I built a tool to help identify programs that are phoning home, normally to check for updates and the like.

It uses a BPF program running in the kernel to monitor traffic which is later analysed in a Java user space program.

You simply setup a WiFi hotspot on a machine that has this installed and allow the devices you want to monitor to connect to it. Leave it for a while and check for any patterns it has identified.

This project is ready to use as is but I do intend to keep adding to it. Please let me know if you find something interesting!