gstatic.com (a google domain) Connections On Stock Graphene OS On Startup

llama420

DeletedUser495 I have. What more do you want? I have a pcap now but just can't see how to post it up.

llama420

DeletedUser495 I even explained how to reproduce it yourself in a manner you can understand.

llama420

Well, here's the raw pcap log since I can't seem to attach files here. Only targeted the google IP 142.250.69.99. Running this without my phone in reverse tethering shows no connections to this IP.

1 0.000000 10.2.0.2 142.250.69.99 TCP 80 53386 → 443 [SYN] Seq=0 Win=64860 Len=0 MSS=1380 SACK_PERM TSval=842624526 TSecr=0 WS=128
2 0.039130 142.250.69.99 10.2.0.2 TCP 80 443 → 53386 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1360 SACK_PERM TSval=1145659709 TSecr=842624526 WS=256
3 0.039200 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=1 Ack=1 Win=64896 Len=0 TSval=842624566 TSecr=1145659709
4 0.070852 10.2.0.2 142.250.69.99 TLSv1.3 589 Client Hello (SNI=www.gstatic.com)
5 0.108987 142.250.69.99 10.2.0.2 TCP 72 443 → 53386 [ACK] Seq=1 Ack=518 Win=64768 Len=0 TSval=1145659779 TSecr=842624598
6 0.131534 142.250.69.99 10.2.0.2 TLSv1.3 1420 Server Hello, Change Cipher Spec
7 0.131586 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=518 Ack=1349 Win=66944 Len=0 TSval=842624658 TSecr=1145659801
8 0.131605 142.250.69.99 10.2.0.2 TCP 124 443 → 53386 [PSH, ACK] Seq=1349 Ack=518 Win=64768 Len=52 TSval=1145659801 TSecr=842624598 [TCP PDU reassembled in 12]
9 0.131605 142.250.69.99 10.2.0.2 TCP 1420 443 → 53386 [ACK] Seq=1401 Ack=518 Win=64768 Len=1348 TSval=1145659801 TSecr=842624598 [TCP PDU reassembled in 12]
10 0.131620 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=518 Ack=1401 Win=66944 Len=0 TSval=842624658 TSecr=1145659801
11 0.131675 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=518 Ack=2749 Win=69760 Len=0 TSval=842624658 TSecr=1145659801
12 0.169178 142.250.69.99 10.2.0.2 TLSv1.3 160 Application Data
13 0.169227 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=518 Ack=2837 Win=69760 Len=0 TSval=842624696 TSecr=1145659839
14 0.190423 10.2.0.2 142.250.69.99 TLSv1.3 136 Change Cipher Spec, Application Data
15 0.272788 142.250.69.99 10.2.0.2 TCP 72 443 → 53386 [ACK] Seq=2837 Ack=582 Win=64768 Len=0 TSval=1145659943 TSecr=842624717
16 0.272808 10.2.0.2 142.250.69.99 TLSv1.3 320 Application Data
17 0.311036 142.250.69.99 10.2.0.2 TCP 72 443 → 53386 [ACK] Seq=2837 Ack=830 Win=64768 Len=0 TSval=1145659981 TSecr=842624800
18 0.319619 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
19 0.319665 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
20 0.319696 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [ACK] Seq=830 Ack=4885 Win=74496 Len=0 TSval=842624846 TSecr=1145659989
21 0.319752 142.250.69.99 10.2.0.2 TLSv1.3 205 Application Data
22 0.319752 142.250.69.99 10.2.0.2 TCP 72 443 → 53386 [FIN, ACK] Seq=5018 Ack=830 Win=64768 Len=0 TSval=1145659989 TSecr=842624800
23 0.344035 10.2.0.2 142.250.69.99 TLSv1.3 96 Application Data
24 0.344997 10.2.0.2 142.250.69.99 TCP 72 53386 → 443 [FIN, ACK] Seq=854 Ack=5019 Win=76544 Len=0 TSval=842624872 TSecr=1145659989
25 0.380864 142.250.69.99 10.2.0.2 TCP 72 443 → 53386 [ACK] Seq=5019 Ack=855 Win=64768 Len=0 TSval=1145660051 TSecr=842624871
26 0.387195 10.2.0.2 142.250.69.99 TCP 80 53392 → 443 [SYN] Seq=0 Win=64860 Len=0 MSS=1380 SACK_PERM TSval=842624914 TSecr=0 WS=128
27 0.425116 142.250.69.99 10.2.0.2 TCP 80 443 → 53392 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1360 SACK_PERM TSval=1145660095 TSecr=842624914 WS=256
28 0.425136 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=1 Ack=1 Win=64896 Len=0 TSval=842624952 TSecr=1145660095
29 0.434193 10.2.0.2 142.250.69.99 TLSv1.3 589 Client Hello (SNI=www.gstatic.com)
30 0.472930 142.250.69.99 10.2.0.2 TCP 72 443 → 53392 [ACK] Seq=1 Ack=518 Win=64768 Len=0 TSval=1145660141 TSecr=842624961
31 0.495261 142.250.69.99 10.2.0.2 TLSv1.3 1420 Server Hello, Change Cipher Spec
32 0.495313 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=518 Ack=1349 Win=66944 Len=0 TSval=842625022 TSecr=1145660165
33 0.495326 142.250.69.99 10.2.0.2 TCP 1420 443 → 53392 [PSH, ACK] Seq=1349 Ack=518 Win=64768 Len=1348 TSval=1145660165 TSecr=842624961 [TCP PDU reassembled in 35]
34 0.495341 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=518 Ack=2697 Win=69760 Len=0 TSval=842625022 TSecr=1145660165
35 0.495354 142.250.69.99 10.2.0.2 TLSv1.3 212 Application Data
