I have a very odd intermittent problem on my Android 8.0.0 (Samsung
Galaxy S7) phone. I'd like to pick the brains of any networking experts
who also know their way around Android,

Sometimes I am unable to access a particular web site (the webspace that
I rent from GoDaddy for my web sites) from that phone. Other computers
(Windows 7/10, Linux, iOS tablet, another Android phone) have no
problem. It only affects an internet connection via my VDSL landline and
router; if I disable wifi on my phone and force it to use the phone's
mobile internet connection, I've never had it fail.

The symptom is that access to the web site times out. Running a TCP port
scanner on the phone, no ports are accessible, whereas normally port 80
(HTTP) and ports 110/25 (POP/SMTP) respond to a port scan

The port scanner app can resolve the site's IP address from its name, so
DNS name-to-address mapping seems to work. Nevertheless, I'm wondering
if the phone's DNS cache needs to be cleared - and if so, how I do it.

It affects more than one browser. I normally use Dolphin, but Firefox is
affected in the same way. So it *looks* as if it's not a browser cache
problem.

When the problem happens, it lasts for several days. Then, apparently
spontaneously, it rights itself for several days.

During a period when access to the site fails, if I make a successful
access to the site by the phone's mobile internet connection, and then
turn off mobile and turn on wifi, I can always access one page on the
site (a page that happens to have an server-generated timestamp on it,
so I know I'm getting an up-to-date copy of the page, and not something
that the browser has cached) and then the next access to another page on
the same site always fails.

Normally I'd use Wireshark to see what traffic the phone is sending out,
but I've got the age-old problem that the switch in the router is too
efficient, so a Windows/Linus PC running Wireshark, even connected to
the same access point (in the router) that the phone is connected to,
cannot see all the traffic of a known-good web site access, because the
switch in the router is keeping out traffic that is not to/from the
Wireshark PC.

If it wasn't for the over-zealous network switch, I'd expect to see the
phone do a DNS name-to-address query of the router (which is the phone's
designated DNS server), and then get a DNS response from the router
(which has queried my ISP's DNS server behind the scenes). And then the
phone should send an HTTP GET which should result in a GET response with
the page's HTML.

Although my router is normally set to use my ISP's DNS server, I've
tried manually configuring it to use Google's 8.8.8.8 instead, in one of
two ways:

1. The phone's LAN connection is configured to use the router's IP as
its DNS, and the router's WAN connection is set to use 8.8.8.8

2. The router's WAN connection is set to use the ISP's DNS, but is set
to hand out 8.8.8.8 instead of its own IP as the DNS server that a
computer (eg the phone) uses.

Rebooting the router or using a different router makes no difference to
the problem: once the phone is in a non-access frame of mind, nothing
seems to make it work, apart from using a different internet connection
and then, over the original VDSL and router connection, the *first*
access to another page after I've switched the phone back to use that
connection.

I've noticed that my router's WAN address changes from time to time -
presumably the router disconnects and reconnects to the WAN every few
days and isn't always allocated the same WAN address by my ISP. However
I cannot see any correlation between the WAN address and the occurence
of the problem. Also, the ISP's DNS server addresses (primary, and
secondary fallback) alternate from time to time, but that again does not
correlate with the problem.

I'm a bit at a loss as to how to troubleshoot the problem. If only I
could find a Wireshark-like app for Android that actually worked (as
proved by monitoring a known-good web site access) and which didn't
require the phone to be rooted.

Any suggestions as to how I proceed?

NY <me@privacy.net> wrote:

> Sometimes I am unable to access a particular web site (the webspace that
> I rent from GoDaddy for my web sites) from that phone. Other computers
> (Windows 7/10, Linux, iOS tablet, another Android phone) have no
> problem. It only affects an internet connection via my VDSL landline and
> router; if I disable wifi on my phone and force it to use the phone's
> mobile internet connection, I've never had it fail.

