Android Data Call: Control, netd, eBPF & Packets

Two planes: control vs data

A cellular data call is two conversations that share a radio and a kernel interface but almost no logic. Interviewers use this split as a filter. If you start an "HTTPS over LTE" answer with RRC and never name netd, or you start with sk_buff and never mention setupDataCall, you have mixed the planes.

CONTROL (once per data call)                    DATA (every packet)
App / system NetworkRequest                     App write/send / QUIC datagram
        |                                               |
Telephony DataNetwork / DcTracker               ART / libcore / bionic
        |                                               |
IRadioData.setupDataCall                        tcp_sendmsg / udp_sendmsg
        |                                               |
Modem NAS ESM / 5GSM + RRC                      sk_buff + eBPF + fwmark
        |                                               |
P-GW / SMF+UPF assigns IP                       rmnet/CCMNI + offload + modem UP
        |                                               |
netd + NetworkAgent + validation                GTP-U + NAT + server
        v                                               v
   "Network is usable"                          bytes on the wire

Radio prerequisites: camped, RRC, bearers and APN types

No amount of Android policy creates a data call if the UE is not a guest of a cell and a session in the core. Separate three states that juniors collapse into "we have signal": camped (cell selected), registered (core knows the UE), and RRC connected (there is an air-interface signalling path right now).

Camped, idle, connected

RRC_INACTIVE (NR) keeps the RAN and core context so resume is cheaper than a full idle-to-connected transition. It is still not "packets flowing"; the user plane must be resumed. Details: 5G NR.

Default bearer vs dedicated bearer (LTE)

LTE attach creates a default EPS bearer to one APN: always-on IP, best-effort QoS (typically QCI 9 for internet, QCI 5 for the IMS APN). A dedicated bearer is extra QoS (for example QCI 1 conversational voice) on the same PDN, usually network-initiated after IMS asks the PCRF. Android apps never "open a dedicated bearer" for HTTPS; they use the default internet bearer. IMS media is the usual dedicated-bearer story; see IMS & VoLTE.

APN / DNN types

An APN (LTE) or DNN (5G) is the named entrance into the operator's packet core. Android stores types in the telephony provider (from apns-conf.xml plus carrier / user edits). Types are capabilities, not interface names.

Other types you will see in dumps and carrier XML: supl, xcap, cbs, ia (initial attach), enterprise. Do not invent a type in an interview; if it is not in the dump, say "carrier-specific type in the APN database".

LTE attach + default EPS bearer vs 5G registration + PDU session

This is the radio control plane at interview depth, not a second copy of the 5G page. The trap: LTE Attach creates the first data connection; 5G Registration does not. On SA, data is a separate PDU Session Establishment. NSA still uses the EPC for the master node, so the phone's "internet" session is an LTE PDN even while NR is aggregated. Radio-deep procedures: telephony / RIL and 5G NR.

LTE: Attach carries ESM

EMM Attach Request is bundled with an ESM PDN Connectivity Request. The MME creates a session toward S-GW / P-GW. Attach Accept arrives with Activate Default EPS Bearer Context Request: EPS bearer id, APN, PDN address (IPv4 and/or IPv6 IID), QoS, and often PCO (DNS, P-CSCF). The UE accepts; the default bearer is up. Later dedicated bearers use ESM Activate Dedicated EPS Bearer Context. If the default bearer is rejected, attach fails with an ESM cause wrapped in EMM.

5G SA: 5GMM then 5GSM

Registration (5GMM, AMF) makes the UE known: SUCI, 5G-AKA or EAP-AKA', NAS security, 5G-GUTI, TAI list, Allowed NSSAI. Then the UE sends PDU Session Establishment Request (5GSM, SMF): PDU session id, DNN, S-NSSAI, session type (IPv4 / IPv6 / IPv4v6 / Ethernet / Unstructured), SSC mode. The SMF picks a UPF; the user plane is an N3 GTP-U tunnel. QoS inside that tunnel is QoS flows (QFI), not one GTP tunnel per QCI as in LTE. URSP traffic descriptors on the UE can steer an app onto a different DNN or slice; Android surfaces those as TrafficDescriptor / slice info on the data call.

LTE (always-on IP at attach)
 UE -- ESM PDN Connectivity Request --> MME -- GTP-C --> S-GW/P-GW
 UE <-- Activate Default EPS Bearer (IP, DNS, QCI) --
        user plane: DRB -- S1-U GTP-U -- S-GW -- S5/S8 GTP-U -- P-GW -- Internet

5G SA (registration then session)
 UE -- 5GMM Registration --> AMF          (no IP yet)
 UE -- 5GSM PDU Session Est. --> AMF --> SMF -- N4 --> UPF
        user plane: DRB -- N3 GTP-U -- UPF -- N6 -- Internet

GTP-C vs GTP-U

Say in interviews: "GTP-U is the user-plane tunnel in the core; GTP-C (LTE) or PFCP (5G N4) is how the core builds that tunnel. The UE only sees NAS session management and a local IP on rmnet_dataX."

