Mysterious Android connectivity - part 2

(Continued from part 1.)

Running OS Monitor and clicking the Connection tab gives you a little more information than the command line; anything with a SYN_SENT status is not working correctly.

Google Bookmarks Sync

wg-in-f188.1e100.net:5228 SYN_SENT

Google Services Framework
wg-in-f188.1e100.net:5228 SYN_SENT

Samsung Push Service

eu.west-1.compute.amazonaws.com:5223  SYN_SENT

AllShare Service

(Appears to be attempting to connect to something on my subnet) SYN_SENT

So let's try disabling some things

Settings > Accounts and sync

I have everything but Google disabled, and within Google I have the following ticked:
Sync Blogger
Sync Calendar
Sync Chrome
Sync Contacts
Sync Gmail
Sync Internet

So untick all those, disable Accounts and sync for double-measure and restart the phone (not sure if it needs a restart, but hey.)

And the result? It's still syncing stuff!
  
Samsung Push Service

eu.west-1.compute.amazonaws.com:5223  SYN_SENT

Google Contacts Sync

wg-in-f188.1e100.net:5228 SYN_SENT

So Google contacts may be syncing on startup regardless.

After ten minutes or so all the SYN_SENTs timeout, but Google Services Framework soon starts up again and fails to fully establish a connection. Perhaps we could make it use port 443 instead? (Like Maps and several other things do quite successfully.)

Commands available to the basic KBOX installation

sdcard$ cd $KBOX

kbox$ cd bin

bin$ pwd

/data/data/com.myboyfriendisageek.airterm/files/kbox/bin

bin$ ls

[                  ifplugd            rm

[[                 ifup               rmdir

acpid              inetd              rmmod

add-shell          init               route

addgroup           insmod             rpm

adduser            install            rpm2cpio

adjtimex           ionice             rsync

ar                 iostat             rsync_daemon.sh

arp                ip                 rtcwake

arping             ipaddr             run-parts

ash                ipcalc             runlevel

awk                ipcrm              runsv

base64             ipcs               runsvdir

basename           iplink             rx

bash               iproute            scp

beep               iprule             scp.bin

blkid              iptunnel           script

blockdev           kbd_mode           scriptreplay

bootchartd         kbox_shell         sed

brctl              kill               sendmail

bunzip2            killall            seq

busybox            killall5           setarch

bzcat              klogd              setconsole

bzip2              last               setfont

cal                length             setkeycodes

cat                less               setlogcons

catv               linux32            setsid

chat               linux64            setuidgid

chattr             linuxrc            sh

chgrp              ln                 sha1sum

chmod              loadfont           sha256sum

chown              loadkmap           sha512sum

chpasswd           logger             showkey

chpst              login              slattach

chroot             logname            sleep

chrt               logread            smemcap

chvt               losetup            softlimit

cksum              lpd                sort

clear              lpq                split

cmp                lpr                ssh

comm               ls                 ssh_daemon.sh

cp                 lsattr             start-stop-daemon

cpio               lsmod              start_bash.sh

crond              lspci              stat

crontab            lsusb              strace

cryptpw            lzcat              strings

cttyhack           lzma               stty

cut                lzop               su

date               lzopcat            sulogin

dc                 make_ssh_keys.sh   sum

dd                 makedevs           sv

deallocvt          makemime           svlogd

delgroup           man                swapoff

deluser            md5sum             swapon

depmod             mdev               switch_root

devmem             mesg               sync

df                 microcom           sysctl

dhcprelay          mkdir              syslogd

diff               mkdosfs            tac

dirname            mke2fs             tail

dmesg              mkfifo             tar

dnsd               mkfs.ext2          tcpsvd

dnsdomainname      mkfs.minix         tee

dos2unix           mkfs.vfat          telnet

dropbear           mknod              telnet_daemon.sh

dropbearkey        mkpasswd           telnetd

du                 mkswap             test

dumpkmap           mktemp             tftp

dumpleases         modinfo            tftpd

echo               modprobe           time

ed                 more               timeout

egrep              mount              top

eject              mountpoint         touch

env                mpstat             tr

envdir             mt                 traceroute

envuidgid          mv                 traceroute6

ether-wake         nameif             true

expand             nbd-client         tty

expr               nc                 ttysize

fakeidentd         netstat            tunctl

false              nice               udhcpc

fbset              nmeter             udhcpd

fbsplash           nohup              udpsvd

fdflush            nslookup           umount

fdformat           ntpd               uname

fdisk              od                 uncompress

fgconsole          openvt             unexpand

fgrep              passwd             uniq

find               patch              unix2dos

findfs             pgrep              unlzma

flock              pidof              unlzop

fold               ping               unxz

free               ping6              unzip

freeramdisk        pipe_progress      uptime

fsck               pivot_root         usleep

fsck.minix         pkill              utelnetd

fsync              pmap               uudecode

ftpd               popmaildir         uuencode

ftpget             poweroff           vconfig

ftpput             powertop           vi

fuser              printenv           vim

getopt             printf             vlock

getty              ps                 volname

grep               pscan              wall

gunzip             pwd                watch

gzip               raidautorun        watchdog

halt               rdate              wc

hd                 rdev               wget

hdparm             readahead          which

head               readlink           who

hexdump            readprofile        whoami

hostid             realpath           xargs

hostname           reboot             xz

httpd              reformime          xzcat

hwclock            remove-shell       yes

id                 renice             zcat

ifconfig           reset              zcip

ifdown             resize

ifenslave          rev

X Server

I haven't used it in anger but it certainly sounds interesting.