36 0.495365 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=518 Ack=2837 Win=72448 Len=0 TSval=842625022 TSecr=1145660165
37 0.536094 10.2.0.2 142.250.69.99 TLSv1.3 136 Change Cipher Spec, Application Data
38 0.616794 142.250.69.99 10.2.0.2 TCP 72 443 → 53392 [ACK] Seq=2837 Ack=582 Win=64768 Len=0 TSval=1145660287 TSecr=842625063
39 0.616805 10.2.0.2 142.250.69.99 TLSv1.3 320 Application Data
40 0.655117 142.250.69.99 10.2.0.2 TCP 72 443 → 53392 [ACK] Seq=2837 Ack=830 Win=64768 Len=0 TSval=1145660325 TSecr=842625144
41 0.663553 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
42 0.663578 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=830 Ack=3861 Win=75136 Len=0 TSval=842625190 TSecr=1145660333
43 0.663587 142.250.69.99 10.2.0.2 TCP 448 443 → 53392 [PSH, ACK] Seq=3861 Ack=830 Win=64768 Len=376 TSval=1145660333 TSecr=842625144 [TCP PDU reassembled in 45]
44 0.663593 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [ACK] Seq=830 Ack=4237 Win=77824 Len=0 TSval=842625190 TSecr=1145660333
45 0.663746 142.250.69.99 10.2.0.2 TLSv1.3 786 Application Data, Application Data
46 0.695447 10.2.0.2 142.250.69.99 TLSv1.3 96 Application Data
47 0.695472 10.2.0.2 142.250.69.99 TCP 72 53392 → 443 [FIN, ACK] Seq=854 Ack=4952 Win=80000 Len=0 TSval=842625222 TSecr=1145660334
48 0.727452 10.2.0.2 142.250.69.99 TCP 80 53404 → 443 [SYN] Seq=0 Win=64860 Len=0 MSS=1380 SACK_PERM TSval=842625254 TSecr=0 WS=128
49 0.733212 142.250.69.99 10.2.0.2 TCP 72 443 → 53392 [ACK] Seq=4952 Ack=855 Win=64768 Len=0 TSval=1145660403 TSecr=842625222
50 0.764776 142.250.69.99 10.2.0.2 TCP 80 443 → 53404 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1360 SACK_PERM TSval=1145660435 TSecr=842625254 WS=256
51 0.764796 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=1 Ack=1 Win=64896 Len=0 TSval=842625292 TSecr=1145660435
52 0.768349 10.2.0.2 142.250.69.99 TLSv1.3 589 Client Hello (SNI=www.gstatic.com)
53 0.805209 142.250.69.99 10.2.0.2 TCP 72 443 → 53404 [ACK] Seq=1 Ack=518 Win=64768 Len=0 TSval=1145660475 TSecr=842625295
54 0.833680 142.250.69.99 10.2.0.2 TLSv1.3 1420 Server Hello, Change Cipher Spec
55 0.833734 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=518 Ack=1349 Win=66944 Len=0 TSval=842625360 TSecr=1145660503
56 0.833765 142.250.69.99 10.2.0.2 TCP 124 443 → 53404 [PSH, ACK] Seq=1349 Ack=518 Win=64768 Len=52 TSval=1145660503 TSecr=842625295 [TCP PDU reassembled in 60]
57 0.833765 142.250.69.99 10.2.0.2 TCP 1420 443 → 53404 [ACK] Seq=1401 Ack=518 Win=64768 Len=1348 TSval=1145660503 TSecr=842625295 [TCP PDU reassembled in 60]
58 0.833783 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=518 Ack=1401 Win=66944 Len=0 TSval=842625361 TSecr=1145660503
59 0.833839 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=518 Ack=2749 Win=69760 Len=0 TSval=842625361 TSecr=1145660503
60 0.871030 142.250.69.99 10.2.0.2 TLSv1.3 160 Application Data
61 0.871079 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=518 Ack=2837 Win=69760 Len=0 TSval=842625398 TSecr=1145660541
62 0.880823 10.2.0.2 142.250.69.99 TLSv1.3 136 Change Cipher Spec, Application Data
63 0.964718 142.250.69.99 10.2.0.2 TCP 72 443 → 53404 [ACK] Seq=2837 Ack=582 Win=64768 Len=0 TSval=1145660635 TSecr=842625408
64 0.964780 10.2.0.2 142.250.69.99 TLSv1.3 323 Application Data
65 1.007599 142.250.69.99 10.2.0.2 TCP 72 443 → 53404 [ACK] Seq=2837 Ack=833 Win=64768 Len=0 TSval=1145660677 TSecr=842625492
66 1.016987 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
67 1.017050 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
68 1.017051 142.250.69.99 10.2.0.2 TLSv1.3 153 Application Data
69 1.017087 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [ACK] Seq=833 Ack=4885 Win=74496 Len=0 TSval=842625544 TSecr=1145660687
70 1.017809 142.250.69.99 10.2.0.2 TCP 72 443 → 53404 [FIN, ACK] Seq=4966 Ack=833 Win=64768 Len=0 TSval=1145660688 TSecr=842625492
71 1.029101 10.2.0.2 142.250.69.99 TLSv1.3 96 Application Data
72 1.030316 10.2.0.2 142.250.69.99 TCP 72 53404 → 443 [FIN, ACK] Seq=857 Ack=4967 Win=74496 Len=0 TSval=842625557 TSecr=1145660687
73 1.055888 10.2.0.2 142.250.69.99 TCP 80 53420 → 443 [SYN] Seq=0 Win=64860 Len=0 MSS=1380 SACK_PERM TSval=842625582 TSecr=0 WS=128
74 1.067376 142.250.69.99 10.2.0.2 TCP 72 443 → 53404 [ACK] Seq=4967 Ack=858 Win=64768 Len=0 TSval=1145660737 TSecr=842625556
75 1.094763 142.250.69.99 10.2.0.2 TCP 80 443 → 53420 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1360 SACK_PERM TSval=1145660765 TSecr=842625582 WS=256
