len=0 TSval=842625557 TSecr=1145660687
73 1.055888 10.2.0.2 142.250.69.99 TCP 80 53420 → 443 [SYN] Seq=0 Win=64860 Len=0 MSS=1380 SACK_PERM TSval=842625582 TSecr=0 WS=128
74 1.067376 142.250.69.99 10.2.0.2 TCP 72 443 → 53404 [ACK] Seq=4967 Ack=858 Win=64768 Len=0 TSval=1145660737 TSecr=842625556
75 1.094763 142.250.69.99 10.2.0.2 TCP 80 443 → 53420 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1360 SACK_PERM TSval=1145660765 TSecr=842625582 WS=256
76 1.094782 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=1 Ack=1 Win=64896 Len=0 TSval=842625622 TSecr=1145660765
77 1.098399 10.2.0.2 142.250.69.99 TLSv1.3 589 Client Hello (SNI=www.gstatic.com)
78 1.137552 142.250.69.99 10.2.0.2 TCP 72 443 → 53420 [ACK] Seq=1 Ack=518 Win=64768 Len=0 TSval=1145660807 TSecr=842625625
79 1.164657 142.250.69.99 10.2.0.2 TLSv1.3 1420 Server Hello, Change Cipher Spec
80 1.164713 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=518 Ack=1349 Win=66944 Len=0 TSval=842625691 TSecr=1145660834
81 1.164762 142.250.69.99 10.2.0.2 TCP 124 443 → 53420 [PSH, ACK] Seq=1349 Ack=518 Win=64768 Len=52 TSval=1145660834 TSecr=842625625 [TCP PDU reassembled in 85]
82 1.164762 142.250.69.99 10.2.0.2 TCP 1420 443 → 53420 [ACK] Seq=1401 Ack=518 Win=64768 Len=1348 TSval=1145660834 TSecr=842625625 [TCP PDU reassembled in 85]
83 1.164793 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=518 Ack=1401 Win=66944 Len=0 TSval=842625692 TSecr=1145660834
84 1.164816 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=518 Ack=2749 Win=69760 Len=0 TSval=842625692 TSecr=1145660834
85 1.203645 142.250.69.99 10.2.0.2 TLSv1.3 161 Application Data
86 1.203695 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=518 Ack=2838 Win=69760 Len=0 TSval=842625730 TSecr=1145660873
87 1.264446 10.2.0.2 142.250.69.99 TLSv1.3 136 Change Cipher Spec, Application Data
88 1.318346 10.2.0.2 142.250.69.99 TCP 80 53424 → 443 [SYN] Seq=0 Win=64860 Len=0 MSS=1380 SACK_PERM TSval=842625845 TSecr=0 WS=128
89 1.348863 142.250.69.99 10.2.0.2 TCP 72 443 → 53420 [ACK] Seq=2838 Ack=582 Win=64768 Len=0 TSval=1145661019 TSecr=842625791
90 1.348876 10.2.0.2 142.250.69.99 TLSv1.3 321 Application Data
91 1.356922 142.250.69.99 10.2.0.2 TCP 80 443 → 53424 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1360 SACK_PERM TSval=1145661027 TSecr=842625845 WS=256
92 1.356942 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=1 Ack=1 Win=64896 Len=0 TSval=842625884 TSecr=1145661027
93 1.364401 10.2.0.2 142.250.69.99 TLSv1.3 589 Client Hello (SNI=www.gstatic.com)
94 1.387064 142.250.69.99 10.2.0.2 TCP 72 443 → 53420 [ACK] Seq=2838 Ack=831 Win=64768 Len=0 TSval=1145661057 TSecr=842625876
95 1.400902 142.250.69.99 10.2.0.2 TCP 72 443 → 53424 [ACK] Seq=1 Ack=518 Win=64768 Len=0 TSval=1145661071 TSecr=842625891
96 1.403192 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
97 1.403249 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=3862 Win=72448 Len=0 TSval=842625930 TSecr=1145661073
98 1.403286 142.250.69.99 10.2.0.2 TLSv1.3 1012 Application Data
99 1.403287 142.250.69.99 10.2.0.2 TLSv1.3 2120 Application Data
100 1.403287 142.250.69.99 10.2.0.2 TLSv1.3 2282 Application Data, Application Data
101 1.403287 142.250.69.99 10.2.0.2 TCP 1096 443 → 53420 [PSH, ACK] Seq=9060 Ack=831 Win=64768 Len=1024 TSval=1145661073 TSecr=842625876 [TCP PDU reassembled in 104]
102 1.403325 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=4802 Win=75136 Len=0 TSval=842625930 TSecr=1145661073
103 1.403383 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=10084 Win=75136 Len=0 TSval=842625930 TSecr=1145661073
104 1.405299 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
105 1.405339 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=11108 Win=77824 Len=0 TSval=842625932 TSecr=1145661075
106 1.405363 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
107 1.405382 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=12132 Win=78848 Len=0 TSval=842625932 TSecr=1145661075
108 1.407335 142.250.69.99 10.2.0.2 TCP 1096 443 → 53420 [ACK] Seq=12132 Ack=831 Win=64768 Len=1024 TSval=1145661077 TSecr=842625876 [TCP PDU reassembled in 110]
109 1.407388 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=13156 Win=79872 Len=0 TSval=842625934 TSecr=1145661077
110 1.407413 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
111 1.407427 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=14180 Win=78848 Len=0 TSval=842625934 TSecr=1145661077
112 1.409410 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