Android telephony data stack

The framework decides when a data call exists. The modem decides how the NAS signalling runs. ConnectivityService decides whether apps may use the resulting Network. Keep those three verbs straight.

DataService and the APN database

android.telephony.data.DataService is the pluggable data-plane control API. The default implementation talks to IRadioData. Vendors (and AOSP IWLAN) can ship another DataService that sets up an IPsec tunnel to an ePDG instead of a cellular PDN. Telephony binds the service, sends a setup request with a profile, and gets back the same shape of result: interface, addresses, DNS.

APNs live in the telephony provider (content://telephony/carriers), seeded from apns-conf.xml, filtered by MCC-MNC / carrier ID, and editable by the user or a carrier-privileged app. The framework pushes the initial attach profile (setInitialAttachApn) and the full list (setDataProfile) so the modem can attach and can also originate a second PDN later.

Gates before setup

1. SIM and PS service Card loaded, PS domain in service (or emergency exception).
2. Data enabled User mobile-data toggle, carrier policy, and device policy (user restriction / parental / enterprise). This gate applies to the internet APN, not IMS.
3. Roaming Data roaming setting and carrier roaming rules. Voice/IMS roaming is a different policy.
4. DDS / PhoneSwitcher On DSDS, only the preferred data subscription's TelephonyNetworkFactory is live for default internet.
5. Restricted capabilities IMS, MMS, FOTA Networks usually lack NET_CAPABILITY_NOT_RESTRICTED. Ordinary apps never receive them as the default Network.
6. Throttle / retry DataRetryManager plus modem-reported suggested retry; permanent ESM/5GSM causes (unknown APN, not subscribed) should not tight-loop.

IWLAN / Wi-Fi offload (high level)

When AccessNetworksManager prefers IWLAN, setup uses the IWLAN DataService: IPsec to the ePDG, then into the EPC/5GC as if it were another access. setupDataCall can carry a handover reason and existing addresses so the IP is preserved. Apps keep the same Network object if handover succeeds; if it fails, ConnectivityService falls back. Do not describe IWLAN as "just Wi-Fi" — it is a cellular PDN/PDU over untrusted WLAN.

IRadioData.setupDataCall and SetupDataCallResult

The Radio HAL data slice is android.hardware.radio.data.IRadioData (AIDL; HIDL on older releases). Framework RIL.java issues a solicited request with a serial; the vendor answers later on IRadioDataResponse.setupDataCallResponse. Unsolicited dataCallListChanged is how the modem tells Android the call list moved (network drop, handover, IP change). Binder/AIDL mechanics: Binder & AIDL.

setupDataCall / deactivateDataCall

Exact parameter lists move by HAL version. In interviews, name the ideas and say you would confirm the current AIDL:

• accessNetwork — EUTRAN, NGRAN, IWLAN, and so on.
• dataProfile — APN/DNN, protocol (IP / IPV6 / IPV4V6), auth, type bits, optional traffic descriptor / slice.
• roamingAllowed, reason — normal, handover, shutdown (names as in the current DataRequestReason enum).
• addresses / dnses — filled on handover so the session can keep its IP.
• pduSessionId, sliceInfo, trafficDescriptors, matchAllRuleAllowed — 5G / URSP path; omit or zero on plain LTE internet if the HAL allows.

deactivateDataCall(serial, cid, reason) tears down by the CID the modem assigned. After a modem restart the list is empty; the framework must not assume old CIDs.

SetupDataCallResult fields that interviews expect

Radio HAL vs vendor RIL / QMI WDS

AOSP stops at the HAL. The vendor radio process translates setupDataCall into chipset IPC. On Qualcomm-based designs the usual example is QMI WDS (Wireless Data Service: start/stop network interface, profile, packet status) plus QMI DSD for which RAT should carry data. Other SoCs have the same job under different names (vendor AT, custom RPC). You never debug "QMI WDS" from Java; you debug HAL cause + vendor logs. Prefer: "the vendor RIL maps IRadioData onto QMI WDS or the SoC equivalent" over a guessed TLV list.

DataNetwork / DataService
        |  Binder (IRadioData)
Vendor radio HAL process
        |  QMI WDS / SoC equivalent (example)
Modem NAS ESM / 5GSM
        |
SetupDataCallResult {cid, ifname, addresses, dnses, ...}
        |
TelephonyNetworkAgent --> ConnectivityService
netd configures ifname

Kernel interface bring-up: rmnet, QMAP, offload, netlink

Each data call is a Linux netdev. The TCP/IP stack does not know it is cellular. Vendor drivers multiplex several logical calls over one physical link to the modem.

QMAP (Qualcomm example)

QMAP (Qualcomm Multiplexing and Aggregation Protocol) is a header in front of each Ethernet-like frame on the AP–modem link. Multiplexing: a mux id maps to one PDN/iface. Aggregation: several packets share one transfer so the AP and IPA see fewer transactions. Other vendors do multiplexing too; do not say "QMAP" as if it were 3GPP.