76 1.094782 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=1 Ack=1 Win=64896 Len=0 TSval=842625622 TSecr=1145660765
77 1.098399 10.2.0.2 142.250.69.99 TLSv1.3 589 Client Hello (SNI=www.gstatic.com)
78 1.137552 142.250.69.99 10.2.0.2 TCP 72 443 → 53420 [ACK] Seq=1 Ack=518 Win=64768 Len=0 TSval=1145660807 TSecr=842625625
79 1.164657 142.250.69.99 10.2.0.2 TLSv1.3 1420 Server Hello, Change Cipher Spec
80 1.164713 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=518 Ack=1349 Win=66944 Len=0 TSval=842625691 TSecr=1145660834
81 1.164762 142.250.69.99 10.2.0.2 TCP 124 443 → 53420 [PSH, ACK] Seq=1349 Ack=518 Win=64768 Len=52 TSval=1145660834 TSecr=842625625 [TCP PDU reassembled in 85]
82 1.164762 142.250.69.99 10.2.0.2 TCP 1420 443 → 53420 [ACK] Seq=1401 Ack=518 Win=64768 Len=1348 TSval=1145660834 TSecr=842625625 [TCP PDU reassembled in 85]
83 1.164793 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=518 Ack=1401 Win=66944 Len=0 TSval=842625692 TSecr=1145660834
84 1.164816 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=518 Ack=2749 Win=69760 Len=0 TSval=842625692 TSecr=1145660834
85 1.203645 142.250.69.99 10.2.0.2 TLSv1.3 161 Application Data
86 1.203695 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=518 Ack=2838 Win=69760 Len=0 TSval=842625730 TSecr=1145660873
87 1.264446 10.2.0.2 142.250.69.99 TLSv1.3 136 Change Cipher Spec, Application Data
88 1.318346 10.2.0.2 142.250.69.99 TCP 80 53424 → 443 [SYN] Seq=0 Win=64860 Len=0 MSS=1380 SACK_PERM TSval=842625845 TSecr=0 WS=128
89 1.348863 142.250.69.99 10.2.0.2 TCP 72 443 → 53420 [ACK] Seq=2838 Ack=582 Win=64768 Len=0 TSval=1145661019 TSecr=842625791
90 1.348876 10.2.0.2 142.250.69.99 TLSv1.3 321 Application Data
91 1.356922 142.250.69.99 10.2.0.2 TCP 80 443 → 53424 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0 MSS=1360 SACK_PERM TSval=1145661027 TSecr=842625845 WS=256
92 1.356942 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=1 Ack=1 Win=64896 Len=0 TSval=842625884 TSecr=1145661027
93 1.364401 10.2.0.2 142.250.69.99 TLSv1.3 589 Client Hello (SNI=www.gstatic.com)
94 1.387064 142.250.69.99 10.2.0.2 TCP 72 443 → 53420 [ACK] Seq=2838 Ack=831 Win=64768 Len=0 TSval=1145661057 TSecr=842625876
95 1.400902 142.250.69.99 10.2.0.2 TCP 72 443 → 53424 [ACK] Seq=1 Ack=518 Win=64768 Len=0 TSval=1145661071 TSecr=842625891
96 1.403192 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
97 1.403249 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=3862 Win=72448 Len=0 TSval=842625930 TSecr=1145661073
98 1.403286 142.250.69.99 10.2.0.2 TLSv1.3 1012 Application Data
99 1.403287 142.250.69.99 10.2.0.2 TLSv1.3 2120 Application Data
100 1.403287 142.250.69.99 10.2.0.2 TLSv1.3 2282 Application Data, Application Data
101 1.403287 142.250.69.99 10.2.0.2 TCP 1096 443 → 53420 [PSH, ACK] Seq=9060 Ack=831 Win=64768 Len=1024 TSval=1145661073 TSecr=842625876 [TCP PDU reassembled in 104]
102 1.403325 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=4802 Win=75136 Len=0 TSval=842625930 TSecr=1145661073
103 1.403383 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=10084 Win=75136 Len=0 TSval=842625930 TSecr=1145661073
104 1.405299 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
105 1.405339 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=11108 Win=77824 Len=0 TSval=842625932 TSecr=1145661075
106 1.405363 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
107 1.405382 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=12132 Win=78848 Len=0 TSval=842625932 TSecr=1145661075
108 1.407335 142.250.69.99 10.2.0.2 TCP 1096 443 → 53420 [ACK] Seq=12132 Ack=831 Win=64768 Len=1024 TSval=1145661077 TSecr=842625876 [TCP PDU reassembled in 110]
109 1.407388 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=13156 Win=79872 Len=0 TSval=842625934 TSecr=1145661077
110 1.407413 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
111 1.407427 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=14180 Win=78848 Len=0 TSval=842625934 TSecr=1145661077
112 1.409410 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
113 1.409460 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=15204 Win=79872 Len=0 TSval=842625936 TSecr=1145661079
114 1.409479 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
115 1.409492 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=16228 Win=78848 Len=0 TSval=842625936 TSecr=1145661079