113 1.409460 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=15204 Win=79872 Len=0 TSval=842625936 TSecr=1145661079
114 1.409479 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
115 1.409492 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=16228 Win=78848 Len=0 TSval=842625936 TSecr=1145661079
116 1.425617 142.250.69.99 10.2.0.2 TLSv1.3 1420 Server Hello, Change Cipher Spec
117 1.425669 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=518 Ack=1349 Win=66944 Len=0 TSval=842625952 TSecr=1145661095
118 1.425688 142.250.69.99 10.2.0.2 TCP 124 443 → 53424 [PSH, ACK] Seq=1349 Ack=518 Win=64768 Len=52 TSval=1145661095 TSecr=842625891 [TCP PDU reassembled in 148]
119 1.425689 142.250.69.99 10.2.0.2 TCP 1420 443 → 53424 [ACK] Seq=1401 Ack=518 Win=64768 Len=1348 TSval=1145661095 TSecr=842625891 [TCP PDU reassembled in 148]
120 1.425749 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=518 Ack=2749 Win=69760 Len=0 TSval=842625952 TSecr=1145661095
121 1.441118 142.250.69.99 10.2.0.2 TCP 1096 443 → 53420 [ACK] Seq=16228 Ack=831 Win=64768 Len=1024 TSval=1145661111 TSecr=842625930 [TCP PDU reassembled in 123]
122 1.441164 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=17252 Win=79872 Len=0 TSval=842625968 TSecr=1145661111
123 1.441188 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
124 1.441188 142.250.69.99 10.2.0.2 TLSv1.3 1339 Application Data
125 1.441203 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=18276 Win=78848 Len=0 TSval=842625968 TSecr=1145661111
126 1.441218 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=19543 Win=77696 Len=0 TSval=842625968 TSecr=1145661112
127 1.443435 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
128 1.443486 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=20729 Win=82304 Len=0 TSval=842625970 TSecr=1145661113
129 1.443506 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
130 1.443523 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=21915 Win=84736 Len=0 TSval=842625970 TSecr=1145661113
131 1.446254 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
132 1.446304 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=23101 Win=87040 Len=0 TSval=842625973 TSecr=1145661116
133 1.446327 142.250.69.99 10.2.0.2 TCP 1258 443 → 53420 [PSH, ACK] Seq=23101 Ack=831 Win=64768 Len=1186 TSval=1145661116 TSecr=842625930 [TCP PDU reassembled in 135]
134 1.446340 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=24287 Win=89472 Len=0 TSval=842625973 TSecr=1145661116
135 1.448148 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
136 1.448196 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=25473 Win=91776 Len=0 TSval=842625975 TSecr=1145661118
137 1.448227 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
138 1.448250 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=26659 Win=94208 Len=0 TSval=842625975 TSecr=1145661118
139 1.450997 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
140 1.451050 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=27845 Win=96640 Len=0 TSval=842625978 TSecr=1145661120
141 1.451062 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
142 1.451075 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=29031 Win=98944 Len=0 TSval=842625978 TSecr=1145661120
143 1.452984 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
144 1.452993 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=30217 Win=101376 Len=0 TSval=842625980 TSecr=1145661123
145 1.452997 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
146 1.452999 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=31403 Win=103680 Len=0 TSval=842625980 TSecr=1145661123
147 1.455272 142.250.69.99 10.2.0.2 TLSv1.3 288 Application Data
148 1.462984 142.250.69.99 10.2.0.2 TLSv1.3 159 Application Data
149 1.462993 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=518 Ack=2836 Win=69760 Len=0 TSval=842625990 TSecr=1145661133
150 1.464921 10.2.0.2 142.250.69.99 TLSv1.3 96 Application Data
151 1.465932 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [FIN, ACK] Seq=855 Ack=31620 Win=106112 Len=0 TSval=842625993 TSecr=1145661125
152 1.493165 10.2.0.2 142.250.69.99 TLSv1.3 136 Change Cipher Spec, Application Data
153 1.502826 142.250.69.99 10.2.0.2 TCP 72 443 → 53420 [ACK] Seq=31620 Ack=856 Win=64768 Len=0 TSval=1145661173 TSecr=842625992
154 1.572757 142.250.69.99 10.2.0.2 TCP 72 443 → 53424 [ACK] Seq=2836 Ack=582 Win=64768 Len=0 TSval=1145661243 TSecr=842626020
155 1.572805 10.2.0.2 142.250.69.99 TLSv1.3 324 Application Data
156 1.611005 142.250.69.99 10.2.0.2 TCP 72 443 → 53424 [ACK] Seq=2836 Ack=834 Win=64768 Len=0 TSval=1145661281 TSecr=842626100
