""ET INFO Android Device Connectivity Check""

SID: 2036220

Revision: 3

Class Type: misc-activity

Metadata: affected_product Android, attack_target Mobile_Client, created_at 2018_09_14, deployment Perimeter, deployment Internal, performance_impact Low, signature_severity Informational, tag Connectivity_Check, updated_at 2023_05_01

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "GET"

  • Value: "/generate_204"

  • Value: "Host|3a 20|connectivitycheck.gstatic.com|0d|"

  • Value: "Accept-Encoding|3a 20|gzip|0d|"

  • Value: !"Cache"

  • Value: !"Referer|3a|"

Within:

PCRE:

Special Options:

  • http_method

  • http_uri

  • fast_pattern

  • http_header

  • http_header

  • http_header

source