Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

On iPhone 4 IOS 4.3.5, if I start playing music the iPod app is getting or sending information from internet.

To reproduce it : kill the ipod app using the "taskbar"
then play some music your will notice the turning "wheel" of data transfer during a few seconds

I am not using Genius or Ping.
I have already the song cover.
I don't have any vocals

Do you have an idea of what kind of info is sent or received ?

Update : I am trying to connect through fiddler on my PC Fiddle is acting as a proxy and will let me inspect the data
BUT the wifi proxy settings is returning from manual to disabled all the time !

share|improve this question

3 Answers 3

up vote 3 down vote accepted

The iPod app is contacting iTunes server to get some encrypted keys. Three of them actually, respectively called "signature", "certs" and "bag". All of them are part of an xml (plist) file located at http://ax.init.itunes.apple.com/bag.xml?ix=2.

There's no POST data, just some cookies and HTTP headers giving information about the device and the context. These informations are part of many request made to Apple servers by iOS.

I have no idea what this "bag" can be nor what it's used for.

Details

Here's the request headers :

User-Agent : iTunes-iPhone/4.3.4 (4; 32GB)
Accept-Language : fr;q=1.0,en;q=1.0[...]
X-Apple-Store-Front : [cut]
X-Apple-Connection-Type : WiFi
X-Apple-Cuid : [cut]
X-Apple-Software-Cuid : [cut]
X-Dsid : [cut]
X-Apple-Client-Application : MediaPlayer
X-Apple-Client-Versions : iBooks/1.3

The cookies names :

mz_at1
s_vi
dssid2
mz_pc
mz_at0
ds01_a
Pod
s_vnum_us
s_vnum_befr
mz_if
mz_pt
a
s_vnum_fr
s_cvp35b

And the XML scheme :

<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0"> 
    <dict> 
        <key>signature</key>
        <data>[encrypted string]</data> 
        <key>certs</key> 
        <array> 
            <data>[encrypted string]</data> 
        </array> 
        <key>bag</key>
        <data>[VERY long encrypted string]</data> 
    </dict> 
</plist>

The "certs" part seems to be constant, even with a standard browser and none of the special HTTP headers or cookies.

(I don't want to publish too many details as I don't know what they contain about me or my Apple ID.)

share|improve this answer

It's probably searching for local shares. In the latest versions of iOS, the iPhone has gained support for Home Sharing with iTunes. So, when you launch the iPod app, it's searching to see if there are any available network shares to stream music and video files from.

share|improve this answer
    
It can be : I used "Local Share" before But the user id and password are currently empty –  Chti Suisse Aug 10 '11 at 14:56

If you still see the thumbs up and speech bubble in the iPod app's UI while playing the song, it's talking to Ping in the background. Those icons are only visible if the app knows the song is in the iTunes catalog.

Assuming I'm right so far, it's asking Apple's infrastructure whether it should show the Ping UI for a particular song.

share|improve this answer
    
No I don't see the thumbs and speech bubble. I never activated Ping. It's disabled it in restrictions –  Chti Suisse Aug 10 '11 at 16:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.