157 1.621024 142.250.69.99 10.2.0.2 TLSv1.3 2036 Application Data, Application Data
158 1.621024 142.250.69.99 10.2.0.2 TCP 1096 443 → 53424 [ACK] Seq=4800 Ack=834 Win=64768 Len=1024 TSval=1145661291 TSecr=842626100 [TCP PDU reassembled in 160]
159 1.621082 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=4800 Win=73728 Len=0 TSval=842626148 TSecr=1145661291
160 1.621113 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
161 1.621122 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
162 1.621141 142.250.69.99 10.2.0.2 TLSv1.3 2120 Application Data
163 1.621160 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=8034 Win=76032 Len=0 TSval=842626148 TSecr=1145661291
164 1.621187 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=10082 Win=76288 Len=0 TSval=842626148 TSecr=1145661291
165 1.623138 142.250.69.99 10.2.0.2 TLSv1.3 2120 Application Data, Application Data
166 1.623189 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=12130 Win=78336 Len=0 TSval=842626150 TSecr=1145661293
167 1.625202 142.250.69.99 10.2.0.2 TCP 1096 443 → 53424 [ACK] Seq=12130 Ack=834 Win=64768 Len=1024 TSval=1145661295 TSecr=842626100 [TCP PDU reassembled in 168]
168 1.625243 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
169 1.625264 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=14178 Win=78336 Len=0 TSval=842626152 TSecr=1145661295
170 1.627183 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
171 1.627223 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
172 1.627244 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=16226 Win=78336 Len=0 TSval=842626154 TSecr=1145661297
173 1.658884 142.250.69.99 10.2.0.2 TCP 1096 443 → 53424 [ACK] Seq=16226 Ack=834 Win=64768 Len=1024 TSval=1145661329 TSecr=842626148 [TCP PDU reassembled in 174]
174 1.658937 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
175 1.658937 142.250.69.99 10.2.0.2 TLSv1.3 1339 Application Data
176 1.658960 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=18274 Win=78336 Len=0 TSval=842626186 TSecr=1145661329
177 1.662274 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
178 1.662316 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=20727 Win=81792 Len=0 TSval=842626189 TSecr=1145661330
179 1.662335 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
180 1.663618 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
181 1.663669 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=23099 Win=86528 Len=0 TSval=842626190 TSecr=1145661332
182 1.663692 142.250.69.99 10.2.0.2 TCP 1258 443 → 53424 [PSH, ACK] Seq=23099 Ack=834 Win=64768 Len=1186 TSval=1145661333 TSecr=842626150 [TCP PDU reassembled in 183]
183 1.665897 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
184 1.665949 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=25471 Win=91392 Len=0 TSval=842626193 TSecr=1145661333
185 1.665962 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
186 1.668234 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
187 1.668284 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=27843 Win=96128 Len=0 TSval=842626195 TSecr=1145661336
188 1.668303 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
189 1.670611 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
190 1.670656 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=30215 Win=100864 Len=0 TSval=842626197 TSecr=1145661338
191 1.670675 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
192 1.672972 142.250.69.99 10.2.0.2 TCP 1258 443 → 53424 [ACK] Seq=31401 Ack=834 Win=64768 Len=1186 TSval=1145661343 TSecr=842626154 [TCP PDU reassembled in 194]
193 1.673021 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=32587 Win=105600 Len=0 TSval=842626200 TSecr=1145661340
194 1.673036 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
195 1.675316 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
196 1.675364 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=34959 Win=110336 Len=0 TSval=842626202 TSecr=1145661343
197 1.675385 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
198 1.677677 142.250.69.99 10.2.0.2 TLSv1.3 1168 Application Data, Application Data
199 1.677745 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=37242 Win=112128 Len=0 TSval=842626204 TSecr=1145661345
200 1.714299 10.2.0.2 142.250.69.99 TLSv1.3 96 Application Data
201 1.714409 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [FIN, ACK] Seq=858 Ack=37242 Win=112128 Len=0 TSval=842626241 TSecr=1145661345
202 1.751216 142.250.69.99 10.2.0.2 TCP 72 443 → 53424 [ACK] Seq=37242 Ack=859 Win=64768 Len=0 TSval=1145661421 TSecr=842626241

