yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy S II SGH-I777] elherr:
Has anyone taken a look at the behavior of wifi in relation to Google Location Services? It's fairly well known that Google has mapped wireless access point MAC addresses and use them by default in Android to augment GPS to provide better/more reliable position data for mobile applications.

I started thinking about 0x886c frames I've been seeing in captures. They seem to happen on a very periodic basis. I postulate that these frames are seen during a 802.11 scanning event, not from associating or disconnecting from a WAP.

I'm thinking that Google Location Services triggers a scan on a periodic basis to collect MAC addresses from WAP's within range, which, in turn, has the effect of generating Layer 2 chatter from/to interface. Possible an issue with binary BT-AMP driver implementation?

In my testing I saw bursts of 0x886c (BT-AMP) frames EXACTLY every 120 seconds when phone was connected to WAP. When not associated, I saw frame burst every 60 seconds. These tests were static -- I did not change location.

In a third test, I ran Shark while driving for about 30 minutes. I should note that I have Access Point scanning turned off in my wifi options (phone will not prompt me to connect to open WAP's).

The third test was the real eye opener. See attached PCAP. Wifi interface is getting hammered with Layer 2 0x886c frames.

I turned off Google Locations Services and see absolutely no 0x886c frames while associated with WAP. None, nada, zilch. I'm currently running another sleep test with Location Services turned off. So far it looks like I am on the right track.

Currently on CM9 0519 with UCLD4 baseband.

Oh, and by the way, I read ALL 72 pages of this thread. My head hurts.

Thoughts, anyone?
[AT&T Samsung Galaxy S II SGH-I777] elherr:
Started idle test at 99% battery. With Location Services disabled, 9 hours 20 minutes later I have 87%.

1.3 percent drain per hour. Huge improvement. Typically I've been losing up to 5 percent per hour.

BBS stats show 90% of time sleeping. Before I was only seeing 75% -- if that.

I've attached BBS and wakelocks.
[AT&T Samsung Galaxy S II SGH-I777] xelra:
I get a huge amount of wlan_rx_wake wakelocks from my NAS, coming from microsoft-ds.

I can't just turn off SMB, because I need it. But should it be scanning every port of my phone?

Can anyone help with resolving this? Any tips?

Thanks in advance.
[AT&T Samsung Galaxy S II SGH-I777] elherr:
It would be very unusual for SMB to exhibit scanning behavior.

Have you run a capture with Shark? I'm running SMB (Samba on Debian Linux) and see very few packets originating from the server and it is definitely not scanning ports.
[AT&T Samsung Galaxy S II SGH-I777] patsmike:
Hmm... i never turn on Google Location services and i still have a wifi wakelocks. By the way, elherr, thanks for looking into this.... nice to have someone knowledgeable with this stuff!

Unfortunately theres no good way around the wifi wakelocks for those that do have them... cm9 wifi sleep policy does not work correctly on the sg2, and the AOKP "power saver" 'screen-off wifi' is still quite buggy...

Would it help you if I got a bunch of data (sharks, bbs stats, etc) from my phone? I am usually around 2 networks during a typical day and I get the same exact 75% deep sleep wakelock on wifi on either one.

maybe we'll be able to figure out whether we have the same problem underlying problem or not..
[AT&T Samsung Galaxy S II SGH-I777] elherr:
I'd be happy to take a look. I'm seeing 90% sleep with gTalk, Exchange, Groove IP, and other top talkers active on my phone on two different WAP's.

Currently pulling real time dump and looking at WLAN wakelocks with different configurations.
[AT&T Samsung Galaxy S II SGH-I777] patsmike:
Wow 90% is getting there, better than what i'm doing.