Vendor offload (IPA as the Qualcomm example)

An IP Accelerator (IPA) is a hardware block that can route, filter, NAT, header-convert and aggregate between the modem, AP memory, and peripherals (USB / Wi-Fi for tethering) so the application processor is not in every packet. Other SoCs ship equivalent DMA/offload engines under different names. Interview sentence: "Offload sits beside the netdev, not instead of the Linux stack for app sockets; exception is hardware tethering forward, where packets may never enter the AP stack."

What netd does on the netdev (via netlink)

After Telephony has ifname and addresses, netd (and the kernel) apply the usual RTNetlink objects. You will see the effects with ip even if you never read a netlink dump:

• RTM_NEWLINK / flags: iface up.
• RTM_NEWADDR: IPv4 and IPv6 addresses from SetupDataCallResult.
• RTM_NEWRULE + RTM_NEWROUTE: per-Network table, default route, occasionally on-link prefixes.
• IPv6: host autoconfig may already have a link-local; netd still adds the global / delegated address the modem reported.

Kernel driver internals (probe, NAPI, DMA) belong with Linux Kernel & BSP.

ConnectivityService: agents, scoring, validation, binding, VPN

ConnectivityService in system_server is the only component apps should think of as "am I on the internet?". Telephony offers a Network; Wi-Fi offers another; VPN may overlay both. Framework overview: Android frameworks.

NetworkAgent and NetworkCapabilities

A TelephonyNetworkAgent (or Wi-Fi / VPN agent) publishes a Network plus NetworkCapabilities: transports (TRANSPORT_CELLULAR, TRANSPORT_WIFI, TRANSPORT_VPN, …) and capabilities (INTERNET, NOT_METERED, NOT_RESTRICTED, VALIDATED, CAPTIVE_PORTAL, IMS, MMS, DUN, FOTA, enterprise / slice-related flags on recent releases). Scoring / NetworkScore (and the current prefer-policy) ranks candidates. Cellular typically loses to validated Wi-Fi for the default Network unless the app binds or Wi-Fi is unvalidated / lost.

Validation and captive portal

A Network with INTERNET is not default-usable until validation succeeds (or the platform decides to skip). NetworkMonitor (in the Network stack module; names have moved with Mainline) issues an HTTPS probe to a well-known connectivity URL, follows redirects, and may detect a captive portal. Success adds NET_CAPABILITY_VALIDATED. Failure: the interface can still have an IP — this is the "connected, no internet" UI case. Private DNS failures can also keep a Network from becoming the happy default.

NetworkRequest and binding

• ConnectivityManager.requestNetwork / registerDefaultNetworkCallback — system and apps (with permissions) ask for capabilities.
• bindProcessToNetwork(Network) — that process's default socket routing uses that Network's fwmark/table (until cleared).
• Network.bindSocket(fd) / Network.openConnection — one socket or URLConnection, not the whole process.
• Without a bind, the socket follows the current default Network (and can break mid-transfer if the default switches — modern stacks re-bind or use the callback).

VPN overlay and dual Wi-Fi + cellular

A VPN creates a TUN Network that typically becomes default; underlying cellular/Wi-Fi stay up as the VPN's egress. Lockdown VPN blocks non-VPN sockets. protect() / fwmark protect bits let the VPN's own tunnel sockets escape the VPN table (otherwise the tunnel would loop). Dual networks: Wi-Fi default + cellular for a bound MMS/IMS/HIPRI request, or OEM dual-STA plus cellular. Each Network has its own netId, table and mark. Multipath / MultipathPreference is policy on top, not a second TCP stack.

netd in depth

netd is Android's native network daemon: a privileged process that applies kernel policy on behalf of ConnectivityService, NetworkManagementService, NetworkPolicyManagerService and a few modules. Java does not call ip with Runtime.exec for production paths; it talks Binder/AIDL to netd, and netd talks netlink, sockopts, nftables/iptables compatibility, and eBPF maps.

Binder / AIDL to netd

The stable interface is android.net.INetd (plus related AIDL in the Network stack / Tethering / DnsResolver modules depending on release). Calls are capability-checked; only system_server and a short allowlist may use them. Older code and some OEM scripts still speak the ndc text protocol on the netd socket; treat ndc as a remnant for dumps and bring-up, not the modern control path. See Binder & AIDL.

What netd actually applies

DnsResolver

Stub resolution moved out of monolithic netd into the DnsResolver component (Mainline / Network stack). It still receives per-netId DNS servers from the data call or DHCP, implements Private DNS (DNS-over-TLS), happy-eyeballs-ish races, and DNS64 synthesis when configured. dumpsys netd and resolver dumps both matter; do not assume one process owns everything on every release.