116 1.425617 142.250.69.99 10.2.0.2 TLSv1.3 1420 Server Hello, Change Cipher Spec
117 1.425669 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=518 Ack=1349 Win=66944 Len=0 TSval=842625952 TSecr=1145661095
118 1.425688 142.250.69.99 10.2.0.2 TCP 124 443 → 53424 [PSH, ACK] Seq=1349 Ack=518 Win=64768 Len=52 TSval=1145661095 TSecr=842625891 [TCP PDU reassembled in 148]
119 1.425689 142.250.69.99 10.2.0.2 TCP 1420 443 → 53424 [ACK] Seq=1401 Ack=518 Win=64768 Len=1348 TSval=1145661095 TSecr=842625891 [TCP PDU reassembled in 148]
120 1.425749 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=518 Ack=2749 Win=69760 Len=0 TSval=842625952 TSecr=1145661095
121 1.441118 142.250.69.99 10.2.0.2 TCP 1096 443 → 53420 [ACK] Seq=16228 Ack=831 Win=64768 Len=1024 TSval=1145661111 TSecr=842625930 [TCP PDU reassembled in 123]
122 1.441164 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=17252 Win=79872 Len=0 TSval=842625968 TSecr=1145661111
123 1.441188 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
124 1.441188 142.250.69.99 10.2.0.2 TLSv1.3 1339 Application Data
125 1.441203 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=18276 Win=78848 Len=0 TSval=842625968 TSecr=1145661111
126 1.441218 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=19543 Win=77696 Len=0 TSval=842625968 TSecr=1145661112
127 1.443435 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
128 1.443486 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=20729 Win=82304 Len=0 TSval=842625970 TSecr=1145661113
129 1.443506 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
130 1.443523 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=21915 Win=84736 Len=0 TSval=842625970 TSecr=1145661113
131 1.446254 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
132 1.446304 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=23101 Win=87040 Len=0 TSval=842625973 TSecr=1145661116
133 1.446327 142.250.69.99 10.2.0.2 TCP 1258 443 → 53420 [PSH, ACK] Seq=23101 Ack=831 Win=64768 Len=1186 TSval=1145661116 TSecr=842625930 [TCP PDU reassembled in 135]
134 1.446340 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=24287 Win=89472 Len=0 TSval=842625973 TSecr=1145661116
135 1.448148 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
136 1.448196 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=25473 Win=91776 Len=0 TSval=842625975 TSecr=1145661118
137 1.448227 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
138 1.448250 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=26659 Win=94208 Len=0 TSval=842625975 TSecr=1145661118
139 1.450997 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
140 1.451050 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=27845 Win=96640 Len=0 TSval=842625978 TSecr=1145661120
141 1.451062 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
142 1.451075 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=29031 Win=98944 Len=0 TSval=842625978 TSecr=1145661120
143 1.452984 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
144 1.452993 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=30217 Win=101376 Len=0 TSval=842625980 TSecr=1145661123
145 1.452997 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
146 1.452999 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [ACK] Seq=831 Ack=31403 Win=103680 Len=0 TSval=842625980 TSecr=1145661123
147 1.455272 142.250.69.99 10.2.0.2 TLSv1.3 288 Application Data
148 1.462984 142.250.69.99 10.2.0.2 TLSv1.3 159 Application Data
149 1.462993 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=518 Ack=2836 Win=69760 Len=0 TSval=842625990 TSecr=1145661133
150 1.464921 10.2.0.2 142.250.69.99 TLSv1.3 96 Application Data
151 1.465932 10.2.0.2 142.250.69.99 TCP 72 53420 → 443 [FIN, ACK] Seq=855 Ack=31620 Win=106112 Len=0 TSval=842625993 TSecr=1145661125
152 1.493165 10.2.0.2 142.250.69.99 TLSv1.3 136 Change Cipher Spec, Application Data
153 1.502826 142.250.69.99 10.2.0.2 TCP 72 443 → 53420 [ACK] Seq=31620 Ack=856 Win=64768 Len=0 TSval=1145661173 TSecr=842625992
154 1.572757 142.250.69.99 10.2.0.2 TCP 72 443 → 53424 [ACK] Seq=2836 Ack=582 Win=64768 Len=0 TSval=1145661243 TSecr=842626020
155 1.572805 10.2.0.2 142.250.69.99 TLSv1.3 324 Application Data
156 1.611005 142.250.69.99 10.2.0.2 TCP 72 443 → 53424 [ACK] Seq=2836 Ack=834 Win=64768 Len=0 TSval=1145661281 TSecr=842626100
157 1.621024 142.250.69.99 10.2.0.2 TLSv1.3 2036 Application Data, Application Data