I just did a little test to see if I get the wlan wakelock on other roms/kernels:

1) Cm9, stock everything (even no gapps installed, just cpuspy to check for sleeping) - same 75% deep sleep during wifi

2) ICS touchwiz (Phonebricker ROM + siyah) - same wifi wakelocks

3) Gingerbread - Unnamed ROM, stock everything - no wifi wakelocks at all!!!!

conclusion: seems to be an ICS-related problem, for me at least
[AT&T Samsung Galaxy S II SGH-I777] stone_ship:
disable_ipv6 is changed to 0 (enabled) every time wifi is toggled on/off as well. Your sysctl script should have disabled it, but maybe you turned off wifi sometime after the reboot and did not manually disable ipv6.
[AT&T Samsung Galaxy S II SGH-I777] stone_ship:
In case you are interested, I pulled some data from my phone last night. I don't have huge drain problems (thanks to this thread!) but I have indeed noticed better deep sleep percentages since disabling Google's location services as you suggested. I was getting very similar numbers as you mentioned in a previous post: something like 77% deep sleep prior to turning off location services. Now getting 89--93%

CM9 5-16 nightly, fluxxi kernel, LD4 modem

wlan_rx_wake is 0.9%; I can't remember, but I think this is very low for me.

deep sleep 93% over 9h 20m period

Also attaching Shark dump. I'm not really sure how to read it, so if there's anything eyebrow raising, please don't assume I've seen it.

Great work and thanks for investigating this wakelock!
[AT&T Samsung Galaxy S II SGH-I777] elherr:
Wow! Thanks. Which CM9 nightly?

---------- Post added at 05:46 AM ---------- Previous post was at 05:42 AM ----------

Thanks! I'll look a bit later. Last night my percentages dropped to 75 percent again and the only thing that changed was flashing CM9 0522 yesterday afternoon. I'm reverting to 0519 to see if this makes a difference. I need to get up to speed with Cyanogen code review to look at changes.

By the way -- here is a good read on G+. Dianne Hackborn at Google with comments by Andrew Dodd (Entropy512).

https://plus.google.com/105051985738280261832/posts/FV3LVtdVxPT

BCM4330 looks SO good on paper... why the **** has it caused so many problems? iPad 3 uses it and had power issues as well.

https://www.bluetooth.org/tpg/RefNotes/4330-PB10X-R1.pdf
[AT&T Samsung Galaxy S II SGH-I777] stone_ship:
Coincidentally updated to 0522 this morning after posting. I'll make sure to check up on my deep sleep percentages throughout next couple days.
[AT&T Samsung Galaxy S II SGH-I777] patsmike:
Ah I forget exactly... either 4/27 or 4/19

I've been down this path before... I noticed the wakelocks as I flashed a new nightly (around 4/28 or so) so I tried to backtrack until it went away, to no avail. I think I went back to about 3/30, which was the oldest I had that I hadn't yet deleted from my phone, but the problem still didn't go away...

But if you try this and it works please let me know!
[AT&T Samsung Galaxy S II SGH-I777] elherr:
Will do. I've downgraded to 0519. I've been looking at change log to 0522 and nothing really strikes me as pertinent. We'll see.
[AT&T Samsung Galaxy S II SGH-I777] rav4kar:
with 0522 there are much kernel changes merged in, 3.0.32.
[AT&T Samsung Galaxy S II SGH-I777] elherr:
My bad. Still not quite awake yet. Thanks. Seeing 3.0.32 merge on 0521?
[AT&T Samsung Galaxy S II SGH-I777] elherr:
Just got done addressing some issues at work and had a few minutes to look at your files...

Your stats and Shark dump look much better than mine. I have periodic broadcasts from DLNA and SMB servers on my network (every five minutes or so), in addition to an Exchange server that is pushing content to my phone. Your network seems quiet by comparison. Traffic originating from your phone seems normal. Google services, Facebook, etc. I only see a few 0x886c ethernet frames in the dump. That is good.

