TLS 1.3 stops Mishra's Pixel capture short of the payloads his page lists

Start with the unit. A capture at the firewall can establish that a device contacted an IP address, when it did so, the port and protocol involved, and how many bytes moved ^[11]. DNS and TLS metadata can help tie that traffic to a destination domain ^[11]. It cannot separate one HTTP request from the next inside a reused TLS connection, so "348.4 requests per hour" is a count of connections or of packets, whichever the tooling emitted. The research page splits the total across Google Play Services, location and mapping, device provisioning, Google Photos, Search and Assistant, Firebase Cloud Messaging and diagnostics, and says those categories sum to the headline figure ^[4].

The byte total gives a rough cross-check. At 348.4 an hour, a day is 8,361.6 requests ^[1], and the page puts the default configuration at 18.6 MB sent per day across 42 Alphabet endpoints ^[5]. That averages about 2.2 KB per request ^[2].

The payload inventory is a second claim of a different kind. Mishra's page says the connections contained nearby Wi-Fi identifiers, SIM serial hashes, hardware fingerprints, facial-recognition indices and trending search queries, and assigns those descriptions to destinations including checkin.gstatic.com, device-provisioning.googleapis.com and photosdata-pa.googleapis.com ^[12]. The same page identifies much of the traffic as TLS 1.3 ^[13]. Wireshark's documentation says TLS encrypts client-server communications and that decryption requires session secrets or other suitable key material ^[14]. According to runtimewire, Mishra's methodology does not describe collecting TLS session keys, installing a trusted interception certificate, instrumenting the phones, or correlating the captures with application logs ^[15]. A destination suggests a service category. On its own it cannot prove which field a given encrypted packet carried ^[16].

Netgate's documentation describes the pfSense packet-capture interface as a front end to tcpdump, with captures downloaded afterwards for examination in Wireshark ^[8]. Mishra describes a pfSense firewall "running Wireshark" and capturing every radio wave from the phones ^[9]. A pfSense firewall observes the network packets that cross its interfaces ^[10].

Mishra wrote that he and his friends "wanted to see what really happens" when phones are left alone ^[17]. For the four-profile table to carry to another fleet, the profiles have to share a counting rule, an account state and an idle definition. The phones were reportedly left untouched for 259,200 seconds, which is exactly the 72 hours claimed ^[3][3]. The "privacy settings disabled" profile at 194.2 runs 44 percent below stock ^[4], so that label has to mean the features producing the telemetry were switched off.

The zero for GrapheneOS without Google services is the most robust line in the table, because a device with no Google services contacting no Alphabet endpoints can be read straight off the capture ^[6]. Isolating three factory-unlocked phones on a WPA3-Enterprise network with no other devices present is the right control for that comparison ^[3]. The research article puts three phones on that otherwise empty network, while the companion guide says there were "four identical test setups" and separately describes three Pixel phones and two PCs connected through a managed switch ^[7].