today I did had fun with Netstat on my device and saw that Google Play Services are making VNC connections from my device to a Google server.

The question here is : why ? Sounds to me like a backdoor allowing Google to see whatever I do, that's really scary...

Google Play Services sending packets via the VNC protocol.

  • It might be the same port is used, not necessarily the same protocol. I'd bet SockStat simply uses a list of well-known ports to map numbers to names (like it's done on Linux via the /etc/services file).
    – Izzy
    Dec 2 '16 at 8:28
  • Problem here is that VNC port is 5900, not 5228 :/
    – SkyzohKey
    Dec 2 '16 at 8:37
  • Sure. But do you know what table SockStat is using for assignments? Have you asked its dev? As for port 5228, references: Port 5228 Details, related question on SO: Android C2DM port number choice. Could well be a typo in the code, as that port is e.g. used by HP Virtual Room Service :) I'd contact the dev of that app for clarification why it says "VNC". I very much doubt we're really talking about VNC connections here.
    – Izzy
    Dec 2 '16 at 10:22

I just decompiled the SockStat apk and found this:

.class Lcom/powl1/sockstat/Utils$1;
.super Ljava/util/HashMap;
.source "Utils.java"
#skipped lines
const/16 v4, 0x146c #Register v4 is assigned as 0x146c (Hex equivalent of 5228)
#skipped lines
.line 161 # A HashMap might have been used to map port 5228 to "VNC"
    invoke-static {v4}, Ljava/lang/Integer;->valueOf(I)Ljava/lang/Integer;

    move-result-object v0

    const-string v1, "VNC"

    invoke-virtual {p0, v0, v1}, Lcom/powl1/sockstat/Utils$1;->put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;

What this means is that as @Izzy pointed out, the developer might have incorrectly labelled port 5228 as "VNC"..

Contact the developer to solve this issue ;)

  • I don't know if this is eligible to be posted as an answer; please report me if it's to be removed and put as a comment :)
    – Gokul NC
    Dec 4 '16 at 8:32

A TCP service is making an (established) outbound connection over port 5228, meaning your device is reaching out to a service, not awaiting a connection. The 'listening' tab next to it would be where a VNC listener would reside.

In any case, 5228 is not a VNC port. VNC uses 5900 or 5800 by default. As mentioned above, the nestat app must have mislabeled it.

According to speedguide.net, tcp & udp port 5228 is used by the Google Play Store and Google Chrome user sync. This would explain why the application name is Google Play Services, which to my understanding is the framework for Google application i/o.

  • How does this answer the question? And why should there be a need to configure a service?
    – Izzy
    Dec 4 '16 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.