You have Apple equipment on your network? I'm surprised Apple and Android peacefully coexist on the same wireless network. ;-)
[AT&T Samsung Galaxy S II SGH-I777] chamonix:
A SyncLoopWakeLock is held in the https://github.com/asksven/BetterBatteryStats-Knowledge-Base/wiki/SyncLoopWakeLock process of syncing your accounts:
[AT&T Samsung Galaxy S II SGH-I777] Don MC:
Would checking if Spanning Tree Protocol (STP) on the router is disabled or not be an idea? Especially for those with battery drain on WiFi.

I just disabled STP on my router and my WiFi icon's constant Rx (down-arrow) blinking disappeared. Now I'll just wait and see if it has any effect on my battery life and/or my wlan_rx_wakes.
[AT&T Samsung Galaxy S II SGH-I777] stone_ship:
Thank you for taking a look. Now I know what a quiet capture looks like. That dump was from my home network, and we do not have many gadgets connected, so I'm happy to hear all is quiet, as I would have hoped/expected! The Apple device is the wireless router, which is definitely compatible with Android :)

By the way, my deep sleep percentages dropped yesterday after 0522, but not by enough to think it is anything other than normal random variation. I will keep checking.
[AT&T Samsung Galaxy S II SGH-I777] elherr:
Interesting. I would not think that the WLAN interface would listen to or pass STP multicast. I'll have to check if I can enable STP on my wireless router at work and do a capture.
[AT&T Samsung Galaxy S II SGH-I777] Don MC:
Well, mine does. Disabling STP on my router (Buffalo WZR-HP-G300NH with DD-WRT firmware) stopped all unnecessary traffic to my phone. Before, the Shark dump from the phone was full of them (one STP packet every two seconds). Now they're all gone, and wlan_rx_wake is down too (though I've only got about three hours' worth of data to rely on).

I too find it very peculiar that the phone's WiFi chip doesn't just ignore them. I also do not know if it is normal for the router to transmit these packets via WLAN in the first place. I don't know much about what STP is.
[AT&T Samsung Galaxy S II SGH-I777] elherr:
Thanks. During idle network periods I'm seeing about 90% sleep again with 0519 while associated with WAP.

Interestingly enough, while I was out last night for dinner, my percentage dropped to 75% with about 6% drain/hour on AT&T network. More investigation required...
[AT&T Samsung Galaxy S II SGH-I777] elherr:
Wow. Good catch! WLAN must listen for Layer 2 broadcast (ARP, etc), but multicast? Sheesh. I'd hope that most do not have STP enabled on routers. Unless you have a rather odd network STP is rather pointless -- in my opinion anyway.

STP is typically used in a bridged ethernet network where one has more than one path to what is called a "root bridge". A root bridge could be thought of as a "gateway" in Layer 3 (IP) terms. STP provides protection from network loops and can provide redundancy in the event of a ethernet link failure. One can spend weeks familiarizing oneself with STP and its various flavors....

Typically, a wireless router has LAN & WLAN interfaces bridged. STP might be useful if you had a host (computer) with WLAN and LAN connections bridged and active to the same wireless router bridge. I've never tried this on my home network but it could be fun play with. In this case, without STP active one could conceivably cause a packet storm and DoS oneself. :-)
[AT&T Samsung Galaxy S II SGH-I777] burgess_boy:
Battery Drain Results

Hi

I noticed I was getting larger battery drains at work than at home whilst using wifi, this coupled with the fact i am having large wlan_rx_wakes and wlan_wakes leads me to believe that the works router is the culprit (which I unfortunately have no access to in terms of changing network settings).

I have managed to get about an hour of testing (unfortunately it was towards the end of the working day) from Betterbatterystats, Shark and CPU Spy to show. I am just wondering if anyone can identify any other problems I may be able to solve from these results.

If the length of time is too short then I can run a test tomorrow as well

NB. IF its of any use I tried using JuiceDefender during work and it gives me noticable improvements in battery life with no wlan_rx_wake or wlan_wake.

