yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] pandata000:
You're welcome! :good:
[Android Apps and Games] pandata000:
Playing with it, I found some interesting "unexpected" connections:

For example - the ES File Explorer (one of the best file managers for me) is connecting to IP in Beijing, China on the HTTP port 80 ... ?

View attachment 2308464

There are no ads in their app, probably they are using some kind of tracking, but why in China? Most of the apps are using Flurry, Google Analytics, etc. :) With a saucy list of permissions granted to the app it's scary .. :)

View attachment 2308466

So, I was thinking that probably a place on the web that explains the network connections of the apps (at least the popular ones) will be a good source of security for those that want to know. What do you think ?
[Android Apps and Games] raul6:
Nice app, thanks! Working well on N4. No funny connection with ES though. Did you use its downloader maybe?
[Android Apps and Games] pandata000:
Thanks! About the ES, the connection was right after the start on cleaned prefs. It can be something from their tutorial though ?
[Android Apps and Games] pandata000:
The domain name www.estrongs.com resolves to that same IP 202.108.23.200, so it's something from their web site or something from their service.

However, this IP hosts many other China web-sites, so I'm still not sure what exactly they are using this connection for: http://sameid.net/ip/202.108.23.200/
[Android Apps and Games] MIMB:
nice app for monitoring apps

i can use this one :good:
[Android Apps and Games] fernandovg:
Current connections tab:

is it possible to have a group option (group by app, group by status(listen, established, etc)

Is it possible to have a filter?

For example i only want to see established connection from Chrome for example.

thanks for this app
[Android Apps and Games] pandata000:
Hi,

Connection grouping is more or less made in the APP Log tab - cumulative per app or by clicking on the Chrome app in APP Details screen, where you see all IPs used by the specific app.

Filter is good - I have to think how to make it from UI side of view, as I don't want to use menu buttons etc. in user navigation.

Thanks for testing and your suggestions !
[Android Apps and Games] teuf3l:
very nice, i was looking for an app like this. :good:

thanks in advance for the xda unlocker. :)
[Android Apps and Games] venu007:
Searching for a long time for this kind of app...

Now I can know what app is hogging my internet...

Thanks many times

Sent from my Micromax A110
[Android Apps and Games] hadi_rena:
Interesting application :good: now I can see which app opening a connection and where they are going. But one question: What is the diferrence between current connection with connection log with 'live capture' on :confused: sorry for noob question.

My suggestion for improvement / feature: floating bar showing D/L and U/L rate
[Android Apps and Games] venu007:
Sir.. Can u make it available to my country INDIA in playstore..

Sent from my Micromax A110
[Android Apps and Games] pandata000:
Hi, Your question is OK, as the app still don't have a doc-related material. The Current connections tab shows in live time all connections made by your device.

The Connections Log tab shows only accumulated data for the captured connections - e.g. you may start and stop the live capture over time.

Unfortunately the D/L U/L rate is not available per IP, as the app is not using netfilter/iptables logs.
[Android Apps and Games] pandata000:
Yup, sorry, try after couple of hours.
[Android Apps and Games] hadi_rena:
Thanks for the explanation and for D/L U/L rate I didn't mean per IP basis but a live global rate if possible so we can know whenever there is any connection opened or data transfer. When there is a connection opened we can see the detail in Current Connection tab.

Anyways your app is really good I can see where an app connection is establish
[Android Apps and Games] pandata000:
Thanks! I can think of such indication, however such think will drain the battery (will act like non-stop live capture, which is not good :)
[Android Apps and Games] fernandovg:
is it possible to identify multicast with your app?

My wifi is constantly downloading (no uploading). the strange is that sync is disabled.

I read on other forum that "here is something on your network that is constantly broadcasting"

How to detect that?

thanks!
[Android Apps and Games] pandata000:
Hi fernandovg,

The app reads the virtual /proc/net kernel tables, so if those connections are handled somehow 1) by your device kernel and/or 2) by any app on your phone then you will see them in the "Current Connections Tab" of the app - e.g. you will see only those packets that are intended to be received by your device.

