General Discussions

Sorry. I wasn't 100% sure where to put this post. It might need to go on one of the other boards. If so, just let me know where it should go.

So my question is, I noticed a ton of traffic on which ever client I leave the manager running on. It's fine because as soon as I close the manager, the traffic stops. I was just wondering if someone can tell me what it's doing and why it's doing it so often.

Thanks!

I dont know which traffic exactly you are talking about but the trainer manager uses WebView2 (Chromium) and displays websites. If these websites have scripts running which does something in an intervall it could cause some kind of traffic. Besides its regularly checking for trainer updates etc.

Yeah - that's the answer I was looking for. It is displaying websites directly, but it looks like it's checking 'www.cheathappens.com' about every 30 seconds, even when idle. Is there a way to request that gets turned down a little bit? Maybe 5 minutes or so instead of 30 seconds?

It generates the 3rd highest amount of traffic on my network when on and idle - behind 'netflix' and 'oculus' - which I'm not surprised since Facebook is so data-hungry. I can attach another screenshot if needed.

Thanks!

EDIT: I would've included roku, but I have all it's attempts to phone home blocked XD

Right now the trainer manager is phoning home more often than all my google devices combined.



www3.l.google.com - Hits: 1184
connectivitycheck.gstatic.com - Hits: 665

www.cheathappens.com - Hits: 2785


That's from 1 device running the manager. The number goes up exponentially for each device that turns it on.

[Edited by thelurker, 12/10/2021 9:56:36 AM]

Just checked this on my end and not seeing this happening on my network.

Using packet capture, mitm proxy and monitoring my local dns server.

[Edited by opticalip, 12/11/2021 2:32:30 AM]

That's really weird. Are you using Wireshark or Microsoft's packet monitoring? I'm just looking at reports from pi-hole. Are you seeing *any* traffic to cheathappens? If you're here on the site or have it open, even just to read this post, you should have seen *some* traffic on your report.

Edit: Oh and what filter are you using? You might be filtering it out on accident.

[Edited by thelurker, 12/11/2021 6:56:54 AM]

Looks like it took awhile to kick in.

Started doing it 20-30 mins after I opened/left open the manager.

Also was using httpdebugger, fiddler + proxifer, and p[ihole

If it makes so many requests then check your trainer update intervall. If its not that then its WebView2 and we don't have any control over this. Which means it's not coming from our code. Maybe its a bug in WebView2, maybe its a Windows setting. Maybe something else injects into every WebView2 process (AV?).

I am honestly not sure what the big concern is here. Is it sending out or receiving 10GB/hour of traffic? Have you turned all of the update and other checking off in the user settings? Have you captured what is being sent/received? Feel free to share it here, we have absolutely nothing to hide. There are no secret processes encoded into the TM to collect and send any type of personal or otherwise information outside of what WebView2 might be sending which could well be usage statistics, crash reports, etc. We are trying our best to focus on the new AIO project, but things like this deter us. The TM has been in circulation for what, 10 years or so and this is the first time it's being brought up? Does the TM set off all of the virus/trojan alarms at VirusTotal or Jotti? Would really like to settle this so we can get back to making the next generation of the TM which users pledged almost $400K to make a reality.