CPU Spy results:

Total State Time: 1:09:06

Deep Sleep 0:36:69 52%

200 MHz 0:14:42 12%

300 MHz 0:01:16 1%

400 MHz 0:00:42 1%

500 MHz 0:03:22 4%

800 MHz 0:10:18 14%

1000 MHz 0:01:49 2%
[AT&T Samsung Galaxy S II SGH-I777] elherr:
GAAHHH! KILL IT WITH FIRE! Your work network sucks. No further capture required. I've never seen a capture as busy with broadcast and multicast yuckiness. I don't think I've ever seen Wellfleet BOFL PDU's in a capture before. There is quite a bit of IPv6 chatter as well. All in all it does not look like a good network to connect to if running on battery.
[AT&T Samsung Galaxy S II SGH-I777] burgess_boy:
Thank you very much for the response. I had my suspicions as im losing between 8-12% of battery an hour. Think I'll be using mobile data from now on
[AT&T Samsung Galaxy S II SGH-I777] elherr:
Thank you. Now I have an example of a truly ugly wireless network. I'm still learning a great deal about the Android IP stack (and Android in general), but it appears that Linux netfilter is implemented in Android (well CM9 anyway...) as well as userspace tools. If rules are implemented at the interface (BCM4330 hardware/firmware), then one could build rules to filter unwanted traffic. I can't think of any reason for a phone to listen to IPv4 multicast (224.0.0.0/4), STP (01:80:C2:00:00:00), etc. In most situations one could ****can IPv6 in its entirety.

CM9 appears to pass everything by default.

shell@android:/ # iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
all -- anywhere anywhere ! quota globalAlert: 2097152 bytes
ACCEPT all -- anywhere anywhere
all -- anywhere anywhere owner socket exists

Chain FORWARD (policy DROP)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
all -- anywhere anywhere ! quota globalAlert: 2097152 bytes
ACCEPT all -- anywhere anywhere
all -- anywhere anywhere owner socket exists

Chain costly_shared (0 references)
target prot opt source destination
penalty_box all -- anywhere anywhere
all -- anywhere anywhere owner socket exists
ACCEPT all -- anywhere anywhere

Chain penalty_box (1 references)
target prot opt source destination

More to play with. Fun! I seem to be spending most of my time in ADB shell these days... :-)
[AT&T Samsung Galaxy S II SGH-I777] rav4kar:
Hi elherr, you are a great deal here to help us on network side.as I previously posted many times, my case is similar to that of burgess_boy! So, are these work wifi's ( which we don't have any control over at work..use it or loose it policy!) misconfigured or configured correctly for some... some... reasons such as security probes or anything . Throw us some ideas what we can go and tell network engineers at work..or how we can show them this problem on our phone while phone's connected on wifi and adb@adndroid#

makes sense?

thanks!
[AT&T Samsung Galaxy S II SGH-I777] :
Guys multipdp and wlan rx and mail app (exchange polling every 15 mins, sync disabled to try and reduce this problem) are killing me with wake lock time and count.

I already disabled IPv6 on every networked PC and on my phone, and turned off dhcp (that god rid of the dhcp wake lock it seems...).

Any other suggestion? How to track which app is connecting so often and giving problems? I already ditched Facebook for friend caster..

Thanks a lot! ;)

Sent from my SGS2 - SlimICS Rom & Fluxi Kernel
[AT&T Samsung Galaxy S II SGH-I777] elherr:
*** Using a packet sniffer (e.g., Shark for Root) on a company network is typically frowned upon. Frowned upon as in: You-Have-Been-Sniffing-My-Network-WIth-A-Rooted-Device--I-WILL-KILL-YOU-NOW! ***

Having said that, you can run Shark and look for chatty broadcast/multicast in your capture. Unfortunately, a good portion of that traffic may be required by other hosts (computers) for normal operations, so it cannot be blocked on the network. There are too many variations in network design to say for certain.

What may work out is developing netfilter (iptables in userspace) rules to block some of the traffic at the phone interface. I have not played with this yet. If we can block traffic at the WLAN interface all is good. If the traffic has to be processed by the kernel then the exercise would be pointless, as that would mean you would still be generating wakelock just to have the kernel drop the packet.