Unclear is if using vDSL incurs the problem for all devices, or it is
only for a phone+vDSL scenario.

Checked if your vDSL modem has a "keep alive" (aka auto-reconnect)
option?

On 04/09/2022 19:07, VanguardLH wrote:
> NY <me@privacy.net> wrote:
>
>> Sometimes I am unable to access a particular web site (the webspace that
>> I rent from GoDaddy for my web sites) from that phone. Other computers
>> (Windows 7/10, Linux, iOS tablet, another Android phone) have no
>> problem. It only affects an internet connection via my VDSL landline and
>> router; if I disable wifi on my phone and force it to use the phone's
>> mobile internet connection, I've never had it fail.
>
> Unclear is if using vDSL incurs the problem for all devices, or it is
> only for a phone+vDSL scenario.
>
> Checked if your vDSL modem has a "keep alive" (aka auto-reconnect)
> option?

Sorry. The problem is mainly experienced on one Android Phone.

When I had a similar symptom on Linux once, I could not see even a DNS
lookup never mind an HTTP GET request in Wireshark. But that only
happened for a short time and has not happened since. And my wife has
noticed occasionally that pages on that site take a very long time to
load, but are not actually failing due to a time out.

So almost exclusively the problem is with one phone and that internet
connection.

The original router (Plusnet's own router) from when I first experienced
the problem reported how long the DSL connection had been connected, and
it was always a long time, so the DSL connection hadn't dropped at the
time when the Android phone went wrong. Sadly my new TPLink router only
reports when the router was last booted and gives no indication of the
last time DSL connected.

Both routers experience the fault. But the Plusnet router only started
experiencing the fault in the last 6 months, after working OK for
several years on the same VDSL line. It suggests a problem between the
router and the web site, may be due to a problem with the ISP's
equipment, but I want to be sure that I've eliminated everything else
first.

Originally I had the Plusnet router in modem-only mode and used Linksys
Velop mesh nodes to give wifi coverage and to act as the LAN-WAN router,
DHCP server and DNS server. But I changed to using the Linksys in bridge
mode and the Plusnet router as full router/DHCP/DNS to see if it made
any difference (it didn't) and then replaced the PN router with the
TPlink one, to eliminate the PN modem/router as the fault. And I've
experienced the fault when I connect directly to the router's wifi, as
opposed to one of the Linksys nodes (I gave them different SSIDs so I
could be sure which the phone was connected to - router or mesh) which
tends to suggest that the Linksys devices aren't the cause.

NY wrote:

> I have a very odd intermittent problem on my Android 8.0.0 (Samsung Galaxy S7) phone.
Is it just that phone, or any other phones on your home wifi affected?

> When the problem happens, it lasts for several days. Then, apparently
> spontaneously, it rights itself for several days.

Do you control your own DNS? If so are the refresh/retry/expire intervals in
the range of days? If so try changing them to be shorter (hours or 10s of
minutes) see if that alters the problem

> Normally I'd use Wireshark to see what traffic the phone is sending out, but
> I've got the age-old problem that the switch in the router is too efficient

ways to get full visibility of wifi traffic from e.g. a PC

wifi card with monitor mode support
airpcap adapter used to be expensive, but now discontinued
separate access point, connected to a switch that has (preferably hardware)
mirror port

> so a Windows/Linus PC running Wireshark, even connected to the same access
> point (in the router) that the phone is connected to, cannot see all the
> traffic of a known-good web site access, because the switch in the router is
> keeping out traffic that is not to/from the Wireshark PC.
that's what switches do, it's their whole point, only give packets to devices
that need to see them

you could connect the phone to ethernet using a usb dongle, then capture it
using a switch that provides a mirror port

> If only I could find
> a Wireshark-like app for Android that actually worked (as proved by monitoring a
> known-good web site access) and which didn't require the phone to be rooted.

android being linux, you could probably use tcpdump on it to capture, but it
would likely involve rooting the phone

Andy Burns wrote:

> separate access point, connected to a switch that has (preferably hardware)
> mirror port

Cheapie switch that will do the trick

<https://amazon.co.uk/TP-Link-TL-SG105E-switch/dp/B00N0OHEMA>

connect it to the xDSL router, connect an old router acting as AP only to it
with a unique SSID for the phone to use, through the GUI configure a mirror port
from the AP port to another port, connect a PC to that port and see everything
with wireshark ...

