0

I have a Redmi Note 3 (unrooted) phone running MIUI Global 10.2 [Android version 6.0.1 MMB29M]

I have installed AdGuard to monitor the traffic that my phone sends/receives. While checking the 'Filtering Log', I see few connections that the app "Android OS" makes to the remote address "118.189.138.5:123" (see screenshot). As you can see from the screenshot, the requested URL is having a "UDP" connection protocol.

Now, when I do a search for this IP address, I see that it belongs to "M1 Connect Pte Ltd" in Singapore.

https://www.speedguide.net/ip/118.189.138.5

I also noticed similar UDP connections to these IP addresses:

95.216.192.15 belongs to "D2 Internet Investment Ukraine ETTH broadband" in Ukraine 133.243.238.163 belongs to "National Institute of Information and Communicatio" in Japan and the strangest of all 202.12.97.45 belonging to "Ministry of University Affairs" in Thailand

So my question is why would Android OS make connection to this IP addresses. What are these connections for? Am I missing something here or are these some legit connections used for some 'good' work? Is my phone connecting and leaking some information?

Hoping that some expert on networking will answer this.

enter image description here

2
  • Stay close to vanilla AOSP AMAP. Avoid using highly customized ROMs, particularly from OEMs, whether it's Xioami, OnePlus, Huawei, Samsung, Google or whatever. You never know what they put on your device. – Irfan Latif Oct 7 '19 at 13:23
  • I don't know what software you used for back tracing the IP addresses, but using the current protocol rdap (successor of whois) I get "Computer Center Khon Kaen University" for 202.12.97.45. Anyway some UDP traffic can be the result of Voice over LTE (VoLTE). Additionally the Port 123 indicates that this is the Network Time Protocol (time sync). Often a large pool of NTP servers is used. May be this is the explanation for the different UDP connections over time. – Robert Oct 8 '19 at 6:49
1

There is a simple answer what is causing the UDP traffic.

The first indicator is the used port number 123 which is typically used by the Network Time Protocol (NTP). This protocol is responsible for synchronizing the time of your smartphone with a remote server.

To spread the burden among multiple servers and to make sure there is always a server available the NTP protocol usually does not use one specific time server to synchronize with.

Instead a large pool of servers is used. The three IP address 118.189.138.5 95.216.192.15 133.243.238.163 and 202.12.97.45 you mentioned are all NTP servers and they belong to the NTP pool "Asia 1".

Therefore if you capture more traffic earlier or later I assume you will see all of those IP addresses with UDP traffic on port 123.

2
  • AOSP has hard-coded value 2.android.pool.ntp.org for NTP server. I wonder if this can resolve to some address in Asia. – Irfan Latif Oct 8 '19 at 9:57
  • 1
    @Irfan Maybe this pool uses GeoDNS (different result based on the IP you request it) or Xiaomi has changed the NTP server default value. – Robert Oct 8 '19 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.