Constantly high data consumption [answered]

Question

2

Constantly high data consumption [answered]

asked 2014-11-18 13:12:44 +0300

rzjack
56 ●1 ●1 ●6

updated 2016-08-17 11:07:03 +0300

jiit

2678 ●32 ●58 ●59

admin

Hello, my Jolla device is constantly sending and receiving data, no matter if I'm connected to wi-fi or to mobile data. This problem has also been discussed here with a proposed solution, but that does not work for me: https://together.jolla.com/question/47313/huge-data-consumption-after-latest-os-update/

I already tried to delete the mail account and the mail app, and I also killed the media tracker services as explained in the link above. But the device is still sending and receiving constantly data, although no apps are opened and absolutely no accounts exist on the device (except the jolla account). I hope that this bug (?) will be fixed soon, as it is a complete show stopper for me. I can't use a device which is constantly wasting my data plan.

I hope that someone has noticed a similiar issue with his/her device and can help me.

edit retag flag offensive reopen delete

The question has been closed for the following reason "the question is answered, an answer was accepted" by nthn
close date 2014-11-19 18:31:54.518274

Comments

1

It would help if you could get a sniffer log (tcpdump) of the traffic together with "netstat -tup" output ran as a root.

Otherwise it is just guessing.. like it could be an android app working on the background.

tigeli ( 2014-11-18 13:30:29 +0300 )edit

1

Check with netstat which services are active. Normally you should not have more than this:

[root@Jolla nemo]# netstat -a -n | grep -v unix

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0 127.0.0.1:53                0.0.0.0:*                   LISTEN      
tcp        0      0 ::1:53                      :::*                        LISTEN      
tcp        0      0 :::22                       :::*                        LISTEN      
tcp        0      0 ::ffff:192.168.3.18:22      ::ffff:192.168.3.8:38800    ESTABLISHED 
udp        0      0 127.0.0.1:53                0.0.0.0:*                               
udp        0      0 0.0.0.0:67                  0.0.0.0:*                               
udp        0      0 ::1:53                      :::*

Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node Path

Anything else might be some app sending/recieving data.

Or

[root@Jolla nemo]# netstat -tanup

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0      0 127.0.0.1:53                0.0.0.0:*                   LISTEN      877/connmand        
tcp        0      0 ::1:53                      :::*                        LISTEN      877/connmand        
tcp        0      0 :::22                       :::*                        LISTEN      1/systemd           
tcp        0      0 ::ffff:192.168.3.18:22      ::ffff:192.168.3.8:38800    ESTABLISHED 1/systemd           
udp        0      0 127.0.0.1:53                0.0.0.0:*                               877/connmand         
udp        0      0 0.0.0.0:67                  0.0.0.0:*                               2703/udhcpd         
udp        0      0 ::1:53                      :::*                                    877/connmand

Philippe De Swert ( 2014-11-18 13:32:28 +0300 )edit

Thankyou both for your answers.

This is the output from netstat -a -n | grep -v unix:

Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State      
tcp        0      0 127.0.0.1:53                0.0.0.0:*                   LISTEN      
tcp        0      0 192.168.0.111:49992         54.171.11.122:443           TIME_WAIT   
tcp        0      0 192.168.0.111:49991         54.171.11.122:443           TIME_WAIT   
tcp        0      0 192.168.0.111:59060         208.43.122.143:443          ESTABLISHED 
tcp        0      0 ::1:53                      :::*                        LISTEN      
tcp        0      0 :::22                       :::*                        LISTEN      
udp        0      0 127.0.0.1:53                0.0.0.0:*                               
udp        0      0 192.168.0.111:53314         192.168.0.1:53              ESTABLISHED 
udp        0      0 192.168.0.111:44098         192.168.0.1:53              ESTABLISHED 
udp        0      0 192.168.0.111:58197         192.168.0.1:53              ESTABLISHED 
udp        0      0 ::1:53                      :::*

And this is the output from tcpdump ... I can see that the device is connecting to softlayer on port 443. That may be the problem, correct? Do you have any ideas what is causing this issue?

12:52:16.220806 00:0e:58:8f:0a:bc (oui Unknown) Null > 01:80:c2:00:00:00 (oui Unknown) Unknown DSAP 0x80 Information, send seq 0, rcv seq 7, Flags [Command], length 38
12:52:17.143162 IP 208.43.122.143-static.reverse.softlayer.com.https > 192.168.0.111.59060: Flags [P.], seq 2707457606:2707457634, ack 3149495420, win 514, options [nop,nop,TS val 1150595386 ecr 49376], length 28
12:52:17.143590 IP 192.168.0.111.59060 > 208.43.122.143-static.reverse.softlayer.com.https: Flags [.], ack 28, win 123, options [nop,nop,TS val 50666 ecr 1150595386], length 0
12:52:17.242476 00:0e:58:8f:0a:bc (oui Unknown) > Broadcast, ethertype Unknown (0x6970), length 74: 
    0x0000:  010e 58dd dddd 000e 588f 0abc 6970 0101  ..X.....X...ip..
    0x0010:  005e 37d4 b4a5 a5a5 a5a5 a5a5 a5a5 a5a5  .^7.............
    0x0020:  a5a5 a5a5 a5a5 a5a5 a5a5 a5a5 a5a5 a5a5  ................
    0x0030:  a5a5 a5a5 a5a5 a5a5 a5a5 a5a5            ............
12:52:17.243544 00:0e:58:8f:0a:bc (oui Unknown) Null > 01:80:c2:00:00:00 (oui Unknown) Unknown DSAP 0x80 Information, send seq 0, rcv seq 7, Flags [Command], length 38
12:52:17.951616 IP 192.168.0.111.58197 > 192.168.0.1.domain: 18502+ PTR? 143.122.43.208.in-addr.arpa. (45)
12:52:17.968006 IP 192.168.0.1.domain > 192.168.0.111.58197: 18502 1/0/0 PTR 208.43.122.143-static.reverse.softlayer.com. (102)
12:52:17.970417 IP 192.168.0.111.58197 > 192.168.0.1.domain: 46204+ PTR? 111.0.168.192.in-addr.arpa. (44)
12:52:17.980397 IP 192.168.0.1.domain > 192.168.0.111.58197: 46204 NXDomain* 0/1/0 (79)
12:52:18.260483 IP 208.43.122.143-static.reverse.softlayer.com.https > 192.168.0.111.59060: Flags [P.], seq 28:55, ack 1, win 514, options [nop,nop,TS val 1150596606 ecr 50666], length 27
12:52:18.260605 IP 192.168.0.111.59060 > 208.43.122.143-static.reverse.softlayer.com.https: Flags [.], ack 55, win 123, options [nop,nop,TS val 50778 ecr 1150596606], length 0
12:52:18.268509 00:0e:58:8f:0a:bc (oui Unknown) Null > 01:80:c2:00:00:00 (oui Unknown) Unknown DSAP 0x80 Information, send seq 0, rcv seq 7, Flags [Command], length 38
12:52:18.985402 IP 192.168.0.111.58197 > 192.168.0.1.domain: 42561+ PTR? 1.0.168.192.in-addr.arpa. (42)
12:52:19.006462 IP 192.168.0.1.domain > 192.168.0.111.58197: 42561 NXDomain* 0/1/0 (77)
12:52:19.290759 00:0e:58:8f:0a:bc (oui Unknown) Null > 01:80:c2:00:00:00 (oui Unknown) Unknown DSAP 0x80 Information, send seq 0, rcv seq 7, Flags [Command], length 38
12:52:20.214580 IP 192.168.0.107.59000 > 239.255.255.250.ssdp: UDP, length 94
12:52:20.214794 IP 192.168.0.107.59000 > 239.255.255.250.ssdp: UDP, length 94
12:52:20.216503 IP 192.168.0.107.59000 > 239.255.255.250.ssdp: UDP, length 94
12:52:20.217601 00:0e:58:8f:0a:bc (oui Unknown) Null > 01:80:c2:00:00:00 (oui Unknown) Unknown DSAP 0x80 Information, send seq 0, rcv seq 7, Flags [Command], length 38
12:52:20.627185 IP 208.43.122.143-static.reverse.softlayer.com.https > 192.168.0.111.59060: Flags [P.], seq 55:87, ack 1, win 514, options [nop,nop,TS val 1150598921 ecr 50778], length 32
12:52:20.627307 IP 192.168.0.111.59060 > 208.43.122.143-static.reverse.softlayer.com.https: Flags [.], ack 87, win 123, options [nop,nop,TS val 51015 ecr 1150598921], length 0

rzjack ( 2014-11-18 13:58:48 +0300 )edit

tcp 0 0 192.168.0.111:59060 208.43.122.143:443 ESTABLISHED

This is the softlayer.com-connection, but you did not have "-p"-flag on the netstat-command so I can't tell the name of the executable which is using the connection. Could you rerun netstat with "-tupn" flags?

Anyway, Jolla does not have anything to do with softlayer.com.

tigeli ( 2014-11-18 15:05:21 +0300 )edit

Okay, here's the output of netstat -tupn:

Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
udp        0      0 192.168.0.111:43696         192.168.0.1:53              ESTABLISHED 773/connmand        
udp        0      0 192.168.0.111:58054         192.168.0.1:53              ESTABLISHED 773/connmand        
udp        0      0 192.168.0.111:44317         192.168.0.1:53              ESTABLISHED 773/connmand

The softlayer-connection is currently gone, but the device is still sending data constantly. The tcpdump tells me that there are several SSDP-broadcast each second (see my comment above, for example this entry:

12:52:20.214580 IP 192.168.0.107.59000 > 239.255.255.250.ssdp: UDP, length 94

Do you think it would be possible to avoid the data consumption by disabling SSDP? Or are there some other things that I can try to do?

rzjack ( 2014-11-18 16:14:37 +0300 )edit

It would help if you could get a sniffer log (tcpdump) of the traffic together with "netstat -tup" output ran as a root.
Otherwise it is just guessing.. like it could be an android app working on the background.
tigeli ( 2014-11-18 13:30:29 +0300 )edit
Check with netstat which services are active. Normally you should not have more than this:
[root@Jolla nemo]# netstat -a -n | grep -v unix Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN tcp 0 0 ::1:53 :::* LISTEN tcp 0 0 :::22 :::* LISTEN tcp 0 0 ::ffff:192.168.3.18:22 ::ffff:192.168.3.8:38800 ESTABLISHED udp 0 0 127.0.0.1:53 0.0.0.0:* udp 0 0 0.0.0.0:67 0.0.0.0:* udp 0 0 ::1:53 :::*
Active UNIX domain sockets (servers and established) Proto RefCnt Flags Type State I-Node Path
Anything else might be some app sending/recieving data.
Or
[root@Jolla nemo]# netstat -tanup Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 877/connmand tcp 0 0 ::1:53 :::* LISTEN 877/connmand tcp 0 0 :::22 :::* LISTEN 1/systemd tcp 0 0 ::ffff:192.168.3.18:22 ::ffff:192.168.3.8:38800 ESTABLISHED 1/systemd udp 0 0 127.0.0.1:53 0.0.0.0:* 877/connmand udp 0 0 0.0.0.0:67 0.0.0.0:* 2703/udhcpd udp 0 0 ::1:53 :::* 877/connmand
Philippe De Swert ( 2014-11-18 13:32:28 +0300 )edit
tcp 0 0 192.168.0.111:59060 208.43.122.143:443 ESTABLISHED
This is the softlayer.com-connection, but you did not have "-p"-flag on the netstat-command so I can't tell the name of the executable which is using the connection. Could you rerun netstat with "-tupn" flags?
Anyway, Jolla does not have anything to do with softlayer.com.
tigeli ( 2014-11-18 15:05:21 +0300 )edit
Okay, here's the output of netstat -tupn:
Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name udp 0 0 192.168.0.111:43696 192.168.0.1:53 ESTABLISHED 773/connmand udp 0 0 192.168.0.111:58054 192.168.0.1:53 ESTABLISHED 773/connmand udp 0 0 192.168.0.111:44317 192.168.0.1:53 ESTABLISHED 773/connmand
The softlayer-connection is currently gone, but the device is still sending data constantly. The tcpdump tells me that there are several SSDP-broadcast each second (see my comment above, for example this entry:
12:52:20.214580 IP 192.168.0.107.59000 > 239.255.255.250.ssdp: UDP, length 94
Do you think it would be possible to avoid the data consumption by disabling SSDP? Or are there some other things that I can try to do?
rzjack ( 2014-11-18 16:14:37 +0300 )edit

Accepted Answer

2

answered 2014-11-19 12:46:57 +0300

rzjack
56 ●1 ●1 ●6

@tigeli @Markkyboy: I've done some more research and figured out the following things: 1) The SSDP broadcasts are apparently created by the Sonos Controller Android app. But they only occur when connected to WiFi, and that is okay. 2) The softlayer-connections are consuming much data in both WiFi and mobile data mode and are related to the mitakuuluu whatsapp client. That is the real problem here. So I think everything with Jolla is fine. Your suggestions helped me a lot to figure out the real problem. Really appreciate that.

edit flag offensive delete publish link

Comments

@rzjack : That's why we sailors try to keep an eye on this. Glad to see we could help.

Philippe De Swert ( 2014-11-19 13:52:37 +0300 )edit

Constantly high data consumption [answered]

The question has been closed for the following reason "the question is answered, an answer was accepted" by nthn
close date 2014-11-19 18:31:54.518274

Comments

1 Answer

Comments

Question tools

Stats

Related questions

Constantly high data consumption [answered]

The question has been closed for the following reason "the question is answered, an answer was accepted" by nthn close date 2014-11-19 18:31:54.518274

Comments

1 Answer

Comments

Question tools

Public thread

Stats

Related questions

The question has been closed for the following reason "the question is answered, an answer was accepted" by nthn
close date 2014-11-19 18:31:54.518274