"Andy Burns" <usenet@andyburns.uk> wrote in message
news:jnlr0tFpul0U1@mid.individual.net...
> Andy Burns wrote:
>
>> separate access point, connected to a switch that has (preferably
>> hardware) mirror port
>
> Cheapie switch that will do the trick
>
> <https://amazon.co.uk/TP-Link-TL-SG105E-switch/dp/B00N0OHEMA>
>
> connect it to the xDSL router, connect an old router acting as AP only to
> it with a unique SSID for the phone to use, through the GUI configure a
> mirror port from the AP port to another port, connect a PC to that port
> and see everything with wireshark ...

Ordered one of these. Got an old router that I can use as an AP. Do I need
to do anything special with the router-AP, or will it work if it's in the
default config as a router and I connect one of its normal LAN ports (as
opposed to its WAN port) to the switch? Certainly the router works fine as
an AP when connected to an existing unmanaged switch, and the phone can
access the internet when connected to this router's wifi. The fault with my
webspace site still exists, but then I'd have been very surprised if that
had not been the case ;-)

I'll report back tomorrow when the managed switch has arrived and I've
configured port mirroring, and then proved that I can see the expected
traffic in Wireshark on a PC connected to the mirror port, accessing a site
that works. Once I've proved that I can see what I expect, I'll repeat with
the site that fails. Should be interesting... Especially when I compare
with a different computer that *can* access that same site.

Something that fails permanently, I can understand. But something that fails
consistently for a few days, then works consistently for a few days, then
starts failing again - that's bizarre.

NY wrote:

> Andy Burns wrote:
>
>> <https://amazon.co.uk/TP-Link-TL-SG105E-switch/dp/B00N0OHEMA>
>
> Ordered one of these. Got an old router that I can use as an AP. Do I need
> to do anything special with the router-AP,
just disable DHCP on it so it doesn't clash with your normal router and give it
a fixed IP in the correct subnet for your network.

> or will it work if it's in the default
> config as a router and I connect one of its normal LAN ports (as opposed to its
> WAN port) to the switch?

yep.

> Certainly the router works fine as an AP when connected
> to an existing unmanaged switch, and the phone can access the internet when
> connected to this router's wifi. The fault with my webspace site still exists,
> but then I'd have been very surprised if that had not been the case ;-)

yes, the AP itself (or the AP part of your main router/switch/AP) should have
little to do with it.

> I'll report back tomorrow when the managed switch has arrived and I've
> configured port mirroring, and then proved that I can see the expected traffic
> in Wireshark on a PC connected to the mirror port, accessing a site that works.
> Once I've proved that I can see what I expect, I'll repeat with the site that
> fails. Should be interesting...  Especially when I compare with a different
> computer that *can* access that same site.
>
> Something that fails permanently, I can understand. But something that fails
> consistently for a few days, then works consistently for a few days, then starts
> failing again - that's bizarre.

does the work/fail period correspond to your website's DNS cache/expiry times?

On 9/5/2022 10:24 AM, Andy Burns wrote:

> android being linux, you could probably use tcpdump on it to capture, but it
> would likely involve rooting the phone

Does this need root?
https://www.androidtcpdump.com/android-tcpdump/downloads

NY wrote:

> Any suggestions as to how I proceed?

Andy Burns and VanguardLH have you covered on the networking side (which, I
admit, I understood almost none of when I read their detailed responses so
I'm glad you have the experience I lack to act on their astute advice).