Realistic commands and dumps

# Effects you should be able to read in an interview
ip link show
ip addr show dev rmnet_data0
ip rule show
ip route show table all
ip route show table 100          # netId table; number is an example

# Framework view
dumpsys connectivity
dumpsys netd
dumpsys dnsresolver              # name can vary slightly by release; check the device

# Historical / still useful remnant
ndc interface list
ndc network list
ndc resolver dump

# Policy leftovers you may still see
iptables -t mangle -L -n
iptables -t filter -L -n
nft list ruleset                 # prefer this on nft-first devices

When you quote ndc in an interview, label it as remnant. The live path is AIDL → netd → netlink/eBPF.

eBPF on Android

eBPF programs run in the kernel at well-defined hook points (cgroup skb, tc, sockops, xdp on some devices, tracepoints). Android uses them so per-UID firewall and accounting no longer depend on walking a giant xt_qtaguid table in the forwarding path. Do not recite invented program names. ELF object names and map names change with the Tethering / Network stack / bpfloader drop; say "cgroup skb ingress/egress programs loaded by bpfloader and owned by netd or the tethering module — check current AOSP."

bpfloader and attachment

bpfloader (init-started) loads pinned programs and maps from well-known paths under /sys/fs/bpf and module directories (system, Tethering APEX, others). netd's traffic controller and the tethering/clat daemons attach programs to cgroups and interfaces. If bpfloader fails, you often get "data connected, some UIDs mysteriously blackholed" or zero TrafficStats — not necessarily a radio fail.

cgroup skb ingress / egress

The hooks that matter for app sockets are cgroup/skb on ingress and egress. They see the socket's UID/cgroup, can drop, and can account. This is the UID firewall: NetworkPolicyManagerService (Data Saver, rule-based background, parked / standby, doze network off) pushes policy down; the program enforces it on every packet. Cellular metered + Data Saver is the usual "my UID cannot leave" bug after the iface looks fine.

xt_bpf leftover and qtaguid history

Older Android tagged sockets with xt_qtaguid and counted in /proc/net/xt_qtaguid/stats. TrafficStats and Settings data usage grew on that. Modern releases keep the Java API and migrate the backend to eBPF maps. You may still see xt_bpf matches in iptables for a transitional rule, or OEM leftover qtaguid config. Interview line: "TrafficStats is the API; qtaguid is history; eBPF maps are the current counters — confirm on the build."

Doze, App Standby, Data Saver

These are not modem features. They are NetworkPolicyManagerService + netd + eBPF (and some ConnectivityService scoring). Doze shuts app network in idle; App Standby buckets tighten background; Data Saver restricts background UIDs unless allowlisted. Foreground / temporary exemptions punch holes. Power interaction: Power & thermal.

Tethering eBPF and CLAT eBPF

Tethering offload programs rewrite and forward between the downstream iface (wlan AP, USB, BT-PAN) and the upstream Network, with NAT44 or prefix translation, so the AP CPU is not in every forwarded packet. CLAT programs translate IPv4 sockets onto the NAT64 prefix on IPv6-only cellular (and the reverse on downlink). If CLAT eBPF is down, IPv4-only apps fail while IPv6 apps work. Check current AOSP for the ELF names; do not invent clat_foo.o in an interview unless you just read the tree.

fwmark and policy routing

Linux routes a packet by looking up a table. Android has many tables (one per Network, plus local/main/default leftovers). The selector that picks the table is an fwmark on the socket or skb, matched by ip rule. Without this, every app would use main and you could not have VPN + Wi-Fi + cellular at once.

How a socket gets a mark

1. Default netd / the Network stack apply a per-UID or per-process mark that encodes the current default netId plus permission/protect bits.
2. Explicit Network Network.bindSocket / bindProcessToNetwork sets the mark for that netId (and typically the "explicitly selected" bit so VPN lockdown and default switches do not steal it).
3. VPN protect The VPN app's tunnel sockets get a protect mark so they use the underlying Network, not the TUN table.
4. OEM / privileged UID ranges Platform and OEM reserved AIDs (see android_filesystem_config.h OEM reserved ranges) can have extra rules so system UIDs keep a path when app UIDs are fenced. Quote ranges from the tree on that build; do not memorise unofficial OEM splits.

The bit layout of the 32-bit mark is an AOSP Fwmark contract (netId, permission, explicitlySelected, protect, and related flags). It has been revised. In an interview, draw netId + flags, not a guessed bitfield from memory.

ip rule and per-Network tables

socket (fwmark = netId | flags)
        |
ip rule:  fwmark 0x.../mask  lookup table <netId>
        |
table <netId>:  default via <gw> dev rmnet_data0
                (plus local connected routes)
        |
output dev rmnet_data0  (or wlan0, tun0, clat)

Dump with ip rule and ip route show table all. If the socket's mark does not match a rule, traffic falls through to main, which may have no default, a Wi-Fi default, or a stale route — classic "ping from the shell works, the app does not" (shell UID ≠ app UID) or the reverse.

Uplink hop-by-hop: app to server

Assume the control plane already succeeded: validated default Network, address on rmnet_data0, rules and DNS in place. An app fetches an HTTPS URL with OkHttp (or HttpURLConnection, or a raw Socket).