As I've said before, I'm still learning how Android works, so take what I am saying with a grain of salt -- aside from the sniffer warning at the beginning. If you want to see a network admin develop cloven hooves, a forked tail, and glowing eyes, tell him you've been running a sniffer on his network.

I have my domain hosted on Google and am syncing all services (Blogger, Browser, Calendar, Chrome Beta, Contacts, Currents, Drive, Mail, Photos, G+, etc). I also have Exchange ActiveSync Contacts, Mail, & Calendar active. On wifi I'm getting about 90% deep sleep during idle times. Obviously, when I have a truckload of email hitting my inbox this percentage declines. I'm pretty happy with this figure.

One thing that I did notice that was causing more wakes on wifi was what appeared to be Google location service scanning for nearby access points. I disabled Google location service and significantly improved sleep times. This was on CM9 0519.

DHCP should not cause issues unless the lease time is insanely short. I've set my lease time to two hours with WPA2 TKIP group rekey set to 10 minutes.

On HSDPA or 3G, my sleep time is running at 75% give or take. secril_fmt-interface and l2_hsic wakelock seem to be a couple of the top talkers. From what I am reading, 'secril_fmt-interface' is part of the Radio Interface Layer (RIL), and l2_hsic is (guessing here...) Layer 2 HSIC (High Speed Inter-Chip). HSIC is a variation on USB and is used by CPU to talk to various peripheral devices, including the phone's baseband... Bah! Learning Android is like drinking from the proverbial firehose.

If you have Shark for root installed, capture WLAN traffic during an idle period. See post #1 for instructions. I'd be happy to take a look at the capture.

Cheers,

Edward
[AT&T Samsung Galaxy S II SGH-I777] elherr:
Argh! Boo, hiss. I finally got around to adding rules and it looks like, as I feared, netfilter rules are entirely processed in the kernel. wlan_rx_wake is incrementing even though packets are being dropped. This is quite sad considering the BCM4330 has an embedded ARM processor. One would think that it would easily be able to filter traffic on chip.

Possibly there is another mechanism for pushing filters to BCM chip but I have not found one so far.

Looking at dials and switches exported via sysfs -- does not look pretty.

I've found two things now that I really miss from Linux: lsof socket support and wireless tools (iwconfig, iwlist, iwpriv, iwevent, etc).
[AT&T Samsung Galaxy S II SGH-I777] othermark:
It does install filters, look in:

/kernel/samsung/smdk4210/drivers/net/wireless/bcmdhd/src/dhd/sys/dhd_linux.c

You'll see dhd_set_packet_filter() installs the packet filter if dhcp is not in progress.

If you follow the code in there you can see filters get turned on and off depending on suspend state.

In, fact using the wpa_cli tool (in /system/bin) you can manually set the filters by using the wpa_cli 'driver' command. So....

If you want to compile your own kernel and add some trace output each time the filters are installed/uninstalled (in the suspend functions in dhd_linux.c) you can see if the filters are in place when each suspend happens.

You will then be able to see these messages in dmesg and confirm that the multicast filters are enabled when the device suspends.
[AT&T Samsung Galaxy S II SGH-I777] elherr:
I pulled smdk4210 kernel from github and am looking at the source. Since filters appear to only be pushed to BCM4330 during suspend it makes testing less than straightforward. Adding trace output might tell you that driver reports filters have been applied but is not proof-in-the-pudding.

Next week (fairly busy this weekend) I'm going to set up a test network and use one of my Linux boxes to simulate a dirty network. I'll try testing with various filter rules on and off and see what impact filters have while phone is suspended

Thanks again. I had not started looking at kernel code as yet.