The only way I can possibly help is to google the answer to the question
asked in the title (which wasn't necessarily asked in the body).

You have an older Android 8 so the older articles might still be useful.
First hit (turns out to be a shill - but it begs a question)...

*How to Clear DNS Cache on Android Devices*
<https://beebom.com/how-to-clear-dns-cache-android-devices/>

As the OP had predicted, these are mostly about clearing web browser cache.
But at the bottom was information about 'system' settings.
Settings > Wi-Fi > {SSID} > Modify network > Advanced options
IP settings > Static > {change DNS servers manually}

Drat. That's not about clearing cache - but wait - if you _change_ the DNS
server, does _that_ (in and of itself) cause the DNS cache to be flushed?

At the end of that article was the payback shill for this appl
*DNS Changer: Mobile Data, WiFi* by BGNmobi
<https://play.google.com/store/apps/details?id=com.burakgon.dnschanger>
"The DNS Changer change�s your device�s DNS address"

I found plenty of DNS Changers which are both ad free & gsf free,
where I'll just list the one on top of a filtered search based on being
free, ad free, gsf free, over a million downloads & rated highly
(since all these "DNS Changers" seem to do is muck with settings).
*DNSChanger for IPv4/IPv6 * by Frostnerd.com
free, ad free, gsf free, rated 4.6 of 48K reviews with 1M+ downloads
<https://play.google.com/store/apps/details?id=com.frostnerd.dnschanger>

The question this brings up is whether simply changing the Android system
networking DNS servers will "clear" the previous existing DNS cache?

Does it?
How can we tell?
--
Posted out of the goodness of my heart to disseminate useful information
which, in this csae, is how to clear the DNS cache on Andriod 8 & above.

NY wrote:

> If only I could find a Wireshark-like app for Android that actually worked

Dunno if these "actually work" sans root, but this first hit says some do.
*7 Best Wireshark Alternatives for Android*
<https://techonation.com/best-wireshark-alternatives-android/>
1- CSPLOIT (free, root)
2- ZANTI (free, root)
3- DEBUG PROXY (free, no root)
4- PACKET CAPTURE (free, no root)
5- TPACKETCAPTURE (fremium, no root)
6- ANDROID TCPDUMP (free, root)
7- NMAP (free, no root)

Note this was the first hit in a Google search, and even as I don't see
"ad" sponsored content, this appears to be a shill for "aptoide".

Even so, you can get the app on your own, but I looked for Debug Proxy
by dritanhaderaj, and couldn't find it on the Google Play Store web i/f.

Looking for Packet Capture, I found this free, ad free, gsf free app
*PCAPdroid - network monitor* by Emanuele Faranda
Free, ad free, gsf free, inapp$, rated 4.2 460 reviews 100K+ downloads
<https://play.google.com/store/apps/details?id=com.emanuelef.remote_capture>
"PCAPdroid is a privacy-friendly open source app which lets you track,
analyze and block the connections made by the other apps in your device.
It also allows you to export a PCAP dump & extract metadata.
PCAPdroid simulates a VPN in order to capture the network traffic
without root. It does not use a remote VPN server.
All the data is processed locally on the device."

Is that a wireshark-like app for Android that actually works sans root?
--
Posted out of the goodness of my heart to disseminate useful information
which in this csae is to find a wireshark like app that works w/o root.

CDB wrote:

> Andy Burns wrote:
>
>> android being linux, you could probably use tcpdump on it to capture, but it
>> would likely involve rooting the phone
>
> Does this need root?
> https://www.androidtcpdump.com/android-tcpdump/downloads

<https://www.androidtcpdump.com/android-tcpdump>

"To use this application, you need to have:
A Rooted Android Device"

Andy Burnelli wrote:

> *PCAPdroid - network monitor* by Emanuele Faranda
> Free, ad free, gsf free, inapp$, rated 4.2 460 reviews 100K+ downloads
> <https://play.google.com/store/apps/details?id=com.emanuelef.remote_capture>
> "PCAPdroid is a privacy-friendly open source app which lets you track,  analyze
> and block the connections made by the other apps in your device.  It also allows
> you to export a PCAP dump & extract metadata.
>  PCAPdroid simulates a VPN in order to capture the network traffic  without
> root. It does not use a remote VPN server.  All the data is processed locally on
> the device."
>
> Is that a wireshark-like app for Android that actually works sans root?