App  OkHttp / HttpURLConnection / Socket / Cronet QUIC
  -> ART + libcore (Java net) / Chromium
  -> bionic connect/sendto/write  (libc)
  -> kernel: inet_sendmsg / tcp_sendmsg  (or udp_sendmsg)
  -> allocate / fill sk_buff
  -> netfilter / nftables (raw, mangle, filter, nat as configured)
  -> eBPF cgroup/skb egress  (UID allow + stats)
  -> fwmark -> ip rule -> Network table
  -> optional CLAT (IPv4 skb -> IPv6 toward NAT64 prefix)
  -> ndo_start_xmit on rmnet/CCMNI  (+ QMAP mux/agg)
  -> vendor offload (IPA example): DMA toward modem
  -> modem PDCP / RLC / MAC / PHY
  -> eNB / gNB
  -> GTP-U  (S1-U or N3)  -> P-GW or UPF
  -> NAT / firewall on N6 or SGi
  -> Internet  -> server NIC

TCP handshake vs later data

First connection: connect() sends SYN (one sk_buff path as above). SYN-ACK returns on the downlink path. ACK completes the handshake (1 RTT). TLS then adds 1 RTT (1.2) or less (1.3 1-RTT / 0-RTT). Application bytes ride later segments. Keep-alive sockets skip the handshake but still pay TLS session costs if the server expired the session. QUIC/UDP: no kernel TCP handshake; the first datagram is already a QUIC packet (CRYPTO/0-RTT) on the same fwmark/eBPF/rmnet path. NAT and middleboxes treat it as UDP/443.

Rough on-wire size for a 100-byte HTTP body on a new TLS connection is dominated by handshake, not the body. Once the session is warm, payload plus ~40–80 bytes of IP+TCP+TLS record overhead per segment is the model to quote — not "HTTP is 100 bytes on the air."

Downlink hop-by-hop: server to app

Downlink is not uplink with the arrows flipped. The AP is interrupt- and batch-driven. The modem and offload engine decide how often the CPU hears about packets.

Server  -> Internet  -> P-GW / UPF NAT
  -> GTP-U  -> RAN  -> modem PHY / MAC / RLC / PDCP
  -> vendor offload (IPA example): filter, route, aggregate
       DMA into AP buffers;  ONE IRQ per aggregated batch
  -> rmnet / CCMNI: de-QMAP, gro_cells / napi_gro_receive
  -> NAPI poll in softirq  (not one hardirq per packet)
  -> GRO merges eligible TCP segments
  -> netfilter / eBPF cgroup skb ingress  (UID stats, firewall)
  -> TCP stack: rcv, ACK scheduling, sock receive queue
  -> wait queue / epoll / poll  wakes the blocked thread
  -> bionic recv  -> ART  -> OkHttp read

Why the interrupt story differs

• IPA / vendor aggregation turns N packets into one DMA completion. IRQ reduction is roughly linear in the aggregation factor when the link is busy.
• NAPI disables the IRQ while a poll loop drains a budget of packets in softirq (or a NAPI thread on modern kernels).
• GRO combines segments so TCP sees fewer, larger skbs (better cache, fewer trips through eBPF/netfilter).
• Wakeup is an app-visible cost: epoll_wait returning schedules ART, which may take a wakelock or keep the CPU out of deep idle. Chatty small responses defeat aggregation and suspend. See power.

IPv4, IPv6, CLAT/464XLAT, MTU, Private DNS, DNS64

Carriers increasingly hand the UE IPv6-only on the internet APN (IMS was often IPv6 first). Apps and literal IPv4 APIs still exist. Android's answer is 464XLAT, plus DNS64 in the resolver when needed.

MTU and MSS

Use the MTU from SetupDataCallResult (and clat's computed MTU, which is smaller because of the extra IPv6 header). PMTUD blackholes are common on operator NATs that drop ICMP. Symptoms: TCP handshake works, small requests work, large POST/TLS records stall. Fix: honour MTU, clamp MSS, or repair ICMP; do not raise MTU blindly.

Private DNS (DoT) and DNS64/NAT64

Private DNS (Off / Automatic / Specified hostname) is implemented in DnsResolver as DNS-over-TLS to the chosen resolver. Strict mode can fail validation of a Network if DoT cannot be established. Automatic typically uses opportunistic DoT and falls back. DNS64: when the APN is v6-only and the resolver (or synthesizer) produces AAAA from A, the app connects to a NAT64 prefix; CLAT is still required for IPv4 literals and IPv4-only stacks that never query AAAA. Android may also learn the NAT64 prefix via PREF64 / router advertisements on some networks — treat the discovery method as version- and carrier-specific.

Tethering, VPN, and IMS data-call coexistence

A phone commonly holds several data calls at once. They are different netdevs, CIDs, and Networks. Routing and eBPF keep them from being one bucket of "mobile data".

Tethering

Hotspot / USB / BT-PAN: netd + the Tethering module enable forwarding, hand out prefixes or RFC1918 + NAT, and attach eBPF offload. Hardware (IPA example) may forward USB/Wi-Fi ↔ modem without the AP stack. If the carrier requires dun, Telephony brings a second data call; using the default APN for tethering on those carriers is a policy bug, not a routing mystery.

