While playing around with the final 2.0 I noticed that lots of apps appear to be doing network activity that don’t really have a network component, so I fired up a packet sniffer, dropped the phone into Airplane mode, and then enabled the wireless to force all network traffic out a router that I could sniff.
Some interesting surprises about Epocrates Rx.
The first is that during startup it sends your firmware revision, device name and device ID to their servers. Not sure they could do much with that, and I think they are probably just trying to gather statistics.
The second though is that some component of the software continues to run in the background after you have quit the app.
A few seconds after quitting I noticed this traffic:
20:20:36.744796 IP 10.10.10.248.49400 > 63.241.66.151.http: F 215:215(0) ack 24179 win 32806
At first I though it was just a stray packet still making its way out the wire after I quit. But during the testing of the next app the traffic continued. About once a minute some program was trying to connect to http://63.241.66.151/
20:21:08.786246 IP 10.10.10.248.49400 > 63.241.66.151.http: F 215:215(0) ack 24179 win 32806
20:22:12.873043 IP 10.10.10.248.49400 > 63.241.66.151.http: F 215:215(0) ack 24179 win 32806
20:23:16.960316 IP 10.10.10.248.49400 > 63.241.66.151.http: F 215:215(0) ack 24179 win 32806
20:24:21.048086 IP 10.10.10.248.49400 > 63.241.66.151.http: F 215:215(0) ack 24179 win 32806
20:25:25.129605 IP 10.10.10.248.49400 > 63.241.66.151.http: F 215:215(0) ack 24179 win 32806
20:26:29.211306 IP 10.10.10.248.49400 > 63.241.66.151.http: F 215:215(0) ack 24179 win 32806
20:27:33.293013 IP 10.10.10.248.49400 > 63.241.66.151.http: F 215:215(0) ack 24179 win 32806
20:28:37.374242 IP 10.10.10.248.49400 > 63.241.66.151.http: R 216:216(0) ack 24179 win 32806
A quick nslookup returns:
%nslookup 63.241.66.151
151.66.241.63.in-addr.arpa canonical name = 151.epocrates.com.
151.epocrates.com name = honors.epocrates.com.
Is this proof that an app can communicate after it terminates? Or just a quirk of the iPhone OS?
– Added 7/14–
Followup: Looks like it isn’t an artifact of the OS but an intentional setting that allows apps to keep network connections open in the background.