Looks like it possibly is ...

On 05/09/2022 20:54, Andy Burns wrote:
> NY wrote:
>
>> Andy Burns wrote:
>>> <https://amazon.co.uk/TP-Link-TL-SG105E-switch/dp/B00N0OHEMA>
>>
>> Ordered one of these. Got an old router that I can use as an AP.  Do I
>> need
>> to do anything special with the router-AP,
> just disable DHCP on it so it doesn't clash with your normal router and
> give it a fixed IP in the correct subnet for your network.

Thanks for the reminder to turn off DHCP on the router that I'm using as
an AP. That could have messed up my network badly - a very elementary
mistake. ;-)

Here follows my attempt to make sense of the traces I've got.

I've got three traces: one of it working (immediate display of page in
browser), followed almost immediately by one of it failing (browser
times out), and then a third trace of the page eventually displaying
after a delay of about a minute.

Success
-------

No DNS query of the website, so maybe it's cached from a previous attempt.

HTTP GET request phone->website
HTTP GET response website->phone page contents.

and a few GETs of images on the site or externally.

Yippee!

Failure
-------

DNS query phone->router
DNS response router->phone responds with A record quoting server's
and its IP

phone->website TCP SYN port 33363->80
phone->website TCP SYN port 33364->80
phone->website TCP SYN port 33371->80

but then the only traffic to/from the phone is a load of TCP retransmits
phone->website (no response from web server).

Here are screenshots of the Wireshark packet summaries

https://i.postimg.cc/qRCSZ8nn/failure1.png (filter: all packets to/from
phone 192.168.1.80): DNS query of website goosebears.co.uk at packet 513
and response 514

https://i.postimg.cc/Y0R3X9XY/failure2.png (filter: conversation filter
traffic between phone and website goosebears.co.uk)

In failure2, notice that there was some traffic *before* the DNS query,
maybe left over from an earlier conversation: again a SYN that was
retransmitted.

And then from packet 515 (just after the DNS query) there are three SYN
packets with ports 33363, 33364 and 33371, with retransmissions at
intervals of about 1, 2, 7, 15 seconds from the original SYNs.

So the phone tries to send data and gets no response whatsoever.

I *think* my results have shown that the failure is not due to inability
to resolve the web site name, but a problem with packets from the phone
not being acknowledged, so the phone's browser eventually gives up.

Success after long delay
------------------------

I've just got a trace for the case where there is a very long delay in
the browser, but it eventually works:

https://i.postimg.cc/hPz5M8L0/long-delay1.png
https://i.postimg.cc/HsqPNJ31/long-delay2.png

These are different overlapping parts of the same trace, with a
conversation filter on phone and website, which Wireshark resolves as
ip-160-153-128-26.ip.secureserver.net but it's still the same IP as
goosebears.co.uk before (160.153.128.26). There was no DNS lookup, so
evidently it was cached.

Notice at packet 13829, the same pattern of three SYNs with ports 33901,
33902 and 33903, followed by a long sequence of restransmissions at ever
increasing intervals, but on the second screen, retransmitted packets
13821 get ACKed at 13834 and the connection continues with the HTTP GET
and response. That's a delay from relative time 25 seconds to relative
time 88 second (a gap of 63 seconds).

WTF!

NY wrote:

> the phone's browser eventually gives up.

what browser, Dolphin? Presumably you've tried others?

