Yesterday I pushed net-tools optimized for Android to my github. Main goal was to provide full-featured netstat for Android devices. By the way I succeeded to compile arp, ifconfig, rarp and route utilities. Feel free to clone.
Additionally while playing with netstat compiled that way I noticed that not all connections are listed. It is interesting because the connection I found out to be hidden is something called C2DM or its successor GCM and that connection is started just after establishing Internet connection (so probably Google knows about every wifi and 3g connection you use) and attempt to find application responsible for this failed because of this strange netstat behavior so all I know now is that it is using some kind of custom protocol to send strange, probably compressed or encrypted data straight way to uncle Google.
Due to the fact that it uses mtalk.google.com domain I suspected Talk app for this but uninstalling it didn’t help. The more successful approach was to add this domain to /etc/hosts and the other option is to add iptables rule to block this traffic. It is fairly easy because it is using non-standard port (5228) so we can just do
iptables -A OUTPUT -p tcp --dport 5228 -j DROP |
Disadvantage of the second method is that it has to be done after each system reboot. There will also be few FIXMEs from bionic libc but nevertheless it will work.
BTW: If you are interested in looking at that traffic it can be hijacked using tcpdump on your Android device.