158 1.621024 142.250.69.99 10.2.0.2 TCP 1096 443 → 53424 [ACK] Seq=4800 Ack=834 Win=64768 Len=1024 TSval=1145661291 TSecr=842626100 [TCP PDU reassembled in 160]
159 1.621082 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=4800 Win=73728 Len=0 TSval=842626148 TSecr=1145661291
160 1.621113 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
161 1.621122 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
162 1.621141 142.250.69.99 10.2.0.2 TLSv1.3 2120 Application Data
163 1.621160 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=8034 Win=76032 Len=0 TSval=842626148 TSecr=1145661291
164 1.621187 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=10082 Win=76288 Len=0 TSval=842626148 TSecr=1145661291
165 1.623138 142.250.69.99 10.2.0.2 TLSv1.3 2120 Application Data, Application Data
166 1.623189 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=12130 Win=78336 Len=0 TSval=842626150 TSecr=1145661293
167 1.625202 142.250.69.99 10.2.0.2 TCP 1096 443 → 53424 [ACK] Seq=12130 Ack=834 Win=64768 Len=1024 TSval=1145661295 TSecr=842626100 [TCP PDU reassembled in 168]
168 1.625243 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
169 1.625264 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=14178 Win=78336 Len=0 TSval=842626152 TSecr=1145661295
170 1.627183 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
171 1.627223 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
172 1.627244 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=16226 Win=78336 Len=0 TSval=842626154 TSecr=1145661297
173 1.658884 142.250.69.99 10.2.0.2 TCP 1096 443 → 53424 [ACK] Seq=16226 Ack=834 Win=64768 Len=1024 TSval=1145661329 TSecr=842626148 [TCP PDU reassembled in 174]
174 1.658937 142.250.69.99 10.2.0.2 TLSv1.3 1096 Application Data
175 1.658937 142.250.69.99 10.2.0.2 TLSv1.3 1339 Application Data
176 1.658960 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=18274 Win=78336 Len=0 TSval=842626186 TSecr=1145661329
177 1.662274 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
178 1.662316 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=20727 Win=81792 Len=0 TSval=842626189 TSecr=1145661330
179 1.662335 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
180 1.663618 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
181 1.663669 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=23099 Win=86528 Len=0 TSval=842626190 TSecr=1145661332
182 1.663692 142.250.69.99 10.2.0.2 TCP 1258 443 → 53424 [PSH, ACK] Seq=23099 Ack=834 Win=64768 Len=1186 TSval=1145661333 TSecr=842626150 [TCP PDU reassembled in 183]
183 1.665897 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
184 1.665949 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=25471 Win=91392 Len=0 TSval=842626193 TSecr=1145661333
185 1.665962 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
186 1.668234 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
187 1.668284 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=27843 Win=96128 Len=0 TSval=842626195 TSecr=1145661336
188 1.668303 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
189 1.670611 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
190 1.670656 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=30215 Win=100864 Len=0 TSval=842626197 TSecr=1145661338
191 1.670675 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
192 1.672972 142.250.69.99 10.2.0.2 TCP 1258 443 → 53424 [ACK] Seq=31401 Ack=834 Win=64768 Len=1186 TSval=1145661343 TSecr=842626154 [TCP PDU reassembled in 194]
193 1.673021 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=32587 Win=105600 Len=0 TSval=842626200 TSecr=1145661340
194 1.673036 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
195 1.675316 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
196 1.675364 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=34959 Win=110336 Len=0 TSval=842626202 TSecr=1145661343
197 1.675385 142.250.69.99 10.2.0.2 TLSv1.3 1258 Application Data
198 1.677677 142.250.69.99 10.2.0.2 TLSv1.3 1168 Application Data, Application Data
199 1.677745 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [ACK] Seq=834 Ack=37242 Win=112128 Len=0 TSval=842626204 TSecr=1145661345
200 1.714299 10.2.0.2 142.250.69.99 TLSv1.3 96 Application Data
201 1.714409 10.2.0.2 142.250.69.99 TCP 72 53424 → 443 [FIN, ACK] Seq=858 Ack=37242 Win=112128 Len=0 TSval=842626241 TSecr=1145661345
202 1.751216 142.250.69.99 10.2.0.2 TCP 72 443 → 53424 [ACK] Seq=37242 Ack=859 Win=64768 Len=0 TSval=1145661421 TSecr=842626241

