Researchers Capture 72 Hours of Idle Android Network Traffic Behind pfSense Firewall

Measuring Background Data Drain on Idle Hardware

A privacy research team conducted a 72-hour continuous packet capture of an idle Android smartphone connected behind a pf Sense firewall to measure unsolicited telemetry transmissions. The study, part of the 2026 DeGoogle Mobile Telemetry Study, aimed to quantify data sent to Google when the device was not actively in use. The dataset, released under a Creative Commons Attribution 4.0 license, provides empirical evidence of background network activity from a stock Android device.

The experiment used a controlled network environment where all traffic from the phone was routed through a pf Sense firewall for logging and analysis. Researchers recorded every packet transmitted during the three-day period, focusing on connections to Google-owned domains and services. The goal was to understand the scope of automated data collection that occurs even when users are not interacting with their devices. This type of measurement is critical for users seeking to minimize digital footprints and reduce reliance on major tech platforms.

During the 72-hour window, the Android device maintained persistent connections to multiple Google endpoints, including but not limited to Google Play Services, Firebase, and Google Analytics infrastructure. Even with screen-off and no user interaction, the phone periodically transmitted location pings, device health metrics, and usage statistics. Researchers noted that much of this traffic was encrypted, making payload inspection difficult without deeper protocol analysis. The dataset reveals hundreds of distinct network flows, many occurring at regular intervals, suggesting scheduled sync or heartbeat mechanisms.

Can Users Truly Disconnect from Google Services?

The team also observed that certain system-level processes initiated network requests independently of installed applications. These included automatic time synchronization, certificate validation checks, and firmware update probes. While some of these behaviors are expected for basic device functionality, others appear to serve analytics or advertising purposes. The dataset includes timestamps, source and destination IP addresses, port numbers, and byte counts for each flow, enabling further community-driven analysis.

The findings raise questions about the feasibility of fully degoogling an Android experience without sacrificing core functionality. Many essential services, such as app updates and push notifications, rely on Google's infrastructure. However, the volume of idle traffic suggests that even minimal interaction may result in ongoing data exposure. Researchers hope the open dataset will empower developers and privacy advocates to build better tools for monitoring and blocking unwanted telemetry.

Looking ahead, the research team plans to expand the study to include iOS devices and various custom ROMs. They also intend to analyze traffic patterns across different geographic regions, as data routing may vary based on server proximity and regulatory environments. For now, the dataset serves as a valuable resource for anyone interested in mobile privacy and network transparency.

Frequently Asked Questions

What type of data was captured during the study? The dataset includes raw network packets containing metadata such as IP addresses, ports, timestamps, and packet sizes. Due to encryption, full content payloads were not accessible without additional decryption steps.

How was the Android device configured for the experiment? The phone ran stock Android with default settings and was connected to a local network behind a pf Sense firewall. No modifications were made to system files or installed applications.

Is the dataset available for public use? Yes, the dataset is published under a Creative Commons Attribution 4.0 license and can be accessed through Zenodo using DOI 10.5281/zenodo.22848749. Researchers encourage reuse and citation in future studies.