I have a large number of rooted IoT devices from an industrial supplier that are meant to run as an advertising unit. The goal was to install a standard piece of advertising software designed for android and configure it in it's housing for deployment. These devices are running a rooted
Android 6.0.1 Kernel Version 4.1.17-g900299-dirty
However some of these devices are consuming insane amounts of data - over a 30 day period, 300gb of ethernet data is being used by the device, this is according to the
Data Usage view within the OS Settings. However the application causing it is "Android OS"...
I used a packet sniffer to perform a couple 30 second packet captures as well as a couple longer ones. I reviewed the data and I see that across each device affected the port is random, but it's consistent that there's always 1 port transferring 80-90% of the data seen in the capture. The traffic seems mostly upload traffic (bytes sent from device to remote host), but that hasn't always been the case. Triggering a reboot seems to cause the service to pick a new port during boot.
I tried using
netstat -tulpn in termux to check what process is using this, but the pid section is blank across the board. I see this port is listening, though.
I've looked at
lsof -i | grep <port> but nothing comes up on any of the affected devices.
ps aux | grep <port> is not returning anything either.
Within the captures, it seems like there are a couple consistent hosts that they're reaching out to within a single device, but across devices this is not true. However I'm noticing that the remote host port we're contacting tends to be 4001... is that relevant?
I've read that it's possible it's an OS Upgrade issue where we're downloading updates that somehow fail and cause this awful cycle... but when I looked into the services running that it seems like it's already disabled (as referenced here: Google Play Services High Internet Consumption )
Does anyone have any suggestion of how I can track this down and stop it?