The retransmissions are what you'd expect if something between you nad the
webserver is chucking away packets in one direction or the other.

Is the webserver under your control? What O/S is it?

The TCP port number re-use is odd, generally only see that if some "rogue"
process is ripping through hundreds of TCP connection attempts per second and
wraps round 16 bit port number within the 2MSL_WAIT period.

> Success after long delay
> ------------------------
>
> I've just got a trace for the case where there is a very long delay in the
> browser, but it eventually works:

have you done anything to force keep-alives?

> WTF!

indeed, I didn't try to think too hard about that yet.

On 06/09/2022 19:08, Andy Burns wrote:
> NY wrote:
>
>> the phone's browser eventually gives up.
>
> what browser, Dolphin? Presumably you've tried others?

Yes, I've also tried Firefox and Google Chrome.

I've just tried three times with each browser. Dolphin and Chrome both
eventually produce "failed to load" messages. Firefox consistently
eventually gets through, with the delay between requesting the page and
it being displayed being typically around 60-90 seconds (Firefox seems
to have a longer timeout period: it is more patient and doesn't time
out!). When I'm back on the "router-AP" connected to the port-mirroring
switch, so I can get a Wireshark trace, I'll look to see if it's always
the same story: the first traffic after the browser requests the page
being a series of SYN packets with similar port numbers which retransmit
at ever-increasing intervals until one of them elicits a response and
everything then proceeds as normal.

> The retransmissions are what you'd expect if something between you and
> the webserver is chucking away packets in one direction or the other.

Yes, it looks as if either the phone's packets are not getting through
to the web server or else the server's replies are not getting back. I
wonder if there's a way to determine which...

It looks as if there's pretty major packet loss, though evidently not
100% if packets do occasionally get through. And interesting that once
initial contact has been made, all subsequent traffic gets through -
it's not as if the initial SYN packets finally get acked, but then the
next link in the chain incurs the same long delays and retries.

I was expecting to see the HTTP GET not producing a response from the
server, which could have been at a higher level (eg the HTTP server) but
it looks as if it's a much lower level where packets are disappearing
into a black hole.

> Is the webserver under your control?  What O/S is it?

No it's not. It's run by GoDaddy and we rent webhosting space. I'm not
sure what OS it is, but I *think* it's Unix.

> The TCP port number re-use is odd, generally only see that if some
> "rogue" process is ripping through hundreds of TCP connection attempts
> per second and wraps round 16 bit port number within the 2MSL_WAIT period.
>
>> Success after long delay
>> ------------------------
>>
>> I've just got a trace for the case where there is a very long delay in
>> the browser, but it eventually works:
>
> have you done anything to force keep-alives?

No. What would I do to force keep-alives?

I wonder whether I've got enough evidence to suggest where the problem
may lie, so I know whether to raise a support call with my ISP (Plusnet)
or with the web server hosting company (Godaddy).

The fact that the problem is dependent on the connection (ie ISP rather
than phone's mobile internet connection over Vodafone) tends to point
the finger at Plusnet. But why should it only affect one computer (my
phone) and one web server?

Wish me luck in trying to get either company interested in running
traces to track down the problem ;-) Would they even have the technical
expertise to interpret Wireshark traces, I wonder?

NY wrote:

> The fact that the problem is dependent on the connection (ie ISP rather than
> phone's mobile internet connection over Vodafone) tends to point the finger at
> Plusnet.

I'm also on plusnet, and after a few refreshes it's always ok on firefox windows
and firefox mobile

> But why should it only affect one computer (my phone) and one web server?

I presume there's zero chance of newer firmware for the S7?

I'd generally try to kill as many background apps while trying to run wireshark,
e.g the "local" traffic from the phone to 192.168.72 and .73

NY wrote:

> Here follows my attempt to make sense of the traces I've got.

Are you aware of right-clicking a packet and then doing follow TCP stream, to
look only at related packets?

