Traffic Analyzer Statistics

[Preskitt.man]

I've often looked at the Traffic Analyzer Statistic page on my AC86U, but primarily for All Clients over various periods of time. Out of curiosity, I just narrowed that focus by client to look at my Galaxy S20 phone. Mostly what I saw was expected and unremarkable. But I did see some low volume traffic for apps such as Yahoo, Skype and Twitter. 30KB for example for Skype. Thing is, I don't even have those apps installed on my phone nor do I go there via the web browser. I am seeing these numbers on a daily basis. Very curious about these. Does anyone have any ideas?

 

[Travelor]

386.3_2@Preskitt.man
I do see some anomalies in the reporting on the STATISTIC page (TrafficAnalyzer_Statistic.asp). I am seeing WhatsApp showing up on a phone that my preteen son is using. I made the assumption that my son is on the cusp of being a teen and spreading his wings a little, though he does maintain his innocence. The APP isn't installed "now" but I do keep seeing his phone having some activity with the APP -
I haven't yet searched the forum yet for possible solutions, that's next, but I did want to chime in on your start of the the discussion.

My Network
400+MB WAN on Netgear CM11000
AX11000 with ASUSWRT-Merlin 386.3_2

 

[Preskitt.man]

Very curious - maybe it's just a feature of Android that it has some core elements that will check certain web services. I've got no other explanation. There is nothing on my network, phone or otherwise, that is talking to Twitter or Skype. The apps are not installed on my phone. Nor does my wife use those apps. And Traffic Analyzer definitely shows them coming from my phone. Not enough data to be useful for anything. But still there never the less

 

[Travelor]

It is a bit of a mystery, and I am not sure this is something Merlin development/support may have knowledge.
The reports appear to be generated through the TrendMicro engine/filter/monitor/system. As we are required to agree to the TrendMicro intrusion agreement. I rant the system thru a private DNS. Which only provides data when the DNS is hit with the domain request, which could easily be a cloudflare azure or aws domain which may not have any indication it's Skype Twitter or other messenge app or device.

As such I'm looking at the other reporting capabilities of Merlin to see if maybe TCPDUMP will help reveal more detail.