VPN coexistence

Always-on + lockdown: app sockets without the VPN mark are dropped. The IMS iface must remain reachable for the IMS stack (different Network, restricted). Split-tunnel OEM VPNs add more tables; dump ip rule before theorising.

Power: aggregation, modem DRX, chatty sockets

Cellular power is radio tail plus AP wakeup. A correct data path is one that lets both sleep. Broader budget and Doze: Power & thermal.

• IPA / vendor aggregation — fewer IRQs, less softirq, AP can hit cpuidle and suspend during a bulk transfer if no userspace is scheduled.
• Modem DRX / C-DRX — connected-mode gaps on the air. Small, frequent packets reset the inactivity timer and keep RF in a high-power connected state (tail energy).
• Chatty sockets — heartbeats every few seconds (push, analytics, QUIC PING, TLS close/open) defeat both DRX and AP suspend. One persistent multiplexed connection that batches is cheaper than many short connections.
• Doze / App Standby — eBPF drops or delays background UID traffic so the radio can DRX; exemptions (FCM high priority, foreground) punch holes on purpose.

Interview formula: energy ≈ (radio connected time) × (connected power) + (AP wakeups) × (resume energy). Batching reduces both terms. Offload failure increases only the AP term until the radio is also kept awake by ACKs.

Debug playbook

Work top-down for "no icon", bottom-up for "icon but no packets", and always bisect connected vs validated vs UID-allowed.

Dumps and commands

dumpsys connectivity          # Networks, scores, validation, requests
dumpsys netd                  # netIds, rules netd thinks it installed
dumpsys dnsresolver           # per-netId resolvers, Private DNS, errors
dumpsys telephony.registry    # data connection state, APN, rat
dumpsys telephony_ims         # IMS registration (if present on the build)

ip addr
ip rule
ip route show table all
ip -6 route show table all

# eBPF (if bpftool is on the image or in a debug build)
bpftool prog show
bpftool map show
ls /sys/fs/bpf

tcpdump -i rmnet_data0 -n       # or any ifname from the HAL
# compare with modem / QXDM / vendor log (on-device path varies)

iptables-save
nft list ruleset
dumpsys netpolicy             # Data Saver, UID rules
dumpsys batterystats          # radio and app network attribution

"Connected but no internet" bisect

1. CID and iface IP — dumpsys telephony.registry / data dump + ip addr. No address: still control plane (APN, reject cause, vendor WDS).
2. Routes and rules — default in the Network table? fwmark rules present? Main table red herring.
3. Validation — dumpsys connectivity: VALIDATED vs CAPTIVE vs none. Probe URL, Private DNS, HTTP proxy.
4. DNS vs IP — ping a literal vs a name from the same UID if you can; resolver dump for SERVFAIL / DoT.
5. UID policy — Data Saver, standby, VPN lockdown, enterprise. Shell ping succeeding proves little for uid 10123.
6. CLAT — IPv6 ping works, IPv4 app fails: clat iface, eBPF, NAT64 prefix.
7. On-air vs on-AP — tcpdump shows uplink but no downlink: modem logs, MTU, core GTP-U, operator NAT. tcpdump empty: never left the stack (fwmark, eBPF drop, wrong dev).
8. Offload — bulk throughput + high IRQ + high CPU: aggregation/IPA path. Compare with Wi-Fi on the same build.

The map-level version of this list is on Trace a Path Through the Android Stack; use this page's dumps when you are the owner of the bug.