Edit: This looks like something one could create some havoc with.

http://packeth.sourceforge.net/
[AT&T Samsung Galaxy S II SGH-I777] elherr:
New BCM driver drop in git tree! Entropy512 commit a few hours ago.
[AT&T Samsung Galaxy S II SGH-I777] patsmike:
Nice! Any improvements in terms of wifi wakelock/deep sleep that you've noticed?
[AT&T Samsung Galaxy S II SGH-I777] elherr:
Not promising so far. I have not compared wifi related wakes per se, but, in a couple of 15 minute tests, I am only seeing 66-70% sleep. On 0519 I was getting 90%. Aside from moving from 0519 to 0527 setup is identical. Hmmm...
[AT&T Samsung Galaxy S II SGH-I777] :
Guys is there a simple app to see which apps are connecting to the internet and causing me 45 min of multipdp in 14hours?! :(

Wlan rx is gone down a bit after disabling dhcp at home but I mean its not even 10% less than before...this is a real bugger!!

Sent from my SGS2 - SlimICS Rom & Fluxi Kernel
[AT&T Samsung Galaxy S II SGH-I777] alacrify:
BBS and Wireshark (which are heavily discussed here) will give you the info if you dig - otherwise, it's a PITA, but you can: make a nandroid. Flash your ROM, flash Gapps (if needed), install BBS and Wireshark, and NOTHING else. See how it runs, and disable Google services till it gets to a good baseline. Then add back your apps one at a time until you find the culprit. When you're done, restore your nandroid. Painful, but you can do it in an afternoon and have it nailed down.
[AT&T Samsung Galaxy S II SGH-I777] :
Thank yo mate. I am a long time bbs user, I am not an expert but up until now I nailed the most I can in user space. About kernel wake lock and some apps' (Facebook, email) well...baboon programming maybe?! :/

About wire shark: I got just one log but saw nothing readable in it, just a helluva lot of tcp packets towards different IP addresses. What I was looking for is an app that tells me how much data each app has used in a timeframe (a bit more informative than mobile data setting screen maybe..), and also how many times it connected. This should make my life easy..to have .such a high multipdp there must be a rogue app doing it every few seconds... :@

Sent from my SGS2 - SlimICS Rom & Fluxi Kernel
[AT&T Samsung Galaxy S II SGH-I777] alacrify:
I use 3G Watchdog Pro - it will show you data by application. I'm sure there are others, it works great for me.
[AT&T Samsung Galaxy S II SGH-I777] :
The info I was looking for ;) tomorrow or in two days I'll try and report back any question (or maybe solution..) I come up with!! ;)

Thanks you for your help!

Sent from my SGS2 - SlimICS Rom & Fluxi Kernel
[AT&T Samsung Galaxy S II SGH-I777] elherr:
The problem with usage based tools is that bandwidth use is not necessarily going to correspond with number of times the phone has to go through suspend/resume cycles. Even a couple of packets can wake the phone.

If you want to make a little more sense of a dump in Wireshark, you can use the 'Conversations' tool in the 'Statistics' dropdown menu. It has tabs for Ethernet, IP, TCP, & UDP. It will show a connection based view instead of a linear packet dump.

Also -- you can, to a certain extent, determine which applications are talking by looking at the network socket. A socket is the combination of IP address and port number.

In Windows command line or ADB shell you can use the 'nslookup' command to determine if the IP address has a DNS PTR record. For example:

shell@android:/ $ nslookup 173.194.79.191
Server: 10.10.10.1
Address 1: 10.10.10.1 gate.nebula.lan

Name: 173.194.79.191
Address 1: 173.194.79.191 pb-in-f191.1e100.net

Anything with a name that ends in '1e100.net' belongs to Google (10^100 = 1 googol by the way... Google geekiness).

In addition to the IP address you can look up ports that correspond to services.

TCP 5222 = Google Talk

TCP 5228 = Google Play

TCP 443 = HTTPS (also most email) **Edit: email uses 443 from what I have seen on my phone.*** Normal desktop email many times uses TCP 143 (IMAP).

UDP 53 = DNS