But I suppose that you want to see all multicast/broadcast packets - in this case the app will not help you. You need a rooted device and run it in promiscuous mode and "capture" all the packets. The easiest is to use regular Linux or Windows machine, connect it on this network and use "tcpdump" in Linux or GUI based Wireshark available under linux and windows.
[Android Apps and Games] njstein:
Thanks for the free unlock code! This is app is great, nice to see which apps are doing what behind the scenes.

Sent from a Blazing PACMAN devouring ALL...
[Android Apps and Games] sml156:
Am i missing something

Removed I found my answer
[Android Apps and Games] lion7718:
Thanks for program & unlock code.
[Android Apps and Games] jktenor:
can't get unlock key to work

Call me stupid, but the unlock key has no effect on the app be it free or the 3.99 premium app.

I don't get the process of unlocking.
[Android Apps and Games] pandata000:
The free Unlock key (https://play.google.com/store/apps/details?id=com.antispycell.connmonitor.unlockxda) is for the "Network Connections" app - https://play.google.com/store/apps/details?id=com.antispycell.connmonitor

Just download it, and it will unlock the nag screen and live capture limitations.
[Android Apps and Games] roydest:
[MENTION=3778453]pandata000[/MENTION]

I just found this app, very good work ( Anti Spy Mobile too) ! I can hardly expect your next app/update, keep up the good work....

Thanks for the unlock key !!
[Android Apps and Games] pandata000:
Thank you roydest! The next one will be Connections Blocker (or something like that) - will be able to block unwanted connections, but will work only for ROOTed phones. All firewall apps that I see in the market can block per app, and I want to make one based per IP / Connection - and also linked with Network Connections :)
[Android Apps and Games] roydest:
That would be great ! Do you know the PeerBlock project here at xda? Unfortunately, the app does not work properly and the Thread seems to be dead... a working app would be awesome !
[Android Apps and Games] recurringintensity:
the key is most likely for the first/beta users to help with feedback, bugs, etc. After the preliminaries are put of the way one would assume the link be removed from the post. just speculating..
[Android Apps and Games] pandata000:
No, as far as I see it uses Xposed framework and has abilities to block per lists. My idea is to use the classic netfilter module with iptables, and to keep it simple.
[Android Apps and Games] pandata000:
Hi, As it's stated in the post, the free key made for XDA will be available until 19/10/2013. But all that have it installed by that date will be able to use it lifetime.
[Android Apps and Games] Tahoedan:
Awesome app!

I would love to stop some connections. Like right now Pandora app is closed (and has been for a few hours) but is still active on my network!?
[Android Apps and Games] zubsz:
apk installs

hey dev, you mentioned on the opening post that "it's better to use the Google Play link in order to receive further updates". Does this mean that we cannot receive updates from this and other apps that we have downloaded and installed not from the play store? thanks in advance. great app.
[Android Apps and Games] roydest:
Sounds good, I look forward to the result...
[Android Apps and Games] sordna:
what's the polling interval when the app is in the background?

Hi, thanks for the app and unlock key for xda members!

I tried the capture, put the app in the background, start Dolphin browser, go to a website, exit the browser, go back to the Network Connections app, and it's not logged. However if I leave Dolphin browser running and go back to the network connections app, I do see the browser connection to the website I visited being logged. Doesn't network capture work properly when Network Connections is in the background, and apps start, connect somewhere, and exit ? Or is there a polling interval that can make it miss some connections?
[Android Apps and Games] jasonv31:
Thanks for the great app!
[Android Apps and Games] Andre_Vitto:
Had a FC.. sent in report via the inbuilt report thing with detailed desc.. hope that helps..
[Android Apps and Games] Lim Wee Huat:
Big thanks for the great app and its unlock key! It provides very detailed information about my devices. Highly recommended!
[Android Apps and Games] pandata000:
Sure you will, I meant that you'll be notified for the new versions there. If there are any major updates, I'm updating the thread too.
[Android Apps and Games] pandata000:
Thanks! The polling interval is 2 seconds, so every connection with "established" state should be captured. The app reads the virtual /proc/net of the kernel, so it's not related with the open/exit from other apps.
[Android Apps and Games] pandata000:
Thanks Andre ! Sure, it will help! :)
[Android Apps and Games] aejazhaq:
Can in just say pandata000 you are life saver! I have been scratching my head ever since I bought my s3 and the best thing i could get to was either wireshark or using adb to log network traffic when all i needed was a simple host IP address. I will definitely give this a go tonight and see if I can dig up bugs. Ill opt in for a beta if that's an option.

