Is there a problem with the ISP logs of android phone?
I am working on a case in which I need to present opinion on whether a certain IM app was used by a person between some specific dates. The app is a little known one and its older versions are no longer available.
Although he was using an android phone, I don’t have it (because it was lost). All I have is the internet traffic logs of the phone obtained from the ISP.
ISP logs shows that the user connected to the IP address belongs to the IM server. However, the communication port (both public and private ports) is changed every time the app connected to the server. For example, the app sent more than 900 requests within 4 hours via about 900 different ports.
Is that normal for an IM app working on Android? Or is there a problem with the ISP logs?
Part of the problem in dealing with logs from any ISP is what the ISP decides to log. Since the advent of cell phones, some ISP's require you to come down to the second to determine which subscriber was using an IP address (especially when it comes to mobile devices).
This could be similar to what you are dealing with. With so many cellular devices and WIFI only devices hitting the app at the same time for messaging purposes, I do not doubt the port number would constantly change in this case.
Thanks for the reply.
With so many cellular devices and WIFI only devices hitting the app at the same time for messaging purposes, I do not doubt the port number would constantly change in this case.
This sounds correct for the public port. However, the private port also changes. I couldn't understand why would an app choose to open a different port each time it sends a request?
That makes me suspicious about the reliability of ISP logs.