GrapheneOS

@llama420 Which applications have you installed? Are you using something like Netflix? There's lack of an indication that this connection is made by the OS rather than an app.

llama420

GrapheneOS Thank you for replying. These connections occur with nothing installed on the phone after a reboot/reinstall with nothing else running. Gnirehtet is installed via the adb connection to make reverse tethering work, but it doesn't consistently report these IPs, leading me to believe it's not the fault of that app. Its source code can be found here: https://github.com/Genymobile/gnirehtet. This IP mainly seems to connect after a reboot during the first connection with some occasional exceptions.

GrapheneOS

If you use an app like Netflix and it causes our RemoteProvisioning app to connect to our Widevine provisoning proxy followed by the app connecting to a Google API, that's not an OS issue. It's the app choosing to connect to a Google API. An app connecting to a Google API is not a GrapheneOS issue.

llama420

GrapheneOS This is the script I use to run it:
#!/bin/bash

GNIREHTET="./gnirehtet"
ADB=$(command -v adb)

if [ -z "$ADB" ]; then
echo "[!] 'adb' is not installed."
read -p "Install adb now using apt? (y/n): " ADB_INSTALL
if [[ "$ADB_INSTALL" =~ ^[Yy]$ ]]; then
sudo apt update && sudo apt install -y adb
ADB=$(command -v adb)
if [ -z "$ADB" ]; then
echo "[!] Failed to install adb. Exiting."
exit 1
fi
else
echo "[!] Cannot continue without adb. Exiting."
exit 1
fi
fi

DEVICE=$($ADB devices | grep -w "device" | awk '{print $1}')
if [ -z "$DEVICE" ]; then
echo "[!] No device detected."
echo " Make sure USB debugging is enabled and the device is authorized."
read -p "Press Enter to retry..."
DEVICE=$($ADB devices | grep -w "device" | awk '{print $1}')
if [ -z "$DEVICE" ]; then
echo "[!] Still no device detected. Aborting."
exit 1
fi
fi

echo "[+] Device detected: $DEVICE"

echo "[] Checking if gnirehtet START activity is available..."
$ADB -s "$DEVICE" shell cmd package resolve-activity --brief com.genymobile.gnirehtet.START | grep -q com.genymobile.gnirehtet
if [ $? -ne 0 ]; then
echo "[!] Gnirehtet app is not installed or broken."
read -p "Reinstall it now? (y/n): " INSTALL_CHOICE
if [[ "$INSTALL_CHOICE" =~ ^[Yy]$ ]]; then
echo "[] Installing gnirehtet APK..."
$GNIREHTET install
else
echo "[!] Cannot continue without a working gnirehtet client. Exiting."
exit 1
fi
else
echo "[+] Gnirehtet app is installed and functional."
fi

echo "Make sure the existing VPN always on/kill switch is disabled."
read -p "Press enter to link in."

echo "[*] Starting gnirehtet..."
$GNIREHTET run

llama420

GrapheneOS Just wanted to throw it out there since I led in kind of rudely. I genuinely do like your OS, even with this issue, the ability to block the network of specific apps and the overall security of the system is very impressive.

llama420

GrapheneOS Should also be noted that my PC has deny by default firewall rules that block google connections, mostly ruling out a PC side leak. The Gnirehtet app does have a green light for all connections though.

GrapheneOS

@llama420 You appear to be doing something strange that's resulting in this. What if you use RethinkDNS or another app or monitoring connections instead? Does it show up there? How do you know something else isn't causing it including this tethering setup you're using?

llama420

GrapheneOS The only thing it could be aside from stock OS functionality is the tethering setup, but it's open source and the connections aren't consistent based on its usage. The only consistency I've found in these IPs connecting is that they occur after the OS is rebooted and during the first connection, which leads me to suspect the OS. I've also found some AT&T (my phone service) and AWS connections in this manner when a SIM card was in on a fresh install, despite not being connected to cellular data. These google IPs remained the most consistent even after a fresh install with no SIM card.