FYI there's a Xposed module called peerblock. I think its open-source not sure and maybe you can get in touch with the dev and see if that helps you in implementing blocking the IPs.
[Android Apps and Games] pandata000:
Thanks for the nice words aejazhaq! Just installed the XDA key, and you'll have a lifetime premium of the app, it's not an opt for beta.

[MENTION=4621101]roydest[/MENTION] already told me about the Xposed module. I saw the thread, seems interesting, but I want to keep it simple with the netfilter module and iptables.
[Android Apps and Games] Feregorn:
Great idea! Android was lacking such a useful app. It works great on my OPPO Find 5. And what a wonderful promotion for the XDA members. That's the spirit of giving back to the community. Kudos pandata000!
[Android Apps and Games] littlewonder:
Amazing App

Exactly what I was looking for.. Easy to use, lightweight app and absolutely free. Would buy a paid version if it goes live just to support developer..

So far no issues on stock Nexus 4 running 4.3 ..
[Android Apps and Games] nickfar2000:
5 STARS AND THUMBS UP

Thank your work sir
[Android Apps and Games] sordna:
What happens might be that when I exit the browser, all persistent connections are killed. So if a website is fast and loads within 1 second, your app may not have had the time to capture the established connection, since it's short lived.

Can you add an adjustable poll interval setting? With some selections like like 2, 1, 0.5, 0.2 seconds ? (with disclaimer it will probably consume way more battery of course). However, when debugging network stuff, like the behavior of particular apps when launched, it will be very useful, because currently I can very reliably reproduce the issue of short-lived network connections not being captured. I'm on a Nexus 4 with stock android 4.3 by the way. Thanks!
[Android Apps and Games] pandata000:
Yeah, I can thing of custom polling interval, but I have to check first how it will work with smaller intervals - I have some doubts that it will be stable at all. When you reproduce it, do you see the IP in the "Current Connections Tab" ?
[Android Apps and Games] sordna:
Yes,

I can see my browser connect to the expected address in the current connections, but it does not get recorded in the capture. Bug?
[Android Apps and Games] SecUpwN:
Can someone upload the free unlock key here, please? Don't want to use PlayStore. Thanks!
[Android Apps and Games] vaiz:
:) Good
[Android Apps and Games] pandata000:
Thanks for testing! No, it's not a bug. At a very first stage the connection doesn't have the UID of the app that is using it. And that is why you see it like connection from "Android system" in the current connections tab. But its not captured because the default value in "Settings tab" is to skip connections from Android system (e.g. with 0 UID). So you can untick this one in settings and it will be captured.
[Android Apps and Games] pandata000:
The download of the free unlock key is limited until 10/19, and that is why its made to be loaded from there and not posted in the thread.
[Android Apps and Games] sordna:
Ok, thank you for the explanation. I can verify that unchecking the "Android System" option helps! By the way, if I check the option to only log established connections, again I see short browser sessions not being logged, even though for sure they establish a connection to load a webpage. I think here is where an adjustable polling interval might help! (I'm familiar with netstat on linux, and have seen how FIN/TIME/CLOSE_WAIT can linger for several seconds, making it easy to catch a connection that was made earlier, while ESTABLISHED might only be visible for a second or less). So I guess with a 2sec polling interval, my best bet to avoid missing any connection is to keep both those boxes unticked. Some help text in the app discussing the imilications of the various options would be helpful to the users.

Thanks for the nice app and for your great support !
[Android Apps and Games] alexandarr:
Great app.

Just a small observation when select Resolve IPs to Hostnames in CURRENT CONNECTIONS, it seams like there is small time interval when ip address is visible, and instantly replaced by hostname, it repeats itself every two seconds. Like its flashing.

