Can I find out what exactly is "android system" traffic? I'm using Android 4.4.4 CyanogenMOD 12. My traffic is dominated by "android-system" - about half of my data usage is caused by "it" and I have no idea why it transfers data. backup (backup &amp; restore) is turned off. I dont use any Google Service besides the play store (and very seldomly youtube).
All the "android system"-traffic is background-trafic.

Is there any chance (tool/app/whatever) to find out what exactly the cause for the "android system" traffic is?

PS: 
- I use AFWall+ and in 3G even most of the system apps are blocked.
- I do not have the "Photos" app
It's possible. I used ARM version of tcpdump command. You must copy that command by hand in /system/xbin/. In shell you ran:

tcpdump -i rmnet0 -w /sdcard2/tcpdump.pcap


After some time kill that tcpdump command and copy file tcpdump.pcap to PC. Then use Wireshark to load tcpdump.pcap file to investigate network traffic.