I just tried out RethinkDNS and found connections for dns.google and sentitlement2.mobile.att.net under a standard WiFi connection with no cellular data in use. The dns.google domain returned a "SEND_FAIL" in RethinkDNS with no rule blocking it. All proxies are default/Graphene. My phone is set up as usual again, with minimal apps, but there could be interference somewhere. No AT&T app or anything associated, most blocked from the internet entirely. Only Proton things and IronFox have connections allowed.

llama420

GrapheneOS

Byku

other8026

Fresh install. First connection under gnirehtet showing google's 142.250.69.99, no SIM card:

[*] Starting gnirehtet...
2025-07-28 16:47:11.018 INFO Main: Starting relay server on port 31416...
2025-07-28 16:47:11.019 INFO Relay: Relay server started
2025-07-28 16:47:11.019 INFO Main: Checking gnirehtet client...
2025-07-28 16:47:11.159 INFO Main: Starting client...
Starting: Intent { act=com.genymobile.gnirehtet.START cmp=com.genymobile.gnirehtet/.GnirehtetActivity }
2025-07-28 16:47:13.414 INFO TunnelServer: Client #0 connected
2025-07-28 16:47:13.612 INFO UdpConnection: 10.0.0.2:7846 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.614 INFO UdpConnection: 10.0.0.2:38699 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.618 INFO UdpConnection: 10.0.0.2:44226 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.618 INFO TcpConnection: 10.0.0.2:48572 -> 8.8.8.8:853 Open
2025-07-28 16:47:13.632 INFO UdpConnection: 10.0.0.2:33137 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.637 INFO UdpConnection: 10.0.0.2:10176 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.643 INFO UdpConnection: 10.0.0.2:21299 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.654 INFO UdpConnection: 10.0.0.2:57409 -> 8.8.8.8:443 Open
2025-07-28 16:47:13.664 INFO UdpConnection: 10.0.0.2:60910 -> 23.133.168.244:123 Open
2025-07-28 16:47:13.666 INFO UdpConnection: 10.0.0.2:39187 -> 174.138.208.0:123 Open
2025-07-28 16:47:13.684 INFO UdpConnection: 10.0.0.2:55550 -> 54.39.23.64:123 Open
2025-07-28 16:47:13.735 INFO UdpConnection: 10.0.0.2:48135 -> 23.133.168.246:123 Open
2025-07-28 16:47:13.762 INFO TcpConnection: 10.0.0.2:37472 -> 51.222.159.116:443 Open
2025-07-28 16:47:13.860 INFO UdpConnection: 10.0.0.2:32665 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.915 INFO UdpConnection: 10.0.0.2:50659 -> 8.8.8.8:53 Open
2025-07-28 16:47:13.989 INFO TcpConnection: 10.0.0.2:47266 -> 172.96.172.37:443 Open
2025-07-28 16:47:13.992 INFO TcpConnection: 10.0.0.2:48572 -> 8.8.8.8:853 Close
2025-07-28 16:47:13.996 INFO TcpConnection: 10.0.0.2:42176 -> 142.250.69.99:443 Open
2025-07-28 16:47:14.124 INFO TcpConnection: 10.0.0.2:37476 -> 51.222.159.116:443 Open
2025-07-28 16:47:14.191 INFO TcpConnection: 10.0.0.2:37472 -> 51.222.159.116:443 Close
2025-07-28 16:47:14.443 INFO TcpConnection: 10.0.0.2:42176 -> 142.250.69.99:443 Close
2025-07-28 16:47:14.459 INFO TcpConnection: 10.0.0.2:37482 -> 51.222.159.116:443 Open
2025-07-28 16:47:14.622 INFO TcpConnection: 10.0.0.2:42188 -> 142.250.69.99:443 Open
2025-07-28 16:47:14.623 INFO TcpConnection: 10.0.0.2:42186 -> 142.250.69.99:443 Open
2025-07-28 16:47:14.917 INFO TcpConnection: 10.0.0.2:37482 -> 51.222.159.116:443 Close
2025-07-28 16:47:14.952 INFO TcpConnection: 10.0.0.2:42186 -> 142.250.69.99:443 Close
2025-07-28 16:47:14.998 INFO TcpConnection: 10.0.0.2:42188 -> 142.250.69.99:443 Close
2025-07-28 16:47:15.056 INFO TcpConnection: 10.0.0.2:42208 -> 142.250.69.99:443 Open
2025-07-28 16:47:15.079 INFO TcpConnection: 10.0.0.2:42216 -> 142.250.69.99:443 Open
2025-07-28 16:47:15.501 INFO TcpConnection: 10.0.0.2:42208 -> 142.250.69.99:443 Close
2025-07-28 16:47:15.505 INFO TcpConnection: 10.0.0.2:42216 -> 142.250.69.99:443 Close
2025-07-28 16:47:24.499 INFO TcpConnection: 10.0.0.2:47266 -> 172.96.172.37:443 Close
2025-07-28 16:47:27.094 INFO TcpConnection: 10.0.0.2:37476 -> 51.222.159.116:443 Close

Uninstalled everything except for RethinkDNS (including gnirehtet), and disabled developer options in settings. RethinkDNS showed only Graphene and ntp.org connections.