Sorry for bad English.
[Android Apps and Games] pandata000:
I tried with 1s interval works good on N4, but makes problems on older devices. The read of the poll is not a problem, but the write at the DB. Its clear that the best will be with netfilter / tcpdump, but will limit the app to root-ed devices only. I've added a note under the "Android system" row that's good to be unticked for faster connections - will there in the next release. Thanks for your observation!
[Android Apps and Games] pandata000:
Thanks ! Yes, it's a little bit irritating - that's because the the list is updated every 2 seconds in order to show last connections. Should think of other way or hide the resolving option.
[Android Apps and Games] aejazhaq:
[MENTION=3778453]pandata000[/MENTION]

I have a slightly different question. when you open android setting and goto data usage, there always seems to be a android OS that contains some significant data usage. what exactly falls under that header? I thought since you developed the app you would definitely have a good idea. its not DNS and definitely increases when you sync so that tells me its something wild.

thanks.
[Android Apps and Games] pandata000:
Hi, I don't know what's included there - probably should look at the source code if available. Some are reporting high traffic to Google servers for Auto Backup. Personally, I don't have such problem, but it will be interesting what reports the "Network Connections" app?
[Android Apps and Games] Peterx4:
Great app

Sent from my HTC One now Free
[Android Apps and Games] Zephyr!:
Installed, will post review and bugs(if any). :)
[Android Apps and Games] abs0lut3z33r0:
Thanks for the App and the free key . Great addition to android security apps

Can anyone suggest more apps like THIS and LBE Security
[Android Apps and Games] pandata000:
Thanks!
[Android Apps and Games] polobunny:
Super app. Easy to use, will keep around for sure. Now I'm going to be curious about every app I install though. ;)
[Android Apps and Games] pandata000:
A new version (1.0.5) that fixes some ANRs and FCs is uploaded here and rolled in Google Play - see thread main post.

Thanks for all your ANR & FC reports!
[Android Apps and Games] onmyouji:
Hi, I have a question.

I found "Settings Storage" is making a connection to an IP on port 80. When I checked, the IP address belongs to my ISP network.

The strange thing is, when I tried to enter this IP address on an internet browser, it displayed a Google Search front page.

Should I be worried? Or is this normal?

Thanks
[Android Apps and Games] pandata000:
Hi,

Most probably its a Google node. If the server is from Google network, the PTR record should point to something.1e100.net Click on IP Details, and look the PTR record just below the IP Address. You can find more info on 1e100.net at: https://support.google.com/answer/174717?hl=en

Btw., all 1e100.net servers are with admin data CA 94043, US, and the Geo Location coordinates are not exact for those cases, as Google have datacenters all over the world.
[Android Apps and Games] onmyouji:
Thanks for your reply.

I've checked, the PTR doesn't point to Google. It points to my ISP (I attached some screenshots).

If you don't mind, can you try to access the IP address http://111.94.248.31 from your browser? I'm curious whether it will also displays Google front page.

Thanks.
[Android Apps and Games] pandata000:
Yep, Shows Google search page. Seems like poisoned DNS. See: http://namebench.appspot.com/id/8752031

Probably, you can ask your ISP for explanation.

Google are providing free public DNS servers so, you can set your DNS to 8.8.8.8 instead of your ISPs DNS server to avoid such issues - https://developers.google.com/speed/public-dns/docs/using
[Android Apps and Games] meanhoe:
doh. just missed it. :(
[Android Apps and Games] aejazhaq:
is it possible for a virus/bug/ROM component etc to communicate data online at a lower kernel level (i.e linux base level) instead of at the app level? and will your program detect that IP adress as well or does it just scan for the apps? if not is there another way to detect it?
[Android Apps and Games] pandata000:
In theory - yes. The app gets the info from the kernel /proc/net virtual tables. However, one case that comes in my mind is the "forwarding" flag in kernel - all forwarded connections - if your android device forwards packages (you use it as router) will be skip the /proc/net records. Unfortunately this is that best that can be done w/o root access.