GrapheneOS

@llama420 Which applications have you installed? Are you using something like Netflix? There's lack of an indication that this connection is made by the OS rather than an app.

llama420

GrapheneOS Thank you for replying. These connections occur with nothing installed on the phone after a reboot/reinstall with nothing else running. Gnirehtet is installed via the adb connection to make reverse tethering work, but it doesn't consistently report these IPs, leading me to believe it's not the fault of that app. Its source code can be found here: https://github.com/Genymobile/gnirehtet. This IP mainly seems to connect after a reboot during the first connection with some occasional exceptions.

GrapheneOS

If you use an app like Netflix and it causes our RemoteProvisioning app to connect to our Widevine provisoning proxy followed by the app connecting to a Google API, that's not an OS issue. It's the app choosing to connect to a Google API. An app connecting to a Google API is not a GrapheneOS issue.

llama420

GrapheneOS This is the script I use to run it:
#!/bin/bash

GNIREHTET="./gnirehtet"
ADB=$(command -v adb)

if [ -z "$ADB" ]; then
echo "[!] 'adb' is not installed."
read -p "Install adb now using apt? (y/n): " ADB_INSTALL
if [[ "$ADB_INSTALL" =~ ^[Yy]$ ]]; then
sudo apt update && sudo apt install -y adb
ADB=$(command -v adb)
if [ -z "$ADB" ]; then
echo "[!] Failed to install adb. Exiting."
exit 1
fi
else
echo "[!] Cannot continue without adb. Exiting."
exit 1
fi
fi

DEVICE=$($ADB devices | grep -w "device" | awk '{print $1}')
if [ -z "$DEVICE" ]; then
echo "[!] No device detected."
echo " Make sure USB debugging is enabled and the device is authorized."
read -p "Press Enter to retry..."
DEVICE=$($ADB devices | grep -w "device" | awk '{print $1}')
if [ -z "$DEVICE" ]; then
echo "[!] Still no device detected. Aborting."
exit 1
fi
fi

echo "[+] Device detected: $DEVICE"

echo "[] Checking if gnirehtet START activity is available..."
$ADB -s "$DEVICE" shell cmd package resolve-activity --brief com.genymobile.gnirehtet.START | grep -q com.genymobile.gnirehtet
if [ $? -ne 0 ]; then
echo "[!] Gnirehtet app is not installed or broken."
read -p "Reinstall it now? (y/n): " INSTALL_CHOICE
if [[ "$INSTALL_CHOICE" =~ ^[Yy]$ ]]; then
echo "[] Installing gnirehtet APK..."
$GNIREHTET install
else
echo "[!] Cannot continue without a working gnirehtet client. Exiting."
exit 1
fi
else
echo "[+] Gnirehtet app is installed and functional."
fi

echo "Make sure the existing VPN always on/kill switch is disabled."
read -p "Press enter to link in."

echo "[*] Starting gnirehtet..."
$GNIREHTET run

llama420

GrapheneOS Just wanted to throw it out there since I led in kind of rudely. I genuinely do like your OS, even with this issue, the ability to block the network of specific apps and the overall security of the system is very impressive.

llama420

GrapheneOS Should also be noted that my PC has deny by default firewall rules that block google connections, mostly ruling out a PC side leak. The Gnirehtet app does have a green light for all connections though.

« Previous Page Next Page »