iPod app of my iPhone connecting to internet
The iPod app is contacting iTunes server to get some encrypted keys. Three of them actually, respectively called "signature", "certs" and "bag". All of them are part of an xml (plist) file located at http://ax.init.itunes.apple.com/bag.xml?ix=2.

There's no POST data, just some cookies and HTTP headers giving information about the device and the context. These informations are part of many request made to Apple servers by iOS.

I have no idea what this "bag" can be nor what it's used for.

Details

Here's the request headers :

User-Agent : iTunes-iPhone/4.3.4 (4; 32GB)
Accept-Language : fr;q=1.0,en;q=1.0[...]
X-Apple-Store-Front : [cut]
X-Apple-Connection-Type : WiFi
X-Apple-Cuid : [cut]
X-Apple-Software-Cuid : [cut]
X-Dsid : [cut]
X-Apple-Client-Application : MediaPlayer
X-Apple-Client-Versions : iBooks/1.3


The cookies names :

mz_at1
s_vi
dssid2
mz_pc
mz_at0
ds01_a
Pod
s_vnum_us
s_vnum_befr
mz_if
mz_pt
a
s_vnum_fr
s_cvp35b


And the XML scheme :

&lt;!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
&lt;plist version="1.0"&gt; 
    &lt;dict&gt; 
        &lt;key&gt;signature&lt;/key&gt;
        &lt;data&gt;[encrypted string]&lt;/data&gt; 
        &lt;key&gt;certs&lt;/key&gt; 
        &lt;array&gt; 
            &lt;data&gt;[encrypted string]&lt;/data&gt; 
        &lt;/array&gt; 
        &lt;key&gt;bag&lt;/key&gt;
        &lt;data&gt;[VERY long encrypted string]&lt;/data&gt; 
    &lt;/dict&gt; 
&lt;/plist&gt;


The "certs" part seems to be constant, even with a standard browser and none of the special HTTP headers or cookies.

(I don't want to publish too many details as I don't know what they contain about me or my Apple ID.)