 | 1 | initial version |
Note that there are no "beacons" in the Wi-Fi sense, just packets going to a domain whose name begins with "beacon-handoff".
gvt2.com appears to be something Google-related; there's some code in Google's Chromium that uses it, and a VMware "Network Requirements for Android" page also mentions several Google domains, including gvt2.com.
So those TCP connections are probably some flavor of Android phoning home.
The akamaiedge.net traffic is probably talking to Akamai "edge cache" machines that store Web pages closer (in network-hop terms) to your machine - i.e., closer to the "edge" of the network - than the server is. I'll bet that the [a-z]-msedge.net is the same, with "Akamai" replaced by "Microsoft" (I'm guessing you're not running Microsoft's Edge browser on your phone, so that's probably not what the "edge" is).
MDNS is "Multicast DNS", which is used to do local host name lookup and service discovery. (Bonjour! :-)) The CACHE-FLUSH message is used when announcing services; as the Wikipedia page in question says, "The CACHE-FLUSH bit is used to instruct neighbor-nodes that the record should overwrite, rather than be appended onto, any existing cached entries...".
avast.com is an antivirus company, so the traffic is probably antivirus-related (checking for, or receiving, new definitions for new viruses?).
linkedin.com is LinkedIn.
The ICMPv6 packets with "Neighbor" in the name are part of the Neighbor Discovery Protocol, doing network configuration.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