Take a look at "X Server"

Vim on Android

I was cross to find the once ubiquitous vi was notable only by its absence from Android. You could try an app like Vim Touch, or take a look at AirTerm. While AirTerm's window is a little imposing on the S3, it's worth it for the KBOX (BusyBox) implementation alone. 

List of commands available to the Android shell

ls /system/bin

Many of these are actually symbolic links to Android toolbox (which is a cut-down Busybox.)

LE_dut
adb
am
app_process
applypatch
bcm4334.hcd
bcm4334_murata.hcd
bcm4334_semco.hcd
bcm_dut
bintvoutservice
bluetoothd
bmgr
bootanimation
brcm_patchram_plus
brcm_poke_helper
bu
bugreport
cat
chmod
chown
cmp
csview
dalvikvm
date
dbus-daemon
dd
ddexe
debuggerd
dexopt
df
dhcpcd
diagexe
dmesg
dnsmasq
drmserver
dttexe
dumpstate
dumpsys
e2fsck
fsck.exfat
fsck_msdos
gbias
getevent
getprop
gps.cer
gpsd
gzip
hciattach
hd
hostapd
icd
id
ifconfig
iftop
ime
immvibed
input
insmod
installd
insthk
ioctl
ionice
ip
ip6tables
iptables
keystore
kiesexe
kill
linker
ln
log
logcat
logwrapper
lpmkey
ls
lsmod
lsof
macloader
make_ext4fs
mcDriverDaemon
mediaserver
mfgloader
mkdir
mkfs.exfat
mksh
monkey
mount
mtpd
mv
nandread
ndc
netcfg - similar sort of info you'd expect from ifconfig; I see lo, sit0, ip6tnl0, rmnet0/1/2, plus wlan0 if wifi is enabled when rmnet0 reverts to 0.0.0.0.
netd
netstat - current connections and their states (LISTEN, SYN_SENT, etc).

newfs_msdos
notified_event
notify
npsmobex
omx_tests
pand
ping
playlpm
pm - package manager, type: pm list packages
pppd
printenv
ps
racoon
reboot
renice
rild
rm
rmdir
rmmod
route
run-as
samsungani
samsungpowersoundplay
schedtest
schedtop
scranton_RD
screencap
screenshot
sdcard
sdptool
sendevent
sensorservice
service
servicemanager
setconsole
setprop
setup_fs
sh
simg2img
sleep
smd
smdexe
start
stop
surfaceflinger
svc
sync
system_server
tc
toolbox
top
touch
umount
uptime
vdc
vmstat
vold
watchprops
wipe
wlandutservice
wpa_supplicant

S3 HDMI cable

Useful with Netflix

Android directory structure

Samsung S3

Ran the following in a shell and processed the text file.

ls -alR > /sdcard/Download/structure.txt

/
    acct
    cache
    config
    data
    dev
    efs
    lib
        modules
    mnt
    preload
    proc
    root
    sbin
    sys
        module
        etc
            hosts - contains only localhost
 
    system

Mysterious Android connectivity

I noticed my phone was constantly downloading when connected to my work's "guest" wifi (which is known to block ports).

Further investigation with netcfg on the device revealed an https connection to Facebook:

tcp6       0      0 ::ffff:myip:50498 ::ffff:69.171.234.22:443 ESTABLISHED

This resolves to:

69.171.234.22

api-read-slb-10-08-prn1.facebook.com

And two further half open connections:

tcp6       1      0 ::ffff:myip:33008 ::ffff:74.125.132.188:5228 SYN_SENT

tcp6       0      0 ::ffff:myip:50067 ::ffff:176.34.110.161:5223 SYN_SENT

These resolve to:

74.125.132.188:5228 

wb-in-f188.1e100.net (Google - 1e100 is a Googol)
176.34.228.161:5223
ec2-176-34-228-161.eu-west-1.compute.amazonaws.com

Do those ports fall within the blocked port range?

The Amazon connection could be anything that uses the Amazon S3 cloud; I'm using Dropbox, Netflix, Spotify and ChatOn (hmm, see ChatOn grumble) at the moment.

Unknown listeners

There are, however, several unknown processes waiting for a connection:

tcp       0      0 127.0.0.1:7203         0.0.0.0:*              LISTEN
tcp       0      0 127.0.0.1:16714        0.0.0.0:*              LISTEN
tcp       0      0 127.0.0.1:32500        0.0.0.0:*              LISTEN
tcp6       0      0 ::ffff:127.0.0.1:38573 :::*                   LISTEN

Resources

* http://android.stackexchange.com/questions/6851/how-can-i-uninstall-applications-that-are-locked-by-phone-vendor
* http://wiki.cyanogenmod.com/wiki/Barebones

(Continued http://viandroid.blogspot.co.uk/2012/09/mysterious-android-connectivity-part-2.html)