$ 0 0 You could try to decrypt ipsec tcpdump packets to figure out if phone is reaching out to something that isn't there.