I'm using Android 4.4.4 CyanogenMOD 12. My traffic is dominated by "android-system" - about half of my data usage is caused by "it" and I have no idea why it transfers data. backup (backup & restore) is turned off. I dont use any Google Service besides the play store (and very seldomly youtube). All the "android system"-traffic is background-trafic.

Is there any chance (tool/app/whatever) to find out what exactly the cause for the "android system" traffic is?

PS: - I use AFWall+ and in 3G even most of the system apps are blocked. - I do not have the "Photos" app

  • 1
    Could it be the account synchronisation? – Huey Nov 23 '15 at 1:45
  • android system is the core-system it's an API that can be accesed by any third party app on the phone that have the right permissions so it's gonna be difficult to find what is using that data exactly try disabling background-trafic under settings > more > data usage then option and check the "Restrict background data" checkbox – lord-ralf-adolf Dec 10 '15 at 19:52
  • It is too much data in order to be account sync I think - and I disabled all syncing i know. I'll try the restrict background data idea. – Edgar Hover Jul 27 '16 at 9:53

It's possible. I used ARM version of tcpdump command. You must copy that command by hand in /system/xbin/. In shell you ran:

tcpdump -i rmnet0 -w /sdcard2/tcpdump.pcap

After some time kill that tcpdump command and copy file tcpdump.pcap to PC. Then use Wireshark to load tcpdump.pcap file to investigate network traffic.

  • well, this is all traffic caused by the system, isn't it? It would be quite hard to filter... – Edgar Hover Jul 27 '16 at 9:51
  • yes, it is. but this is some info than nothing – QkiZ Aug 20 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.