Failure modes

Quick revision

• Control plane leases the PDN/PDU; data plane is every packet after the iface is configured.
• Camped + registered is not RRC connected; idle uplink needs Service Request.
• LTE Attach creates a default EPS bearer; 5G Registration does not create a PDU session by itself.
• Default bearer is always-on IP; dedicated bearers are extra QoS (IMS voice), not how Chrome gets HTTPS.
• APN (LTE) = DNN (5G). Types: default, ims, mms, dun, fota, emergency, hipri, plus carrier extras.
• ESM PDN Connectivity / Activate Default EPS Bearer vs 5GSM PDU Session Establishment.
• GTP-U carries user packets in the core; GTP-C/PFCP builds sessions. The UE speaks NAS, not GTP.
• DcTracker (pre-13) vs DataNetworkController + DataNetwork + DataRetryManager + AccessNetworksManager.
• DataService is the pluggable setup API; IWLAN is a DataService, not "just Wi-Fi".
• Gates: SIM, PS service, data enabled, roaming, DDS, restricted caps, throttle/T3396.
• Mobile data off must not tear down the IMS data call.
• IRadioData.setupDataCall / deactivateDataCall; unsolicited dataCallListChanged.
• SetupDataCallResult: cause, cid, ifname, addresses, dnses, gateways, mtu(V4/V6), pduSessionId, trafficDescriptors.
• Vendor maps HAL to QMI WDS (Qualcomm example) or the SoC equivalent — do not invent TLVs.
• ifname comes from the vendor/kernel, not from Java constructing a string.
• rmnet_data / ccmni / generic wwan: one netdev per data call; QMAP mux+agg is a Qualcomm-example header.
• IPA (Qualcomm example) offloads route/filter/NAT/aggregation; other SoCs have equivalents.
• netd applies addresses, rules, routes, firewall/eBPF; Java uses INetd AIDL, not Runtime.exec("ip").
• ndc is a remnant text interface; still useful to read, not the modern control path.
• DnsResolver owns stub DNS, Private DNS (DoT), and often DNS64 synthesis.
• ConnectivityService: NetworkAgent, capabilities, score, validation, VPN overlay.
• VALIDATED is not the same as "iface has an IP".
• bindProcessToNetwork vs Network.bindSocket vs default Network.
• Restricted Networks (IMS/MMS) never become the ordinary app default.
• eBPF: bpfloader, cgroup skb in/out, UID firewall, stats, tethering, CLAT — check current AOSP names.
• TrafficStats API stayed; xt_qtaguid is history; counters live in eBPF maps now.
• Doze / App Standby / Data Saver are netd+eBPF policy, not NAS.
• fwmark + ip rule select the per-Network routing table; dump table all, not only main.
• VPN protect mark keeps tunnel sockets off the TUN table.
• OEM reserved UID ranges can have extra policy rules; quote android_filesystem_config.h for the build.
• Uplink: OkHttp → ART → bionic → tcp_sendmsg → skb → nft/eBPF → route → CLAT? → rmnet → offload → PDCP… → GTP-U → NAT → server.
• TCP SYN uses the same path as later data; QUIC uses udp_sendmsg.
• MSS = MTU − IP − TCP (40 v4, 60 v6, minus options).
• Downlink: offload aggregation, NAPI, GRO, softirq, then socket queue / epoll — not per-packet hardirq.
• IRQ rate ≈ pps / aggregation depth when offload is healthy.
• 464XLAT = CLAT on the UE + PLAT (NAT64) in the network; DNS64 synthesises AAAA from A.
• IPv4 literals on v6-only need CLAT even if DNS64 exists.
• Private DNS (DoT) can fail validation independently of the bearer.
• Tethering may require a DUN APN; hardware may forward without the AP stack.
• Chatty sockets kill modem DRX and AP suspend; batch and multiplex.
• Bisect no-internet: CID/IP → rules/routes → validation → DNS → UID → CLAT → tcpdump vs modem → offload.
• MTU blackhole: handshake works, large segments die; ICMP often filtered on cellular.
• Shell ping ≠ app UID. Always ask which UID you just tested.

Glossary

5GMM / 5GSM

5G NAS mobility management (AMF) and session management (SMF). Registration is 5GMM; PDU sessions are 5GSM.

464XLAT

CLAT on the customer side plus PLAT (NAT64) in the network so IPv4 sockets work on IPv6-only access.

AccessNetworksManager

Telephony component that prefers cellular vs IWLAN (and related access) for a data call.

AMF

Access and Mobility Function in the 5G core; terminates 5GMM.

APN

Access Point Name; the LTE name of a packet data network. 5G name is DNN.

ApnContext

Pre-Android 13 object tracking one APN type's desire for a DataConnection.

bpfloader

Init service that loads Android's pinned eBPF programs and maps. Confirm paths on the build.

Captive portal

Network that intercepts HTTP(S) until a sign-in; validation marks CAPTIVE_PORTAL instead of a clean VALIDATED.

CCMNI

MediaTek cellular netdev family (ccmniN), one interface per data call.

cgroup skb

eBPF hook on packets associated with a cgroup; Android's UID firewall and accounting attach here.

CID

Connection id assigned by the modem for a data call; argument to deactivate and list queries.

CLAT

Customer-side translator: IPv4 (typically 192.0.0.0/29) to IPv6 toward a NAT64 prefix.

ConnectivityService

system_server owner of Networks, requests, scoring, validation and binding.

DataNetwork

Android 13+ state machine for one active telephony data connection.

DataNetworkController

Android 13+ per-Phone orchestrator that replaced DcTracker.

DataProfile

Framework object for an APN/DNN plus protocol, auth and 5G extras (slice, traffic descriptor).

DataRetryManager

Applies carrier retry/backoff and network-provided timers such as T3396.

DataService

android.telephony.data.DataService: pluggable implementer of setup/teardown (RIL or IWLAN).

DcTracker

Pre-13 data connection tracker; still in logs and older branches.

Dedicated bearer

Extra LTE EPS bearer for QoS on an existing PDN (for example QCI 1 voice).

Default EPS bearer

The always-on bearer created at LTE attach (or additional PDN connect) that carries general IP.

DNN

Data Network Name; 5G name for APN.

DnsResolver

Android stub resolver (DoT, per-netId servers, DNS64). Split out of classic netd.

DoT

DNS-over-TLS; what Private DNS uses.

DRB

Data Radio Bearer on the air interface; carries user plane after PDCP.

DRX

Discontinuous reception; modem sleeps between monitoring occasions. Chatty traffic defeats it.