Might make it more obvious if there's a fixed time between where
working/not-working happens, or an easier trace to show plusnet or godaddy?

"Andy Burns" <usenet@andyburns.uk> wrote in message
news:jnpq91FeopbU1@mid.individual.net...
> NY wrote:
>
>> The fact that the problem is dependent on the connection (ie ISP rather
>> than phone's mobile internet connection over Vodafone) tends to point the
>> finger at Plusnet.
>
> I'm also on plusnet, and after a few refreshes it's always ok on firefox
> windows and firefox mobile

The only landline broadband I've been able to test it on (apart from my own)
is my parents' Plusnet connection. It worked consistently - but I could have
been lucky and hit a time when it would have worked anyway: one of those
times when it works fine for several days, before then failing for several
days.

>> But why should it only affect one computer (my phone) and one web server?
>
> I presume there's zero chance of newer firmware for the S7?

I have seen an article somewhere that Samsung are planning to roll out newer
versions of Android to older phones. I'm not sure whether that will include
phones as "old" as the S7, or whether a new version of Android would include
a different TCP stack.

> I'd generally try to kill as many background apps while trying to run
> wireshark, e.g the "local" traffic from the phone to 192.168.72 and .73

I'm always amazed at how much extraneous crap gets transmitted over
Ethernet. As I was looking through one of my Wireshark traces yesterday, I
found a huge "dollop" of DNS queries (and responses) for web sites that
appeared in Dolphin's bookmarks list but which I had not visited since last
time I rebooted the phone. I wonder if Dolphin goes round periodically
testing all the bookmarks.

The 192.168.1.72/73 are my Raspberry Pis: one takes weather station data and
uploads it to the web site that is giving me all the trouble, and also has a
LAN web interface. The other is a PVR, which has a LAN web interface for
scheduling new TV programmes to record. I had killed off all other
foreground apps in the hope that this would reduce irrelevant LAN traffic,
but maybe I should have run the Samsung applet to kill of unused background
tasks as well. Thank goodness for Wireshark's source/destination IP filters.

(I wrote out a reply saying roughly what I've said above, on my laptop
(Thunderbird) last night, but TB was doing its usual trick of freezing
during the progress bar that marks the sending of an email or news posting,
and my posting seems to have vanished into thin air: not in the Drafts
folder nor in the Sent folder. Windows Live Mail seems not to suffer from
that problem.)

The only way I can possibly help is to google the answer to the question
asked in the title (which wasn't necessarily asked in the body).

You have an older Android 8 so the older articles might still be useful.
First hit (turns out to be a shill - but it begs a question)...

*How to Clear DNS Cache on Android Devices*
https://www.trickyworlds.com/how-to-turn-off-suggested-posts-on-instagram/

As the OP had predicted, these are mostly about clearing web browser cache.
But at the bottom was information about 'system' settings.
Settings > Wi-Fi > {SSID} > Modify network > Advanced options
IP settings > Static > {change DNS servers manually}

Drat. That's not about clearing cache - but wait - if you _change_ the DNS
server, does _that_ (in and of itself) cause the DNS cache to be flushed?

At the end of that article was the payback shill for this appl
*DNS Changer: Mobile Data, WiFi* by BGNmobi
https://play.google.com/store/apps/details?id=com.burakgon.dnschanger
"The DNS Changer change�s your device�s DNS address"

I found plenty of DNS Changers which are both ad free & gsf free, where I'll just list the one on top of a filtered search based on being
free, ad free, gsf free, over a million downloads & rated highly
(since all these "DNS Changers" seem to do is muck with settings).
*DNSChanger for IPv4/IPv6 * by Frostnerd.com
free, ad free, gsf free, rated 4.6 of 48K reviews with 1M+ downloads
https://play.google.com/store/apps/details?id=com.frostnerd.dnschanger

The question this brings up is whether simply changing the Android system
networking DNS servers will "clear" the previous existing DNS cache?