Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

Note that there are no "beacons" in the Wi-Fi sense, just packets going to a domain whose name begins with "beacon-handoff". appears to be something Google-related; there's some code in Google's Chromium that uses it, and a VMware "Network Requirements for Android" page also mentions several Google domains, including

So those TCP connections are probably some flavor of Android phoning home.

The traffic is probably talking to Akamai "edge cache" machines that store Web pages closer (in network-hop terms) to your machine - i.e., closer to the "edge" of the network - than the server is. I'll bet that the [a-z] is the same, with "Akamai" replaced by "Microsoft" (I'm guessing you're not running Microsoft's Edge browser on your phone, so that's probably not what the "edge" is).

MDNS is "Multicast DNS", which is used to do local host name lookup and service discovery. (Bonjour! :-)) The CACHE-FLUSH message is used when announcing services; as the Wikipedia page in question says, "The CACHE-FLUSH bit is used to instruct neighbor-nodes that the record should overwrite, rather than be appended onto, any existing cached entries...". is an antivirus company, so the traffic is probably antivirus-related (checking for, or receiving, new definitions for new viruses?). is LinkedIn.

The ICMPv6 packets with "Neighbor" in the name are part of the Neighbor Discovery Protocol, doing network configuration.