DSD

Qualcomm QMI Data System Determination example: which RAT should carry data.

DUN

Dial-Up Networking APN type used by some carriers for tethering.

eBPF

Extended Berkeley Packet Filter; in-kernel programs Android uses for UID policy, stats, tethering and CLAT.

EMM / ESM

LTE NAS mobility and session management. Attach is EMM; PDN/bearer is ESM.

ePDG

Evolved Packet Data Gateway; IPsec peer for IWLAN.

fwmark

32-bit firewall mark on a socket/skb used with ip rule to select a Network's routing table.

GRO

Generic Receive Offload; kernel merging of incoming segments before TCP.

GTP-C

GTP control plane in LTE EPC (session/bearer signalling between core nodes).

GTP-U

GTP user plane; tunnels UE IP packets (S1-U, S5, N3, N9).

HIPRI

High-priority mobile APN/type used to request cellular while another default exists.

ifname

Kernel interface name returned in SetupDataCallResult.

INetd

AIDL interface to the netd daemon.

IPA

IP Accelerator; Qualcomm example of hardware data-path offload. Other SoCs have equivalents.

IRadioData

Radio HAL interface for data calls: setup, deactivate, profiles, keepalive, slicing helpers.

IWLAN

Untrusted WLAN access to the packet core via IPsec to an ePDG; still a cellular session.

MSS

Maximum Segment Size; TCP payload per segment, derived from MTU minus headers.

MTU

Maximum Transmission Unit; largest IP packet the path claims to carry.

NAPI

New API; kernel polling of a nic under load so the CPU is not hardirq-per-packet.

NAT64 / PLAT

Provider-side translator from IPv6 to IPv4; the network half of 464XLAT.

ndc

Legacy netd command-line/text protocol; remnant beside INetd.

netd

Native daemon that programs interfaces, policy routing, firewall/eBPF and related kernel state.

NetworkAgent

Producer of a Network (telephony, Wi-Fi, VPN, Ethernet) into ConnectivityService.

NetworkRequest

App or system request for a Network matching a capability filter.

PCO

Protocol Configuration Options; NAS container for DNS, P-CSCF and similar.

PDN

Packet Data Network connection (LTE name for the IP session to an APN).

PDCP

Packet Data Convergence Protocol; ciphering, integrity, ROHC, reordering on the radio user plane.

PDU session

5G IP (or Ethernet/unstructured) session to a DNN, anchored at a UPF.

PFCP

Packet Forwarding Control Protocol on N4 (SMF controls UPF). 5G replacement for much of GTP-C on that hop.

P-GW

PDN Gateway; LTE user-plane anchor and often NAT to the Internet.

PREF64

RA option that can advertise a NAT64 prefix to the UE.

Private DNS

User setting that forces or prefers DoT in DnsResolver.

QFI

QoS Flow Identifier inside a 5G PDU session / GTP-U header.

QMAP

Qualcomm Multiplexing and Aggregation Protocol example header on the AP–modem link.

qtaguid

Legacy xtables module for per-UID traffic tags and stats; replaced in spirit by eBPF.

QMI WDS

Qualcomm Wireless Data Service example: vendor IPC to start/stop packet data.

rmnet

Qualcomm kernel driver family exposing modem data calls as rmnet_dataN interfaces.

RRC

Radio Resource Control; idle/inactive/connected and bearer setup on the air.

SetupDataCallResult

HAL structure returned after setup: cause, cid, ifname, addresses, DNS, routes, MTU, 5G extras.

sk_buff

Linux socket buffer; the packet object in the kernel stack.

SMF

Session Management Function; 5G owner of PDU sessions.

softirq

Deferred kernel interrupt processing; NAPI poll and much of TCP input run here.

T3346 / T3396

3GPP back-off timers (mobility congestion / per-APN session management). Framework must honour them.

TelephonyNetworkFactory

Offers cellular Networks to ConnectivityService; live on the preferred data subscription.

TrafficDescriptor

URSP match key (application id, DNN, IP descriptors, connection capabilities) carried into setup and the HAL result.

TrafficStats

SDK API for per-UID bytes/packets; backend moved from xt_qtaguid to eBPF maps.

TUN

Virtual iface used by VpnService; typically the default Network while the tunnel egresses on Wi-Fi or cellular.

UPF

User Plane Function; 5G gateway that terminates N3 GTP-U and forwards on N6.

URSP

UE Route Selection Policy; rules from the PCF that map traffic to a DNN, slice and session.

VALIDATED

NetworkCapabilities flag set after a successful connectivity probe (and related checks).

VPN protect

fwmark/socket option that exempts the VPN's own tunnel sockets from the VPN routing table.

WDS

Wireless Data Service; Qualcomm QMI example for PDN/PDU start and stop.

wwan

Generic kernel subsystem / iface name some SoCs use instead of rmnet or ccmni.

xt_bpf

iptables match that runs an eBPF program; leftover on devices still using xtables.

xt_qtaguid

Legacy per-UID tagging and stats module; historical TrafficStats backend.

Interview questions