I'm using Android 4.4.4 CyanogenMOD 12. My traffic is dominated by "android-system" - about half of my data usage is caused by "it" and I have no idea why it transfers data. backup (backup & restore) is turned off. I dont use any Google Service besides the play store (and very seldomly youtube). All the "android system"-traffic is background-trafic.

Is there any chance (tool/app/whatever) to find out what exactly the cause for the "android system" traffic is?

PS: - I use AFWall+ and in 3G even most of the system apps are blocked. - I do not have the "Photos" app

  • 1
    Could it be the account synchronisation?
    – Huey
    Commented Nov 23, 2015 at 1:45
  • android system is the core-system it's an API that can be accesed by any third party app on the phone that have the right permissions so it's gonna be difficult to find what is using that data exactly try disabling background-trafic under settings > more > data usage then option and check the "Restrict background data" checkbox Commented Dec 10, 2015 at 19:52
  • It is too much data in order to be account sync I think - and I disabled all syncing i know. I'll try the restrict background data idea. Commented Jul 27, 2016 at 9:53

1 Answer 1


It's possible. I used ARM version of tcpdump command. You must copy that command by hand in /system/xbin/. In shell you ran:

tcpdump -i rmnet0 -w /sdcard2/tcpdump.pcap

After some time kill that tcpdump command and copy file tcpdump.pcap to PC. Then use Wireshark to load tcpdump.pcap file to investigate network traffic.

  • well, this is all traffic caused by the system, isn't it? It would be quite hard to filter... Commented Jul 27, 2016 at 9:51
  • yes, it is. but this is some info than nothing
    – QkiZ
    Commented Aug 20, 2019 at 19:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .