I captured 72 hours of idle Android packets behind pfSense
4 hours ago
- An idle Android phone sends background telemetry to Google an average of 348 times per hour, totaling over 8,300 transmissions daily, even when unused.
- The study used an external hardware wiretap to capture all outgoing packets from three Google Pixel 8 phones, avoiding software monitoring that the OS could bypass.
- The phones were locked and untouched for 72 hours on a closed Wi-Fi network, with all traffic mirrored to a pfSense firewall running Wireshark.
- Five main types of data leaks were identified: Wi-Fi router BSSIDs for location triangulation, hardware fingerprints and SIM serials, push notification heartbeats, photo sync tokens, and search widget trending queries.
- Google Play Services was the most active service, sending 142.6 requests per hour, followed by Location Services at 84.2 requests per hour.
- The full dataset is available as a CSV with detailed columns including timestamps, destination IPs, ASN, ports, payload sizes, and human-readable descriptions.
- Users can block telemetry by copying the listed Google domains into Pi-hole, AdGuard Home, or NextDNS, and the dataset is released under CC BY 4.0 for journalists and developers.
- The study provides a DeGoogle Freedom Score calculator and a step-by-step runbook for replacing Google services with privacy-focused alternatives.
- Re-measurement is planned for each Android major release and quarterly GrapheneOS updates to keep the data current.