1

Can anyone confirm that the domain found in my logs today indicate a WiFi call initiated: “ss.epdg.epc.mnc260.mcc310.pub.3gppnetwork.org”

Hey everyone. I’m trying to find out if this was indeed WiFi calls going out through the night last night. From what I’ve found, it’s definitely WiFi calls. It’s from T-Mobile using an iPhone 15. I know someone here might have a tool that can actually confirm it for me. Trying to find out if my son was up calling people last night using WiFi and maybe airplane mode combined or something. With it being iPhone and on T-Mobile, no luck looking into bill since WiFi calls and texts and iMessages and RCS don’t show on the bill cause they’re not SMS.

Anyways, any help would be awesome. I do not have it set so that each device on NextDNS is listed separate. But it’s all TVs and 2 cell phones so it’s pretty easy to distinguish the devices in the logs for me.

4 replies

null
    • Nick.33
    • 5 days ago
    • Reported - view

    Bumping. Been digging all day trying to figure it out. About 95% sure it’s WiFi call on T-Mobile. I’ll update later.

      • Calvin_Hobbes
      • 4 days ago
      • Reported - view

       Why not look at the phone and view its call history?   Or are you attempting to use technology to solve a parenting problem?

      • Nick.33
      • 4 days ago
      • Reported - view

       thanks for your suggestion. It wouldn’t be there, and isn’t because it was deleted. Funny thing is, idc about him being up talking every now and then. I’m more so curious as to how and why there are even ways to hide things in plain sight on our phones like this.

      And if it’s what I’m assuming it is, knowing what to look for (in my case WiFi calling) in network activity can help me know if it’s intentional or not. 

      But anyways, I had to take a break. This kind of stuff fascinates me. Haven’t completely got it.

    • ebrooks
    • 2 days ago
    • Reported - view

    Hey! 

    I copied and pasted the following from ChatGPT (surprisingly a useful tool to look up DNS logs): 

    "

    The DNS ss.epdg.epc.mnc260.mcc310.pub.3gppnetwork.org is related to mobile networks, specifically for handling Voice over Wi-Fi (VoWiFi) and LTE services.

    Breakdown of the DNS:

    1. ss – This typically refers to "Session Server" or "Subscriber Services," used for managing sessions like VoWiFi or IP Multimedia Subsystem (IMS) services.
    2. epdg – Stands for "Evolved Packet Data Gateway," which is responsible for securely connecting Wi-Fi calls to the carrier’s core network.
    3. epc – "Evolved Packet Core," the core part of LTE networks that manages data and voice services.
    4. mnc260 – This is the Mobile Network Code (MNC). 260 corresponds to T-Mobile USA.
    5. mcc310 – This is the Mobile Country Code (MCC) for the United States.
    6. pub.3gppnetwork.org – This indicates that the address is part of the 3GPP (3rd Generation Partnership Project) standards, which define how cellular networks operate globally.

    What does this DNS do?

    It’s likely used by T-Mobile USA to manage Wi-Fi calling or Voice over LTE (VoLTE). When your phone connects to Wi-Fi or LTE, it uses this domain to securely route your calls and data back to the mobile carrier’s network.

    If you’re seeing this in your DNS logs, it means your phone is likely accessing T-Mobile’s infrastructure to enable or maintain Wi-Fi calling or IMS-related services."

     

    In short, it looks like you are correct!

Login to reply

Content aside

  • 1 Likes
  • 2 days agoLast active
  • 4Replies
  • 61Views
  • 3 Following