Restarted and reinstalled gnirehtet (without reboot), all domains are Graphene and ntp.org:

[*] Starting gnirehtet...
2025-07-28 16:59:13.886 INFO Main: Starting relay server on port 31416...
2025-07-28 16:59:13.887 INFO Relay: Relay server started
2025-07-28 16:59:13.887 INFO Main: Checking gnirehtet client...
2025-07-28 16:59:14.022 INFO Main: Starting client...
Starting: Intent { act=com.genymobile.gnirehtet.START cmp=com.genymobile.gnirehtet/.GnirehtetActivity }
2025-07-28 16:59:16.287 INFO TunnelServer: Client #0 connected
2025-07-28 16:59:16.347 INFO TcpConnection: 10.0.0.2:36074 -> 8.8.8.8:853 Open
2025-07-28 16:59:16.375 INFO UdpConnection: 10.0.0.2:56885 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.379 INFO UdpConnection: 10.0.0.2:49414 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.380 INFO UdpConnection: 10.0.0.2:22616 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.381 INFO UdpConnection: 10.0.0.2:25076 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.384 INFO UdpConnection: 10.0.0.2:41205 -> 8.8.8.8:443 Open
2025-07-28 16:59:16.386 INFO UdpConnection: 10.0.0.2:1805 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.441 INFO UdpConnection: 10.0.0.2:57654 -> 54.39.196.172:123 Open
2025-07-28 16:59:16.441 INFO UdpConnection: 10.0.0.2:37256 -> 23.133.168.247:123 Open
2025-07-28 16:59:16.441 INFO UdpConnection: 10.0.0.2:38081 -> 159.203.8.72:123 Open
2025-07-28 16:59:16.444 INFO UdpConnection: 10.0.0.2:52812 -> 216.6.2.70:123 Open
2025-07-28 16:59:16.634 INFO UdpConnection: 10.0.0.2:51209 -> 8.8.8.8:53 Open
2025-07-28 16:59:16.726 INFO TcpConnection: 10.0.0.2:36074 -> 8.8.8.8:853 Close

Removed gnirehtet once again, rebooted, and all domains are Graphene and ntp.org in RethinkDNS.

So somehow the reverse tether method returns google domains only on startup regardless of the time of installation or initialization. Other connections like dns.google or AT&T are likely tied to the SIM card or third party apps.

llama420

GrapheneOS

Byku

other8026

gstatic connection was picked up by RethinkDNS after a reboot with gnirehtet still installed. The fault appears to be with the reverse tether method itself and not the OS.

llama420

other8026

Byku

GrapheneOS

It appears I was wrong. I apologize for wasting your time, and I appreciate the effort you guys took to help me with this. Hopefully this will aid in future issues with reverse tethering.

Byku

llama420
sentitlement2.mobile.att.net - this one seems to be used for Wi-Fi calling by AT&T

Did RethinkDNS return the name of the app that did the dns.google query?

While you're at it you can also check RemoteProvisioner connections under Apps in Rethink. It should connect do remoteprovisioning.grapheneos.org.

other8026

llama420 I've also found some AT&T (my phone service) and AWS connections in this manner when a SIM card was in on a fresh install

I think this is expected. It is covered here https://grapheneos.org/faq#other-connections

llama420 I just tried out RethinkDNS and found connections for dns.google and sentitlement2.mobile.att.net under a standard WiFi connection with no cellular data in use.

Do you have a SIM card inserted again? Or do you happen to have an eSIM? You really need to test this without a SIM inserted or set up to verify the OS is not contacting Google domains.

I cannot test with the same setup as you, but I did try two different apps (one was RethinkDNS), and a custom DNS setup with a static IP and all that. I only see GrapheneOS domains popping up until I go to other sites with Vanadium or install apps. All on a device that I factory reset a few times and set up from scratch. If you can see those connections to Google domains, then it would only make sense that I would too. But considering that and your att connection, it sounds like you have a SIM set up or inserted.

llama420 Only Proton things and IronFox have connections allowed.

I wouldn't be surprised if Proton apps are contacting Google domains. Do you see the connections to gstatic before installing those apps?

llama420

other8026 Yeah, gstatic was the most consistent and appeared with no third party apps installed and no SIM after a fresh install. The RethinkDNS test was with a SIM card and IronFox/Proton apps installed. I use a physical SIM card, no eSIM. I'll reinstall again with no SIM and re-run the RethinkDNS test. It's definitely possible that Proton makes google connections, found some google fonts APIs from their Flatpak mailing app on Linux, though it's just a Chromium webview and not officially developed by them.

Byku No associated app in RethinkDNS for dns.google. I suspect it may have been IronFox since it also made quad9 dns queries around the same time which is what IronFox uses, but I have no way of knowing. The google IP returned by the reverse tether method did not appear at all in RethinkDNS testing under identical conditions.

wizoatk

llama420 The fault appears to be

[...]

Heisenbug – a bug that seems to disappear or alter its behaviour when you attempt to study it. Named after Werner Heisenberg, the physicist who first asserted the observer effect of quantum mechanics, which states that the act of observing a system inevitably alters its state.

GrapheneOS

llama420 It would still be good to know why the reverse tethering app triggers this connection. It isn't something which happens by default in a regular configuration.

GrapheneOS

llama420 What does RethinkDNS say is making the connection? It might not be able to identify it due to the usage of ADB shell, etc. but it might be helpful.

de0u

llama420 As the saying goes, "All's well that ends well".

llama420

wizoatk Ha, yeah. The irony...
GrapheneOS RethinkDNS linked gstatic to Download Manager, Downloads, com.android.providers.media, Sounds, and MTP Host. Gnirehtet was undetected by Rethink.

« Previous Page Next Page »