The best way that eliminates any hidden connections from the kernel is to "sniff" the traffic outside the android device - e.g use wireshark, tcpdump, etc, on linux/windows router that shares the connection to your android device or at least shares same local wireless or LAN network.
[Android Apps and Games] aejazhaq:
By forwarding you mean using the phone as a hotspot/teethering? and if I happen to have root, will it then scan for those too? cause I am big on experimenting and install a lot of apps from forums and it would be nice if I have some peace of mind. By the way hows the ipfilter project coming?
[Android Apps and Games] pandata000:
Yes, exactly. If you have root, you can use some netfilter based capture apps. I'm preparing an IP blocker that uses netfilter module, but it will work only for root-ed devices.
[Android Apps and Games] littleromeo:
Network log does almost everything except that it doesn't get IP info. And that's free.

search for com.googlecode.networklog

Pity I couldn't get the unlock key coz I just saw this thread and the giveaway is over :(
[Android Apps and Games] pandata000:
networklog has different approach - it uses iptables (netfilter) and REQUIRES ROOT. Network Connections runs fine on non-rooted devices, as it reads /proc/net virtual files.
[Android Apps and Games] charlie95113:
I feel the same way I just saw it aswwell
[Android Apps and Games] aejazhaq:
---------- Post added at 04:52 PM ---------- Previous post was at 04:44 PM ----------

[/COLOR]

sorry for asking a noob question but whats the difference? a differential explanation would be great.

does that mean that it will also detect rootkit network connection?
[Android Apps and Games] pandata000:
Network Connections shows socket information from the Kernel virtual /proc/net files. The former unix "netstat", now "ss" tool uses the same data sources. Those kernel files are readable for all users (e.g. you don't need elevated root access to read them). This is a standard for all *nix OSes including Android.

The NetworkLog app is using Netfilter module (http://netfilter.org) which is a packet filtering frameware that uses hooks in the Linux kernel that allows kernel modules to register callback functions with the network stack. Those callback functions are used from utilities like iptables (former ipchains) to LOG information about the network packets. The same hooks are used in almost all firewalls for Unix-based systems. This means that you need root-ed device and kernel compiled supporting netfilter module - CM, Miui, etc. has it.

The /proc/net files are readable for all users, which means that Network Connections shows info for connections made by escalated privileged users (root). The rootkit network connections appears with 'Android system' owner in the app, and you show disable the tick "Don't log connections from Android core" in the Settings, should you need to log them.

Exporting the raw database with captured connections (from settings screen) then should ease the process of capturing suspicious ones.
[Android Apps and Games] BloodyScreen:
I have been using this app for quite some time now and I have to say that this really helped me to choose wich apps to block from accessing the internet etc.

Thank you!!
[Android Apps and Games] pandata000:
Thanks! I'm preparing an IP/APP blocking plugin to the app too. But it will require *root*, so I wanted to release it separately.
[Android Apps and Games] SecUpwN:
No need for that, there's already AFWall+. ;)
[Android Apps and Games] pandata000:
I want IP block, not per App block :)
[Android Apps and Games] pandata000:
Hi, The issue is now fixed in the latest version - v1.0.8 - rolled in Google Play, you can download it from the thread main post here too: http://xdaforums.com/attachment.php?attachmentid=2406720&d=1385052300

Thanks !
[Android Apps and Games] xdakewie:
After a factory reset on Christmas Eve I found that reinstalling the XDA unlock key* no longer works. It would be ungrateful to ask you to supply a new one, but please consider holding a New Year sale or something, thanks!

* I can tell you the exact date I originally installed the app & the unlock key via the Play Store as well as their versions, so it's not like I downloaded the key from the web after its expiry!
[Android Apps and Games] pandata000:
Thnak you for your interest ! I'm developing an IP blocking plugin for the app, that will work for rooted devices, and there will be a huge discount or giveaway on its release (most probably by the end of January 2014).
[Android Apps and Games] xdakewie:
Thank you very much for your reply!

I look forward to the new release, and would like to wish you a productive 2014!

Cheers~
[Android Apps and Games] pandata000:
Thank you ! Happy, productive and exciting 2014 to you all !

Cheers!
[Android Apps and Games] Thalinor:
Edited. False alarm I suppose.
[Android Apps and Games] pandata000:
Man, you are looking at a wrong company (look the full whois info). I respect my privacy too, but will tell you that:

1. the company, projects, etc. are not related with any government

2. If you look further at the whois record (at godaddy), you will find that it's registered in Niles, IL, not in TX, and the company are referring above is another one.

3. there is a website, but the mobile version redirects to Play Market, as there's no mobile layout available - just open antispymobile.com with regular desktop/laptop PC or change your browser user agent string

I wish you a less stressful New Year!